Elastic medium stable kql

IBM QRadar External Alerts

Generates a detection alert for each IBM QRadar offense written to the configured indices. Enabling this rule allows you to immediately begin investigating IBM QRadar offense alerts in the app.

View Source

Detection Logic

event.kind: alert and data_stream.dataset: ibm_qradar.offense

Field Validations

Loading…

Comments (0)

Loading comments...