Posted By
Pipotron 2.0
Wed July 17, 2019 07:11 AM
Found In
Egroup:
IBM Security QRadar
\
view thread
hi, your right about keeping original Payload and avoid expensive lookups in the first steps ;) but while adding information later using historic correlation, those informations can be add into indexed properties or simple properties ? same question with AQL properties or AQL custom.functions, ...
|