It would be interesting to try to understand why your team needs to do this. What problem do you have that you think would be solved if you could increase this period?
Paul
------------------------------
Paul Ford-Hutchinson
------------------------------
Original Message:
Sent: Thu June 20, 2024 05:38 AM
From: Davide Salardi
Subject: Modify Inactive offense timer
Thanks John,
we will evaluate if submitting a CER might be worth for this requirement, I will discuss about it with our SOC team.
B Regards,
Davide
------------------------------
Davide Salardi
Original Message:
Sent: Thu June 20, 2024 04:25 AM
From: John Dawson
Subject: Modify Inactive offense timer
Hi Davide,
Unfortunately there is no way to change this timer. The following link outlines information relating to Offenses and retention
https://www.ibm.com/support/pages/qradar-information-about-offense-duration-retention-and-activity
Should this be functionality that you require you can submit an IBM idea
https://www.ibm.com/support/pages/welcome-ibm-ideas-portal
Thanks
------------------------------
John Dawson
Qradar Support Architect
IBM
Original Message:
Sent: Wed June 19, 2024 08:27 AM
From: Davide Salardi
Subject: Modify Inactive offense timer
Hello,
is possible to modify the time interval after which a dormant offense is marked as "inactive"? Currently is set to 5 days, we would like to increase this interval if possible.
B Regards,
Davide
------------------------------
Davide Salardi
------------------------------