I have received two events from firewall with same username,qid,desctiption,payload and category and the only difference was destination IP.One event has an magnitude of 8 and other event has an magnitude of 10.I am unable to understand how qradar event magnitude of both events different based upon only destination IP however the qid,event description,category and payload was same.

------------------------------
Abdul Qudoos
------------------------------

You have probably already found articles about the Magnitude and its constituent parts. The linked article talks about Offense prioritization, but Magnitude is calculated using the three parts mentioned (and internally defined "formula") to produce a synthetic  indicator.  So, with a same event and only a destination IP being different, I'd say the latter fact could be a cause to get a different final magnitude rating (the event itself is mapped to unique QID with associated High & Low Level category and defined Severity rating; if you are absolutely sure that all other components in the events are really the same, than see what is the associated constituent values in the magnitude for each event when you hover the mouse over the magnitude bar - the Severity component is probably the same but maybe the Relevance part might differ?).

------------------------------
Dusan VIDOVIC
------------------------------