Reader small image

You're reading from  Building a Next-Gen SOC with IBM QRadar

Product typeBook
Published inJun 2023
PublisherPackt
ISBN-139781801076029
Edition1st Edition
Right arrow
Author (1)
Ashish M Kothekar
Ashish M Kothekar
author image
Ashish M Kothekar

Ashish has a total experience of more than 15 years working for IBM on various different platforms. He is currently working as tech evangelist for IBM Security products. He has been instrumental in developing more than 10 IBM certification exams including IBM products like QRadar, Cloud Pak for Security, IBM SiteProtector, IBM XGS, etc. He has worked with multiple customers on deploying and then upgrading IBM security products. He has contributed regularly by writing blogs and giving talks on security products. He has published many redpapers on the integration of security products with IBM Storage solutions like IBM Spectrum scale. These redpapers are now full-fledged solutions that are being sold. He has also cleared two Mandarin language exams and is HSK2 qualified.
Read more about Ashish M Kothekar

Right arrow

Understanding the Rule Wizard

As seen in Figure 7.1, there are options to create rules. When you click to create a new rule or click on the already available rules, the Rule Wizard opens. The following is a screenshot of what the Rule Wizard looks like. Notice that the rule has different components, such as rule name, rule definition, rule action, rule response, and so on.

Figure 7.2 – Rule Wizard – part 1

Figure 7.2 – Rule Wizard – part 1

While creating rules, it is important to understand each component and how it can be used. Let’s dive in.

Rule name

When creating a new rule, you can mention the name of the rule you want to create. In Figure 7.2, the name of the rule is marked as Inbound Email with Suspicious Subject. The rule name should actually be a description of what the rule does. It is very similar to writing readable code for any programming language. We use the right kinds of variable names in a programming language so that our code remains readable...

lock icon
The rest of the page is locked
Previous PageNext Page
You have been reading a chapter from
Building a Next-Gen SOC with IBM QRadar
Published in: Jun 2023Publisher: PacktISBN-13: 9781801076029

Author (1)

author image
Ashish M Kothekar

Ashish has a total experience of more than 15 years working for IBM on various different platforms. He is currently working as tech evangelist for IBM Security products. He has been instrumental in developing more than 10 IBM certification exams including IBM products like QRadar, Cloud Pak for Security, IBM SiteProtector, IBM XGS, etc. He has worked with multiple customers on deploying and then upgrading IBM security products. He has contributed regularly by writing blogs and giving talks on security products. He has published many redpapers on the integration of security products with IBM Storage solutions like IBM Spectrum scale. These redpapers are now full-fledged solutions that are being sold. He has also cleared two Mandarin language exams and is HSK2 qualified.
Read more about Ashish M Kothekar