IBM Support

QRadar: Closed Offense Information

Question & Answer


Question

Is there a way for a user to reopen an offense after it has been closed?

Answer

No, at this time it is not possible to reopen a closed offense.

What does a closed offense look like?

Closed offenses have a red (X) icon in the Flag column.


Why can't I see closed offenses in the Offenses tab?

By default, closed offenses and hidden offenses are filtered from the view when the Offenses tab is selected.

How can I show closed offenses?

Users can show closed offenses by clicking the text (Clear Filter) for the Exclude Closed Offenses option under the Current Search Parameters section.


How can I request that this feature be added to future versions of QRadar?

If you would like to see this feature in future releases of QRadar, you can submit a Request for Enhancement (RFE).



To open a Request for Enhancement (RFE) for QRadar:
  1. Click the following link to go to the QRadar SIEM RFE page: https://ibm.biz/BdRPx5
  2. Log in to the support portal page.
  3. Click the Submit tab and fill in the required information.



Where do I find more information?
If you have additional questions or some of this content is not clear, you can see the QRadar forum or contact customer support:

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"--","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.1;7.0;7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
02 April 2020

UID

swg21691528