Questions in topic: "correlation"
https://developer.ibm.com/answers/questions/topics/single/192732.html
The latest questions for the topic "correlation"How do Data Nodes fit into a High Availability configuration
https://developer.ibm.com/answers/questions/505419/how-do-data-nodes-fit-into-a-high-availability-con.html
If I am right, a data node has a 1:1 relationship with an event processor but an event processor can have multiple data nodes.
In a HA configuration with two event processors, how do data nodes behave in case of a ep failover?qradarcorrelationhigh availabilitylocationTue, 21 May 2019 14:00:28 GMTRebssterCanonical Correlation, SPSS ver. 25
https://developer.ibm.com/answers/questions/503632/canonical-correlation-spss-ver-25.html
I need assistance understanding results/output from the Canonical Correlation procedure in SPSS version 25. Is there documentation? Thanks... OzstatisticscorrelationcanonicalMon, 06 May 2019 12:56:38 GMTOzzie5Canonical Correlation, SPSS ver. 25
https://developer.ibm.com/answers/questions/503629/canonical-correlation-spss-ver-25.html
I need assistance understanding results/output from the Canonical Correlation procedure in SPSS version 25. Is there documentation? Thanks... OzstatisticscorrelationcanonicalMon, 06 May 2019 12:55:05 GMTOzzie5Why are the partial correlations in an anti-image matrix negative?
https://developer.ibm.com/answers/questions/503379/why-are-the-partial-correlations-in-an-anti-image.html
So when you run an exploratory factor analysis in SPSS and are given the anti-image matrix, why is are the partial correlations made negative? I have asked several statisticians and have yet to be given a satisfactory answer. The only answer that I can come up with is that SPSS makes the partial correlations negative so that it is to visually see what variance would be taken out of the model if that was removed, although I am not entirely convinced by this answer. Any help would be greatly appreciated!correlationfactoranalysispartialfactorThu, 02 May 2019 14:48:24 GMTCheyene HornerOffense Rule for activity out of business hours
https://developer.ibm.com/answers/questions/498444/offense-rule-for-activity-out-of-business-hours.html
Hi,
I want to create an offense rule that fires, when events with certain QIDs occur out of business hours, lets say when they occur out of 8 am - 5 pm. How can I realize that in an offense rule? As far as I can see I only have the rule part "When the events occur before/after", which I can link with an AND-conjunction.
What I need is:
When the events occur before 8 am OR after 5 pm. Is there any posibility to do it this way?
Regards,
FabqradarrulesaqloffensescorrelationMon, 25 Mar 2019 13:07:52 GMTFabFDQRadar Historical Correlation not generating Offenses
https://developer.ibm.com/answers/questions/497899/qradar-historical-correlation-not-generating-offen-3.html
Hello all,
i have recently created dozen of new rules and i must test them on all events from the past week.
I decided to use Historical Correlation to achieve this.
The configuration was based on this document: https://ibm.co/2U2NuUo
The "Saved Search" was: events from 11 March to 18 March If Log Source Group is "MyGroup"
**Result is:**
- i can see in the "Catalogs" all events found
- i can see (from the single events detail) that events are completely matching my rules
- offense number is 0 so offense are not being created
**Expected result:**
- each time an events completely match a rule, a new offense tagged as "Historical" should be created
**Usefull informations:**
- all rules tested are enabled
- all rules are triggering offense in real time events
- current QRadar version: 7.3.1 Build 20181123182336
- Historical Correlation was configured from an Admin Account
**More tests:**
i activated rule "All Exploits Become Offenses" and all events categoryzed as "Exploit" from an IPS are triggering this rule in real time correctly.
Since the IPS was generating similar events last weeks, i expect some offense using this rule in Historical Correlation. As i said before, i can see events matching the rule in "Catalogs" but offense number is still 0.
I tried changing all possible options in the profile configuration but problem still exists.
Is this a bug?
Best regards, Luca.qradarproblemsiemcorrelationhistoricalWed, 20 Mar 2019 14:40:30 GMTLuca ReggianniniHow to calculate Mann Kendall's Tau-C in SPSS
https://developer.ibm.com/answers/questions/489486/how-to-calculate-mann-kendalls-tau-c-in-spss.html
Hi, I'm SPSS user.
Recently we are calculating tau-c using spss.
but, This value is different from directly calculated for tau-c.
I know that the equation used by SPSS is " tauC = Min(N, 2) * (C - D) / (N^2 * (Min(N, 2) - 1)) "
where,
C : Number of Concordant pair
D : Number of DisConcordant pair
N : Count of Data
Min(N, 2) : Choose Minimum among N and 2
Min(N, 2) always has to be 2 (because Mann-Kendall is Correlation Analysis, N always is greater than or
equal to 2)
Please ask if I know what correlect.....
Thank youstatisticscorrelationWed, 23 Jan 2019 06:53:33 GMTshyunginCorrelation payloads text & create rule
https://developer.ibm.com/answers/questions/480902/correlation-payloads-text-create-rule.html
Hello Team,
Need help
I want to search some text in payload contents via AQL on log activity tab and need to correlate with different payloads. I have create the alert for these payload finds with diff logs sources.
example
1st Payload *ERROR* contains
2nd Payload com.example.com.java.error.text
if payload contains certain text I want to search it but from specific log source , but I don't know how specify log source name in query, please help me.
