Question & Answer
Question
Similar to the if-then statement in programming languages, custom rules consist of a boolean operation and statements. If the QRadar custom rule engine (CRE) evaluates the boolean operation to true, then the CRE performs the configured rule actions and rule responses.
This course addresses the following rule actions:
- Changing severity, credibility and relevance of the event or flow
- Adding the event or flow to an offense
- Annotating the event or flow
- Dropping the event or flow by rule action and routing rule
Duration: 10 Minutes
Follow the link in related information to view the course on the IBM Security Learning Academy
Answer
The Security Learning Academy is a full service learning platform, providing various training objects and instruction options.
Related Information
[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version","Edition":" ","Line of Business":{"code":"LOB24","label":"Security Software"}}]
Was this topic helpful?
Document Information
Modified date:
07 July 2020
UID
ibm11094572