We at times see information in the offense source summary which is inconsistent with the current records in the asset database and often couple of hours/days later the offense summary updates and show the updated asset information in the summary.

 

For example, the offense type is by the username. However the offense source summary would have different username than to the username in the events or username who was source of the offense. When looking at the asset database, it would have the right username (which is in the events) however the offense summary will still have a username which was seen couple of days ago.

 

Is there a polling time where the offense would poll asset database to update the information presented in the offense summary?

------------------------------
DEEP SINGH
------------------------------

Hello Deep, 

Have you been able to sort out the issue you are facing?

I am having similar issue here as well. Below is a description. 

We have enable a rule on our qradar appliance to monitor traffic to a specific destination and to generate an offense whenever the traffic is triggered. There is a user (I will call it user abc) on our active directory which is disable now for 2 months. Whenever user xyz access the monitored destination, the offense is generated. When we go to the offense description and check the username who access the destination we see the username of user abc which is disable and not user xyz.

Is there a way to find out what is causing the issue?

Thanks

------------------------------
Parvesh Dhurmea
------------------------------