An administrator opens the Offenses section and goes to Rules to edit the system notification rule. What is the rule name for system notifications?

In IBM QRadar SIEM, system health events are processed by a specific, predefined rule to generate alerts and offenses for administrators. The default rule responsible for this function is explicitly named "System: Notification". This rule is designed to monitor a wide range of internal system events, such as service failures, license limit warnings, deployment issues, and performance threshold breaches. When one of these events occurs, this rule triggers to create a notification, which typically manifests as an offense on the "Offenses" tab, ensuring that system health issues are promptly brought to the attention of the security team.

B. System: Hardware and Software monitoring: This is a descriptive phrase for a category of monitoring, not the specific name of the default rule that generates system notification offenses in QRadar.

C. System: Software Notifications: This name is too specific. The primary system notification rule is more general, covering software, hardware, licensing, and performance issues, not just software-related events.

D. System: Hardware Notifications: This is also too specific. The default "System: Notification" rule encompasses a broader range of system health events beyond just hardware failures.

1. IBM QRadar SIEM Administration Guide (Version 7.5.0): In the section "System notifications," the documentation states, "System notifications are generated by the System: Notification rule. This rule monitors system health and generates notifications when system functions fail or exceed configured thresholds." (Source: IBM Documentation, QRadar SIEM 7.5.0, Administration Guide, Chapter: "System notifications").

2. IBM QRadar SIEM Core Functionality Guide: The guide details default rule sets, where "System: Notification" is listed as a key rule within the system monitoring rule group. It is responsible for creating offenses from system events that are sent to the SIEM for self-monitoring purposes. (Source: IBM Documentation, QRadar SIEM Core Functionality Guide, Section: "Default Rules").