IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Modify Inactive offense timer

    Posted 06/19/24 08:28 AM

    Hello,

    is possible to modify the time interval after which a dormant offense is marked as "inactive"? Currently is set to 5 days, we would like to increase this interval if possible.

    B Regards,

    Davide



    ------------------------------
    Davide Salardi
    ------------------------------


  • 2.  RE: Modify Inactive offense timer

    Posted 06/20/24 04:26 AM

    Hi Davide,

    Unfortunately there is no way to change this timer.  The following link outlines information relating to Offenses and retention

    https://www.ibm.com/support/pages/qradar-information-about-offense-duration-retention-and-activity

    Should this be functionality that you require you can submit an IBM idea

    https://www.ibm.com/support/pages/welcome-ibm-ideas-portal

    Thanks



    ------------------------------
    John Dawson
    Qradar Support Architect
    IBM
    ------------------------------



  • 3.  RE: Modify Inactive offense timer

    Posted 06/20/24 05:39 AM

    Thanks John,

    we will evaluate if submitting a CER might be worth for this requirement, I will discuss about it with our SOC team.

    B Regards,

    Davide



    ------------------------------
    Davide Salardi
    ------------------------------

    Original Message


  • 4.  RE: Modify Inactive offense timer

    Posted 06/20/24 06:08 AM

    It would be interesting to try to understand why your team needs to do this.  What problem do you have that you think would be solved if you could increase this period?

    Paul



    ------------------------------
    Paul Ford-Hutchinson
    ------------------------------

    Original Message


Related Content