Exit C1000-018 IBM QRadar SIEM V7.3.2 Fundamental Analysis
Question 1 of 5
0% complete
Q1 Single choice

An analyst needs to find all events that are creating offenses that are triggered by rules that contain the word suspicious in the rule name.

Which query can the analyst use as a working sample?

  • A

    SELECT LOGSOURCETYPE(logsourceid), "from log_events where RULENAME(creeventlist) ILIKE '%suspicious%'

  • B

    SELECT LOGSOURCERULES(logsourceid), "from rule_events where RULENAME(creeventlist) ILIKE '%suspicious%'

  • C

    SELECT LOGGEDOFFENSE(logsourceid), *from offense_events where RULENAME(creeventlist) ILIKE '%suspicious%'

  • D

    SELECT LOGSOURCENAME(logsourceid), * from events where RULENAME(creeventlist) ILIKE '%suspicious%'

Previous Next