Which is a valid routing rule combination?

In IBM QRadar SIEM, routing rules determine how incoming events are processed before they are written to storage. A single routing rule can be configured with multiple actions. The combination of "Forward" and "Bypass Correlation" is valid. This configuration allows an event to be sent to an external destination (e.g., another SIEM or a data lake) while also being stored locally on QRadar for searching and reporting, but without being analyzed by the Custom Rules Engine (CRE). This is useful for managing system load or for events that are needed for archival but not for real-time threat detection.

A. Drop and Bypass Correlation: The "Drop" action immediately removes the event from the QRadar pipeline. Therefore, no further actions, such as bypassing correlation, can be performed on it.

B. Drop and Log Only: The "Drop" action prevents the event from being stored or processed. This directly contradicts the "Log Only" action, which requires the event to be written to disk.

D. Bypass Correlation and Log Only: "Bypass Correlation" and "Log Only" describe the same outcome: the event is written to storage but is not sent to the correlation engine. They are not two separate, combinable actions within a routing rule.

1. IBM QRadar SIEM Administration Guide (Version 7.5.0): In the chapter on "Events," the section "Routing rules" describes the available actions. It explicitly states, "You can select multiple actions for the rule. For example, you can select to forward the event and to bypass correlation." This confirms that forwarding and bypassing correlation is a supported combination. The guide also clarifies that a dropped event "is removed from the QRadar data pipeline," making it impossible to combine with any other action. (IBM Security QRadar SIEM Administration Guide, Version 7.5.0, Document number: SC27-9228-02, Chapter 6: Events, Section: Routing rules).