Question & Answer
A limiter does not belong to an offense but to its rule. All rules chains related to an offense are reset when that offense is closed, so closing the offense resets all functions, limiters, and timers related to any of those rules. The following example illustrates this behavior:
You have rules A and B.
Events come in that trigger rules A and B to create the respective offenses A1 and B2.
You close offense A1, thus resetting all rule chains related to rule A.
When an event that triggers rule A comes in, QRadar dispatches a new event and creates a new offense for A.
When an event that triggers rule B comes in, QRadar dispatches a new event and adds the event to offense B2. This counts toward B's response limiter.
Was this topic helpful?
10 January 2023