Which advanced event-search query checks an IP address against the Spam X-Force category with a confidence value greater than 3?
The AQL XFORCE_IP_CONFIDENCE function evaluates an IP address for a specified X-Force category. An event query using the Spam category and the > 3 comparison is select * from events where XFORCE_IP_CONFIDENCE('Spam',sourceip)>3.
XFORCE_IP_CONFIDENCE
Spam
> 3
select * from events where XFORCE_IP_CONFIDENCE('Spam',sourceip)>3
Community Discussion