What is a benefit of using a span port, mirror port, or network tap as flow sources for QRadar?

What is a benefit of using a span port, mirror port, or network tap as flow sources for QRadar?
A . These sources are marked with a current timestamp.
B . These sources show the ASN number of the remote system.
C . These sources show the username that generated the flow.
D . These sources include payload for layer 7 application analysis.

View Answer

Answer: D

Explanation:

Reference:

https://www.ibm.com/developerworks/community/forums/html/topic?id=dd3861e0-f630-4a53-94c3­b426a47b6e02