Offense Analysis
Offense Analysis is the domain where the exam checks whether you can triage a QRadar offense correctly: read its magnitude, trace its contributing rules, pivot into the underlying events and flows, and make a defensible disposition. It is not a tour of buttons; it tests judgment about priority and evidence.
What an offense is
An offense is a correlation result produced by one or more rules. It aggregates related events and flows, source and destination IPs, and rule contributions. Key attributes include magnitude, severity, relevance, credibility, status, assigned user, offense type, and annotations. Magnitude is a composite risk score, not a raw event count; severity comes from the rule, relevance reflects asset importance, and credibility reflects confidence. It changes as new evidence contributes.
Investigation workflow
- Start with magnitude and the offense summary, not the event count.
- Open Contributing Rules to see which logic fired and what it tests.
- Pivot to events and flows to confirm the behavior, then check asset weight and network context.
- Check annotations and notes for prior analyst work; add your own.
- Assign, protect, or close with a reason. Status values include OPEN, HIDDEN, and CLOSED; protected offenses are preserved from automatic cleanup.
Worked example: An offense has magnitude 7, 45 events, source 10.1.1.5, and no owner. The analyst opens Contributing Rules, finds an authentication-failure rule, pivots to events and sees repeated failures against a critical asset, then checks the asset weight. Because the target is critical, relevance is high and the behavior is not a scan false positive. The analyst assigns the offense, protects it, annotates the evidence, and escalates. Reasoning: magnitude and asset context drove priority; event count alone did not.
Traps
- Treating severity as magnitude; magnitude is composite.
- Closing on event count or a single log line without rule and asset context.
- Confusing HIDDEN with CLOSED.
- Forgetting that protected offenses survive retention cleanup.
- Ignoring prior notes and duplicating work.