Hello Everyone,
I hope you all doing well..
I want to ask a question and need your advice based on your experience on QRadar regarding the triggered offenses.
my offense dashboard always have more than 1K offenses with 6k log sources environment including every thing but I think 1K offenses in average is too much and blocked visibility. i want to know the expected triggered offense if all rules tuned well [
let's assume no need to fine tuning] may the offense number exceed more than 100 offenses in average ?
Really appreciate your thoughts and share your experiences with number of offenses...
Regards,
------------------------------
Donald Lavag
------------------------------