IBM C1000-162 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Offense magnitude

A computed weight reflecting event count, contributing rule weights, and time decay. It is not a raw event count, so a few high-weight events can outrank many low-weight ones.

Offense inactivity period

The interval with no new contributing events after which an offense closes automatically. Default is five minutes; closing does not delete the offense record.

Offense retention period

How long closed and open offenses remain stored before purge. Default is thirty days; shortening it removes older offenses and may break historical reporting.

Offense source IP key

Offenses are aggregated primarily by source IP, so events from one host triggered by different rules can merge into a single offense unless the source is excluded.

Offense exclusion filter

A global filter evaluated before offense creation that suppresses offenses matching specified source, destination, or rule criteria. It prevents creation rather than hiding existing offenses.

Offense closing reason

A configurable label recorded when an analyst closes an offense. It forms the audit trail and is grouped in offense reports to show triage outcomes.

Offense severity anchor

Offense severity is anchored to the highest-severity contributing rule and can be raised by magnitude. Equal-severity offenses may still differ in triage priority.

Building block

A reusable container of rule test conditions referenced by rules. It never generates offenses itself; disabling it silently disables every rule that references it.

Rule response limiter

The 'when' clause controlling how often a matching rule generates an offense, for example once per interval per source. It limits offense volume without changing detection logic.

Rule order value

Determines evaluation sequence within a rule group. The first matching rule with an offense-generating response consumes the event, so order decides which rule claims the match.

Threshold accumulation test

Counts matching events in a sliding time window per grouping key, usually source IP. The counter resets per key, so thresholds apply per source unless grouped otherwise.

OR-wrapped building block

A building block whose tests are alternatives. Referenced from a rule, it keeps multi-condition logic readable and independently testable instead of inlining many OR branches.

Regex rule test cost

Payload regular-expression tests are the most expensive rule condition. Anchor and narrow them, and place cheaper equality tests first to reduce evaluation load.

Disabled building block effect

Disabling a building block skips it at evaluation, which makes every rule test referencing it evaluate false. Check dependent rules before disabling any block.

Rule match versus offense yield

A rule with high match count but low offense yield usually needs a tighter test or a response limiter, since matches without offenses add cost without detection value.

AQL time modifier

Syntax such as LAST 24 HOURS or LAST 7 DAYS that bounds a query relative to execution time, not a fixed date, keeping scheduled searches aligned.

AQL UNIQUE function

Counts distinct values in a column. It is the standard way to find a source IP contacting many distinct destinations or a user hitting many hosts.

AQL LIKE and IMATCH

LIKE uses percent wildcards for pattern matching; IMATCH applies case-insensitive regular expressions. Both are slower than equality, so constrain time and indexed fields first.

Reference set join

A named collection of values, such as suspicious IPs, queried alongside event fields. It turns an ad hoc hunt into a repeatable watchlist-driven search.

Beaconing flow signature

Regular connection intervals with low, consistent byte counts and repeated destinations. Volume spikes are not required; periodicity is the primary indicator in flow data.

Hunt to saved search

A validated hunt query is stored as a saved search, which can then run on a schedule, feed a dashboard, or become the basis of a detection rule.

Hunt false-positive tuning

Adding exclusions such as NOT IN a reference set or asset-based filters to the query before promoting it to a rule, so the rule inherits the tuned logic.

Asset context in hunting

Asset identity, services, and vulnerability data let an analyst rank hunt findings by business criticality instead of by raw event count alone.

Dashboard item

A widget backed by a saved search, such as a chart, table, gauge, or map. Editing the saved search changes every dashboard referencing that item.

Fixed item time range

A per-item time range that overrides the dashboard range. It is a common cause of widgets appearing stale when the dashboard range is changed.

Dashboard auto-refresh cost

Refresh cost equals the summed query cost of all item saved searches. Heavy AQL on a short interval degrades console performance for all users.

Dashboard drill-down

Clicking a value passes it as a filter to a target view. The target saved search must expose that field for the drill-down to resolve correctly.

Dashboard clone behavior

Cloning copies item definitions but not the underlying saved searches. Edit or clone the searches separately to avoid mutating the original dashboard's data.

Quick filter versus AQL

Quick filter applies simple field conditions to the current view. AQL queries any supported table and is required for aggregation, grouping, and reference set joins.

Scheduled report delivery

Saved search results sent on a schedule such as hourly, daily, or weekly to email recipients or a file location, independent of dashboard refresh settings.

Report output formats

PDF and HTML render charts and tables for human readers; CSV and XML preserve raw rows for downstream processing and larger exports.

Report row limit

Reports are bounded by the saved search time range and row limit. Unbounded queries can time out, so constrain with LAST n DAYS and LIMIT.