IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  How do anomaly detection rules work behind the code?

    Posted 08/07/20 11:28 AM

    I have successfully created an anomaly detection rule to help monitor the amount of traffic to a website and is alerting when the volume increased by x%. For an automated response, it would be helpful to know what the anomaly detection rule was currently using for the average it was basing the rule off of. I tried digging through the reference sets/maps/tables but could not find anything.

    Is there a place I can go to find what the rule is currently using for the is average to know when to trigger the rule?



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: How do anomaly detection rules work behind the code?
    Best Answer

    Posted 08/07/20 12:50 PM

    I found this after digging through the IBM documentation more, you can use the aggregated data and API to pull the counts:

    https://www.ibm.com/support/knowledgecenter/SS42VS_7.4/com.ibm.qradar.doc/t_qradar_adm_globalview.html



    #QRadar
    #Support
    #SupportMigration


Related Content