IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
Back to discussions
Expand all | Collapse all

How are commas treated in rules/BBs?

  • 1.  How are commas treated in rules/BBs?

    Posted 05/17/21 08:07 PM

    Hi,

    I'm still learning my way around QRadar and I have a question re: rules syntax. If I have a rule that includes a condition such as 'and when BB:CategoryDefinition: Authentication Failures match at least 15 times with the same Source IP, Destination IP, Event Name in 5 minutes', are 'Source IP', 'Destination IP' and 'Event Name' handled with an AND - e.g. all three have to be the same all 15 time they're tested, or with an OR - e.g. only one of the three needs to be the same all 15 time for the BB to be true?

    Thanks

    Dave



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: How are commas treated in rules/BBs?
    Best Answer

    Posted 05/20/21 01:39 PM

    Yes, for the condition to be true, it has to be to the same.



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: How are commas treated in rules/BBs?
    Best Answer

    Posted 05/20/21 02:45 PM

    Thank you.



    #QRadar
    #Support
    #SupportMigration


Related Content