Which two options does a QRadar analyst need to configure in the False Positive window of the QRadar Console to mark an event or flow as False Positive?

exams C1000-163 C1000-163 exam 0 Comments

Which two options does a QRadar analyst need to configure in the False Positive window of the QRadar Console to mark an event or flow as False Positive?
A . Event or flow property and username
B . Asset and traffic direction
C . Event or flow property and traffic direction
D . Event or flow property and port number

Answer: C