C1000-156: IBM Security QRadar SIEM v7.5 Administration

By IBM · Question Mode

QuestionQ16

IBM Security QRadar SIEM v7.5 Administration

An administrator wants to optimize event and flow payload searches for log data retained for up to one month.

What must the administrator do to meet this requirement?

Explanation

QRadar uses payload indexes for fast event and flow payload searches. The Payload Index Retention setting controls how long those indexes are retained; searches outside that retention period can be slow and resource-intensive. Configure payload-index retention to cover the required month.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!