Question & Answer
Question
IBM QRadar SIEM alerts to suspicious activity by creating offenses. An offense contains and links to information helpful to investigate it, such as events, flows, and asset profiles. Many offenses turn out to be false positives, and some false positives can be prevented by properly tuning the QRadar configuration.
The QRadar network hierarchy can cause false positives if it does not completely reflect which IP address ranges are local.
In this video, you learn how to change the network hierarchy based on the conclusion that an offense is a false positive.
Duration: 9 Minutes
Follow the link in related information to view the course on the IBM Security Learning Academy
Answer
The Security Learning Academy is a full service learning platform, providing various training objects and instruction options.
Related Information
Was this topic helpful?
Document Information
Modified date:
11 December 2020
UID
ibm11094944