C1000-156: IBM Security QRadar SIEM v7.5 AdministrationDemo

By IBM · Question Mode

QuestionQ16

IBM Security QRadar SIEM v7.5 Administration

An administrator wants to optimize event and flow payload searches for log data retained for up to one month.

What must the administrator do to meet this requirement?

  • A Configure the retention period for search indexes.
  • B Configure the retention period for property indexes.
  • C Perform a clean on the search model.
  • D Configure the retention period for payload indexes.
Explanation

QRadar uses payload indexes for fast event and flow payload searches. The Payload Index Retention setting controls how long those indexes are retained; searches outside that retention period can be slow and resource-intensive. Configure payload-index retention to cover the required month.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!