Why would an analyst update host definition building blocks in QRadar?
A . To reduce false positives.
B . To narrow a search.
C . To stop receiving events from the host.
D . To close an Offense
Answer: D
Explanation:
Building blocks to reduce the number of offenses that are generated by high volume traffic servers.
Reference: https://www.ibm.com/docs/en/qsip/7.4?topic=phase-qradar-building-blocks
Latest C1000-018 Dumps Valid Version with 60 Q&As
Latest And Valid Q&A | Instant Download | Once Fail, Full Refund