Use Case Manager: This app is specifically designed for investigation and analysis of offenses within QRadar. It offers more focused tools for this task than general Reports.
Active Rules: This view within the Use Case Manager provides insights into rules that directly triggered offenses. This is essential for filtering down to our target rules.
Filtering:
Start Date: Allows you to limit the analysis timeframe to the "previous week" as specified in the question.
Closure Reason: Crucially, this lets you isolate offenses marked as "False Positive" or "Tuned" – the core of the question.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit