After how much time will QRadar mark an Event offense dormant if no new events or flows occur?
QRadar will mark an Event offense as dormant if no new events or flows occur within 30 minutes. However, if QRadar did not process any events within 4 hours, this also triggers the offense to become dormant. Once dormant, the offense remains in this state for 5 days unless new events or flows are added.
Honey
11 days agoJohnson
4 days agoSuzan
16 days agoFrederick
17 days agoLashunda
22 days agoChun
27 days agoSuzan
1 months agoMalcom
1 months agoYoko
1 months agoAlesia
13 days agoTeri
17 days agoDelpha
23 days agoChun
1 months ago