Notifications
Clear all
Topic starter
27/12/2022 1:31 pm
What is an approach to tuning a “noisy” rule, that is, a rule that generates too many offenses?
- A . Determine whether the rule matches too many conditions in the traffic.
B. In the offense output, scroll down and review the “Excessive” flags.
C. Confirm that the rule is enabled.
D. Use the QRadar Pulse app to map noisy offense output.
Suggested Answer: A