IBM Exam C1000-162 Topic 2 Question 25 Discussion

Actual exam question for IBM's C1000-162 exam

Question #: 25
Topic #: 2

What is an effective method to fix an event that is parsed an determined to be unknown or in the wrong QReader category/

ACreate a DSM extension to extract the category from the payload

BCreate a Custom Property to extract the proper Category from the payload

COpen the event details, select map event, and assign it to the correct category

DWrite a Custom Rule, and use Rule Response to send a new event in the proper category

Show Suggested Answer

Suggested Answer: B

The magnitude rating of an offense in QRadar is calculated based on relevance, severity, and credibility. Relevance determines the impact on the network, credibility indicates the integrity of the offense, and severity represents the level of threat. QRadar uses complex algorithms to calculate and periodically re-evaluate the offense magnitude rating.

by Jerrod at Sep 19, 2024, 02:40 AM

Limited Time Offer

25%

Off

Get Premium C1000-162 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tatum

3 months ago

I bet the developers who came up with these options were having a laugh. 'Let's see if they can figure out the sane one!'

upvoted 0 times

...

Dean

3 months ago

Hmm, I wonder if there's an 'E) Summon the QReader gods and offer them a sacrifice' option hidden somewhere.

upvoted 0 times

Eladia

26 days ago

D) Write a Custom Rule, and use Rule Response to send a new event in the proper category

upvoted 0 times

...

Ailene

1 months ago

C) Open the event details, select map event, and assign it to the correct category

upvoted 0 times

...

Audry

1 months ago

B) Create a Custom Property to extract the proper Category from the payload

upvoted 0 times

...

Elke

2 months ago

A) Create a DSM extension to extract the category from the payload

upvoted 0 times

...

Yolando

3 months ago

Option A? Really? Creating a whole DSM extension for this? That's like using a sledgehammer to crack a nut.

upvoted 0 times

Daren

2 months ago

D) Write a Custom Rule, and use Rule Response to send a new event in the proper category

upvoted 0 times

...

Felice

2 months ago

C) Open the event details, select map event, and assign it to the correct category

upvoted 0 times

...

Rochell

2 months ago

B) Create a Custom Property to extract the proper Category from the payload

upvoted 0 times

...

Kandis

3 months ago

Option B could work, but creating a custom property just to extract the category seems like overkill. I'd rather use a more direct approach.

upvoted 0 times

Jade

2 months ago

D) Write a Custom Rule, and use Rule Response to send a new event in the proper category

upvoted 0 times

...

Lindsey

3 months ago

C) Open the event details, select map event, and assign it to the correct category

upvoted 0 times

...

Dylan

3 months ago

A) Create a DSM extension to extract the category from the payload

upvoted 0 times

...

Latricia

3 months ago

I'd go with Option D. Writing a custom rule to handle the issue and generate a new event in the proper category seems more flexible and scalable.

upvoted 0 times

Julio

3 months ago

I prefer creating a Custom Property to extract the proper Category.

upvoted 0 times

...

Stephaine

3 months ago

Creating a DSM extension could work too.

upvoted 0 times

...

Marci

3 months ago

I agree, writing a custom rule seems like the most effective solution.

upvoted 0 times

...

Danica

3 months ago

I think Option D is the best choice.

upvoted 0 times

...

Lavina

4 months ago

Option C looks like the most straightforward solution. Modifying the event mapping seems like the easiest way to reassign the category.

upvoted 0 times

Jolene

3 months ago

I think creating a Custom Property could also work well to extract the correct category.

upvoted 0 times

...

Lawanda

3 months ago

I agree, option C seems like the most efficient way to fix the event category.

upvoted 0 times

...

Shanice

4 months ago

I believe writing a Custom Rule and using Rule Response is the most effective way.

upvoted 0 times

...

Lavonne

4 months ago

I prefer creating a Custom Property to extract the proper Category.

upvoted 0 times

...

Elsa

4 months ago

I think creating a DSM extension is the best method.

upvoted 0 times

...