IBM Support

QRadar: What is the meaning of the letter (C) diplayed on flow data for the Source Bytes or Destination Bytes Column?

Question & Answer


A flow is a record of the communication between two machines. In these flows, they have a start and end time, or a life of multiple seconds. For example, when you connect to a website, the communication includes HTML files, images, flash files, or other and might take some time to transfer the data.


In this case, the (C) letter indicates that the flow contains a content capture from the first 64 or 96 bytes of the flow payload.

[{"Type":"MASTER","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsuAAA","label":"Flow Source"}],"ARM Case Number":"TS000000000","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Document Information

Modified date:
31 October 2022