Week4

Offense rule, offense management and offense storage is done by the _________

• Event Processor

• Magistrate

• Event Collection

displays the rules and building blocks that are used by IBM® QRadar®.

• Device Support Module DSM

• Custom Rules Engine (CRE)

• Flows Per minute (FRM)

It is a method of converting a data from one format to another

• Parsing

• Normalization

• Deduplication

___________allows rules testing across multiple Event Processors in the QRadar SIEM deployment

• Custom Rule Engine

• Global Cross Correlation

• Event Collector

Database for the event processor

• Ariel

• PostgreSQL

• SQL

a component of IBM Qradar that collects flow data from multiple sources

• flow collector

• QFlow

• event collector

Database for the Magistrate

• PosgreSQL

• SQL

• Ariel

This method is implemented in the source code and determines the application by analyzing the payload for multiple markers

• State based decoders

• User-defined

• Port-based

• Signature matching

is linked to an extracted log source event ID

• QID

• QID

• EID

If an Open Offense did not find additional matches for more than 30 minutes, it becomes a _______________

• Dormant Offense

• Active Offense

• Open Offense

• Closed Offense