IBM Support

QRadar: Building Block of type Common will not reflect flows when added to System: Load Building Blocks

Question & Answer


Will a building block of type: Common work when added to 'System: Load Building Blocks'?


The rule, System: Load Building Blocks is an Event only rule. If a building block is created from Type: Common, which includes both Events and Flows, and is then added to the System: Load Building Blocks rule, it will load, but will only reflect Event offenses and not Flow offenses. Flow offenses can be triggered when using Flow rules, which are then bound to the building block used in a Flow rule.

Note: To use a type Common Building Block in a rule you need to apply it to a type Common Rule.
Rules of the type Common are used when Flows and Events need to be tested together in the same test, in sequence, in the same test group.


Where do you find more information?

Related Information

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Offense Manager","Platform":[{"code":"PF016","label":"Linux"}],"Version":"Version Independent","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
31 August 2018