IBM QRadar: Rules: Difference between revisions

From Wiki
No edit summary
Line 12: Line 12:
{| class="wikitable"
{| class="wikitable"
|-
|-
! Header text !! Header text !! Header text
! Tipo !! Rule !! Description
|-
|-
| Windows Events ||
| Windows Events ||
Line 21: Line 21:
'''and NOT''' when the source OP is on of the following '''IP addresses''' || Example
'''and NOT''' when the source OP is on of the following '''IP addresses''' || Example
|-
|-
| Example || Example || Example
| . || . || .
|-
|-
| Example || Example || Example
| . || . || .
|}
|}


Revision as of 18:47, 19 January 2025

Uma Rule (regra) é um grupo de testes que podem desencadear uma ação se condições específicas forem atendidas.


Artigos

Exemplos

Tipo Rule Description
Windows Events

Apply Potential Windows Enumeration Detected
and when an event matches any of the following BB: Windows Endpoint Events
and when the event matches Event ID is any of 4688
and when the event matches Command (custom) any of [whoami or tasklist or system info]
and NOT when the source OP is on of the following IP addresses || Example

. . .
. . .

Ver também

Retrieved from "https://ebasso.net/wiki/index.php?title=IBM_QRadar:_Rules&oldid=9199"