IBM C1000-162 cheat sheet

Offense severity is computed from the contributing rules' severity values plus magnitude; the highest-severity contributing rule anchors the offense severity, and magnitude can raise it further.

Offense magnitude is not a simple event count: it is derived from event count, contributing rule weights, and time decay, so 100 events from one low-weight rule can rank below a few events from a high-weight rule.

Offense indexing uses source IP as the primary key; offenses from the same source IP are aggregated even when triggered by different rules, unless the source is excluded.

An offense closes automatically after its offense inactivity period (default 5 minutes) with no new contributing events; closing is not deletion, and closed offenses remain searchable.

Offense retention is governed by the offense retention period (default 30 days); shortening it purges older offenses, so verify compliance requirements before changing it.

Global offense filters (offense exclusions) suppress offenses for matching source/destination or rule criteria and are evaluated before offense creation, unlike rules that fire but are filtered later.

The offense annotation/notes field and offense closing reason are the audit trail for analyst decisions; closing reasons are configurable and appear in offense reports.

Offense score in the UI is a composite of severity and magnitude; two offenses with equal severity but different magnitude are not equivalent triage priorities.

Correlated offense rules can create an offense from multiple contributing events within a time window, so a single source IP generating diverse low-severity events can still produce a high-magnitude offense.

A rule fires when its test conditions match AND all building blocks referenced in its tests evaluate true; building blocks are reusable test containers, not standalone rules that generate offenses.

Building blocks can reference other building blocks, but nesting depth should stay shallow: each nested level multiplies evaluation cost across every rule that uses the block.

Rule response limiter (the 'when' clause) is separate from the test: a rule can match on every event but only generate an offense once per interval per source, which controls offense volume without changing detection.

Rule threshold/accumulation tests count matching events in a sliding time window; the window resets per grouping key (typically source IP), so thresholds are per-source unless grouped otherwise.

A building block containing only 'AND' tests narrows matches; wrapping alternatives in an 'OR' block and referencing it from a rule keeps the rule readable and testable independently.

Rules are ordered by their configured order value within the rule group; the first matching rule with an offense-generating response consumes the event, so order determines which rule claims a match.

Disabled rules and disabled building blocks are skipped at evaluation; disabling a building block silently disables every rule test that references it, so check dependents before disabling.

Rule test 'when the event matches' conditions use QID, source/destination IP, port, username, and payload/regular-expression matches; regex tests are the most expensive and should be anchored and specific.

Event rate and rule performance are visible in the rule's contribution to event pipeline metrics; a rule with high match count and low offense yield usually needs a tighter test or a response limiter.

Hunting starts from a hypothesis expressed as an AQL query; the query returns raw events, and the analyst pivots from event to offense, asset, and flow data using shared fields such as source IP and username.

AQL supports SELECT, FROM events|flows|offenses|assets, WHERE, GROUP BY, ORDER BY, LIMIT, and LAST n MINUTES/DAYS time modifiers; time modifiers are relative to query execution, not to a fixed date.

AQL aggregation functions include COUNT, SUM, AVG, MIN, MAX, and UNIQUE; UNIQUE counts distinct values and is the standard way to find a source IP hitting many distinct destinations.

AQL string matching uses LIKE with % wildcards and IMATCH for case-insensitive regex; regex predicates are slower than equality and should be constrained by time and indexed fields first.

Reference sets (reference data collections) can be joined in AQL against event fields; a watchlist of suspicious IPs stored as a reference set turns a hunt into a repeatable query.

Flow data (NetFlow/IPFIX) supplies bytes, packets, and direction; a hunt for beaconing looks for regular intervals and low, consistent byte counts rather than volume spikes.

Saved searches convert a validated hunt into a scheduled report or dashboard item; the same AQL that answered the hypothesis becomes the recurring detection artifact.

False-positive tuning in a hunt means adding exclusions to the query (NOT IN a reference set, asset-based filters) before promoting it to a rule, so the rule inherits the tuned logic.

Asset model context (asset identity, services, vulnerabilities) lets a hunt rank findings by business criticality rather than by raw event count alone.

A dashboard is a container of dashboard items; each item is backed by a saved search, and editing the saved search changes every dashboard that references it.

Dashboard item types include charts (time series, bar, pie), tables, gauges, and map widgets; the choice is driven by whether the question is trend, comparison, distribution, or geography.

Dashboard time range can be set per dashboard and per item; an item with a fixed range ignores the dashboard range, which is a common cause of 'stale' widgets.

Dashboard auto-refresh interval is configured per dashboard; refresh cost equals the sum of the underlying saved searches' query cost, so heavy AQL on a short interval degrades the console.

Dashboard permissions follow the owning user/role plus sharing settings; a dashboard shared read-only still executes its saved searches with the viewer's data access, so verify role-based visibility.

Drill-down from a dashboard item passes the clicked field value as a filter into the target; the target saved search must expose that field for the drill-down to resolve.

Default dashboards can be assigned per user or role so each console login lands on the relevant view; the 'Offenses' overview is a built-in dashboard, not a custom one.

Cloning a dashboard copies item definitions but not the saved searches; clone-then-edit the searches separately to avoid mutating the original dashboard's data source.

Quick filter searches the selected event/flow/offense view with simple field conditions; AQL searches any supported table and is the only way to aggregate, group, and join reference sets.

Saved search results can be delivered as reports on a schedule (once, hourly, daily, weekly, monthly) to email recipients or to a file location; the schedule is independent of the dashboard refresh.

Report formats include PDF, CSV, XML, and HTML; CSV/XML preserve raw rows for downstream processing, PDF/HTML render charts and tables for human readers.

Report content is bounded by the saved search's time range and row limit; an unbounded AQL report can time out, so always constrain with LAST n DAYS and LIMIT.

Scheduled report failure is visible in the report status and logs; common causes are recipient/email configuration, oversized result sets, and expired credentials for file delivery.

Search result export from the UI is capped by the configured export row limit and by role permissions; exports larger than the cap must be produced as scheduled CSV reports.

AQL date functions and NOW() allow relative windows inside the query; combining a relative window with a report schedule keeps recurring reports aligned to the schedule rather than to a fixed date.

Report distribution lists and groups are managed centrally; changing a group membership changes every scheduled report that targets that group.