C1000-156: IBM Security QRadar SIEM v7.5 AdministrationDemo

Question

Which advanced event-search query checks an IP address against the Spam X-Force category with a confidence value greater than 3?

A select * from flows where XFORCE_IP_CONFIDENCE('Malware',sourceip)=3
B select * from events where XFORCE_IP_CONFIDENCE('Malware',sourceip)>3
C select * from flows where XFORCE_IP_CONFIDENCE('Spam',sourceip)<3
D select * from events where XFORCE_IP_CONFIDENCE('Spam',sourceip)>3

Explanation

The AQL XFORCE_IP_CONFIDENCE function evaluates an IP address for a specified X-Force category. An event query using the Spam category and the > 3 comparison is select * from events where XFORCE_IP_CONFIDENCE('Spam',sourceip)>3.

Learn more

IBM QRadar: Advanced search options

C1000-156: IBM Security QRadar SIEM v7.5 AdministrationDemo

AstroTutor

Notes

Readiness

QuestionQ22

Community Discussion