Where does QRadar display R2R events?
Where does QRadar display R2R events?
QRadar displays R2R (right to rule) events in the Network Activity tab. These events typically relate to misconfigured or missing network hierarchy entries and are part of the network traffic monitoring and analysis functionality of QRadar. The Network Activity tab is where network traffic, including these types of events, is monitored and analyzed.
C seems most correct. R2R events indicate misconfigured network hierarchy. https://www.ibm.com/docs/en/qradar-common?topic=apps-qradar-use-case-manager-app Reduce the number of false positives by reviewing the most common configuration steps. Easily update network hierarchy, building blocks, and server discovery based on recommendations.
A should be correct
https://www.ibm.com/docs/en/qradar-common?topic=tuning-reviewing-your-network-hierarchy