An administrator needs to import data into QRadar for a specific use case.

The data that has been provided to the administrator is stored in records that map a key to a value.

Which type of data collection must the administrator create?

An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining

to the top abnormal events of the most bandwidth-intensive IP addresses.

How can the administrator do this?

An administrator receives an expensive custom rule notification.

Which tool can now be enabled via the Advanced ‘System Settings’ – Custom Rule Settings to help

troubleshoot this?