Question & Answer
Question
Anomaly detection aims to alert to threats that are undocumented and therefore cannot be detected by methods that monitor for well defined indicators. Such threats can be detected by monitoring for an unusual volume of activities. With IBM® QRadar® SIEM, create anomaly detection rules to monitor for deviations from the baseline of expected activities.
In these exercises, you develop an anomaly detection rule of type Anomaly. It tests for the deviation of the number of events matching a grouped search from the weighted moving average. The rule fires in the exercise because the sample data spikes above the deviation percentage configured in the anomaly rule.
Duration: 45 Minutes
Follow the link in related information to view the course on the IBM Security Learning Academy
Answer
The Security Learning Academy is a full service learning platform, providing various training objects and instruction options.
Related Information
Was this topic helpful?
Document Information
Modified date:
07 July 2020
UID
ibm11094410