Offense generation and management
When the rule conditions match, the rule action triggers. It completely depends on the options selected in the rule action section for an offense to be generated.
Important note
If all the conditions match and if the indexed property is null, an offense is not generated. For example, if the indexed property is a destination port but the event that triggers the offense does not have a destination port value (the value is null), then the offense is not generated.
This note is for a specific design element with which QRadar ensures that no offense is generated even if rule conditions are matched.
Another peculiar design feature is offense-chaining. Offenses are chained together to provide analysts with a deeper understanding of the security incident. It binds one or more offenses based on the offense index field. This helps analysts relate multiple offenses just by looking at one chained offense. Offense-chaining saves analysts a lot of time...
