IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Chain Rule creation

    Posted 01/31/20 03:03 PM
    Hi All ,

    I want to create chain rule in Qradar for inbound and outbound communication towards public IP.

     Public IP 'A' communicating to private IP's followed by any outbound connection towards public IP 'A' withing  'T' Hours.

    Example

    123.X.X.1 --- 10.Y.Y.1 ::::: Inbound connection
    10.Y.Y.2/172.X.X.X (Any private IP) --- 123.X.X.1 :::: Outbound connection


    Please guide me to develop rule condition.

    ------------------------------
    Tukaram Gaonkar
    ------------------------------