Câu 6: C2150-614: IBM Security QRadar SIEM V7.2.7 Deployment
A client has configured a log source to forward events to IBM Security QRadar SIEM V7.2.7. It is recommended that the log source level be configured at the notice level by the DSM Guide, but the client has a policy to log all events at a debug level. The Deployment Professional notices that the configured DSM is parsi…
Nội dung câu hỏi
A client has configured a log source to forward events to IBM Security QRadar SIEM V7.2.7. It is recommended that the log source level be configured at the notice level by the DSM Guide, but the client has a policy to log all events at a debug level. The Deployment Professional notices that the configured DSM is parsing most events, but some are being labeled as stored. The client is very interested in correlating some of the events that are being stored. What should be created to meet this client's goal?
Các lựa chọn
Đáp án được giữ gọn theo nhãn A, B, C, D trong phần bình chọn tương tác.
- A. Custom flow property
- B. Custom event property
- C. Custom DSM for parsing overrule
- D. Custom DSM for parsing enhancement — đáp án hiện tại
Cộng đồng
0 bình luận công khai. Tên thành viên được ẩn một phần.