Which QRadar rule could detect a possible potential data loss?
Posted: Fri Aug 26, 2022 9:58 am
Which QRadar rule could detect a possible potential data loss?
A. Apply Potential data loss on event of flows which are detected by the local system and when any IP is part of any of the following XForce premium Premium_Malware
B. Apply Potential data loss on flows which are detected by the local system and when at least 1000 flows are seen with the same Destination IP and different source in 2 minutes
C. Apply Potential data loss on events which are detected by the local system and when the event category for the event is one of the following Authentication and when any of Username are contained in any of Terminated_User
D. Apply Potential data loss on flows which are detected by the local system and when the source bytes is greater than 200000 and when at least 5 flows are seen with the same Source IP, Destination Port Destination IP in 12 minutes
A. Apply Potential data loss on event of flows which are detected by the local system and when any IP is part of any of the following XForce premium Premium_Malware
B. Apply Potential data loss on flows which are detected by the local system and when at least 1000 flows are seen with the same Destination IP and different source in 2 minutes
C. Apply Potential data loss on events which are detected by the local system and when the event category for the event is one of the following Authentication and when any of Username are contained in any of Terminated_User
D. Apply Potential data loss on flows which are detected by the local system and when the source bytes is greater than 200000 and when at least 5 flows are seen with the same Source IP, Destination Port Destination IP in 12 minutes