IBM Support

QRadar: What is the meaning of the letter (C) diplayed on flow data for the Source Bytes or Destination Bytes Column?

Question & Answer


Question

A flow is a record of the communication between two machines. In these flows, they have a start and end time, or a life of multiple seconds. For example, when you connect to a website, the communication includes HTML files, images, flash files, or other and might take some time to transfer the data.

Answer

In this case, the (C) letter indicates that the flow contains a content capture from the first 64 or 96 bytes of the flow payload.
C

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsuAAA","label":"Flow Source"}],"ARM Case Number":"TS000000000","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
31 October 2022

UID

ibm16472919