On the Offenses tab, which column explains the cause of the offense?

The Offense Type column identifies the detection engine or rule set (Correlation Rule, Anomaly, Policy, etc.) that generated the offense, thereby explaining its underlying cause, whereas other columns provide descriptive or metric information.

A. Description – Free-text name; may not indicate how the offense arose.
C. Magnitude – Quantifies the offense severity, not its origin.
D. IPs – Lists participating IP addresses only.

1. IBM QRadar SIEM User Guide 7.5.0, Table “Offenses view columns”, entry “Offense Type – Indicates what caused the offense”. (SC27-7524-06, p.203)

2. IBM Knowledge Center: “Understanding the Offenses tab” – description of Offense Type column.