C1000-156: IBM Security QRadar SIEM v7.5 AdministrationDemo

By IBM · Question Mode

QuestionQ20

IBM Security QRadar SIEM v7.5 Administration

When creating an identity exclusion search, which time range should you select?

  • A Previous 30 days
  • B Real time (streaming)
  • C Previous 5 minutes
  • D Previous 7 days
Explanation

IBM QRadar identity exclusion searches must use the Real Time (streaming) timespan so the saved search matches live incoming events and continuously excludes the specified identity data from Asset Profiler updates.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!