Also how to find out log source IDs?qradarruleswincollectaqlcorrelationSun, 18 Nov 2018 15:25:34 GMTQNewbieCorrelation
https://developer.ibm.com/answers/questions/480896/correlation-1.html
The questionnaire I have consists of three parts. Each part carries 12 statements. Responses for statements are given in the from of Strongly Disagree, Disagree, Neutral , Agree, Strongly Agree. I need to find the correlation between part one and part three, correlation between part two and part three; and correlation between part one and part two, separately. Please suggest me the way of doing it. Thank you for your kind help.correlationquestionsstatementSun, 18 Nov 2018 04:07:23 GMTChamodi WijewickramaRelated events not correlated in NOI Event Analytics.
https://developer.ibm.com/answers/questions/473427/related-events-not-correlated-in-noi-event-analyti.html
When pattern created in NOI Event Analytics, Related events are not correlated.
IBMExtractedType field gets processed but IBMProcessingStage field not gets processed.
I am using a customised column as resource column.analyticsnoieventcorrelationThu, 04 Oct 2018 09:16:27 GMTHaipengZhangHow to split a correlation into 3 samples
https://developer.ibm.com/answers/questions/471333/how-to-split-a-correlation-into-3-samples.html
I have a correlation between two variables. I have run the correlation and am looking at the scatter plot. Is there a way for me to split my sample into thirds based on the correlation? Meaning I have the bottom third, middle, and the top third. Then is it possible to see if each of these thirds is significantly different from each other? I am trying to determine if I need to stratify my smapling for further research I have and it is based on this correlation.correlationThu, 20 Sep 2018 15:56:06 GMTStephanie587How I can alert based on number of events?
https://developer.ibm.com/answers/questions/469678/how-i-can-alert-based-on-number-of-events.html
I need to monitor that certain log event is detected 6 times in 25 hours.
If not there should be an offense.
I have tried to make and not conditions and threshold rule but no luck..
I am clueless..
Thanks!, br PetriqradarcorrelationalertsreferencessetsTue, 11 Sep 2018 12:49:18 GMTPetri HelinTest of relationship / correlation between yes no answers
https://developer.ibm.com/answers/questions/465307/test-of-relationship-correlation-between-yes-no-an.html
Hi all,
I'm analysing information obtained from a consumer survey for my Thesis. The vast majority of the questions are yes / no responses or similar (is your preference a, b or c).
I'm want to test if there is any relationship between the answers to two of these questions for example;
"Do you find purchasing insurance easy - yes / no"
"How do you purchase insurance - phone, in person or online"
So in essence, is there a relationship between ease of purchasing and how people purchase?
Another example of what I am trying to see is
"Is insurance a necessity or a priority for you - necessity or priority"
"What's more important - price or the cover offered"
For those who see insurance as a necessity what is more important in the purchasing decision.
I don't have a particularly good handle on SPSS or statistics to begin with so any assistance would be greatly appreciated.
Thanks,
RichiecorrelationrelationshipFri, 17 Aug 2018 15:42:00 GMTRichie_CHow to use SPSS for spatial format such as SHP .
https://developer.ibm.com/answers/questions/461266/how-to-use-spss-for-spatial-format-such-as-shp.html
Actually, I am doing a project to estimate above ground tree biomass using Landsat8 and sample plot . I have sample plot and 10 different vegetative indices. Now I have to make equation as AGTB=a1x1+a2x2+a3X3 ..... now I have to know coefficient values to fulfill this equation. Then which software and process should be use to correlate these indices with sample data and estimate biomass? The abstract of this project is attached here with.ecmsupportcorrelationspatialFri, 27 Jul 2018 17:21:20 GMTGobinda15Create a histogram of Pearson correlations?
https://developer.ibm.com/answers/questions/453417/create-a-histogram-of-pearson-correlations.html
Hello,
I need to make a histogram with the Pearson correlations I calculated with SPSS to see how the correlations are distributed. When I click on the output table I am somewhat able to make one, but this includes also the correlation of Variable1 with Variable1 (=1) which I of course do not need.
Is there any other possibility? Can I make a new variable with the Pearson correlations for the datas?
In case someone wants to suggest it: A scatterplot won't do the job for me, I want to be able to see easily how many correlations are between 0.3 - 0.5 or -.3, -.5 etc.
I appreciate any help, as even google fails to help me with this problem!spsscorrelationgraphpearsonThu, 14 Jun 2018 10:37:22 GMTPapayaaInfraclass correlation coefficient analysis
https://developer.ibm.com/answers/questions/450702/infraclass-correlation-coefficient-analysis.html
How I can do Infraclass correlation coefficient on one subclass of 8 subcategories between two different method? (for example I want to know the ICC of Pedestrian Facilities (subclass) with 8 subcategories between two different tools of resident survey and field observation)icccorrelationsurveyThu, 31 May 2018 05:27:20 GMTreihanlikert scale correlation
https://developer.ibm.com/answers/questions/446276/likert-scale-correlation.html
how to find correlation and have scatter plot if the data coming from likert scalespsscorrelationSat, 05 May 2018 15:56:08 GMTmsgs76Logistic Regression Multicollinearity
https://developer.ibm.com/answers/questions/441352/logistic-regression-multicollinearity.html
I am running a Binary Logistic Regression and I am interested in checking for Multicollinearity in the predictors of the model, which includes an interaction term.
----1) What is the interpretation of the Correlation Matrix from the SPSS output (selected in options)?
----2) Can it substitute for the Collinearity Diagnostics (VIF, Tolerance, Eigenvalue, ect..) that I usually get after running a simple Linear Regression?
----3) How do I check for Multicollinearity then?
Thanks!correlationlogisticregressionMon, 09 Apr 2018 15:42:02 GMTLevy33Correlation Alert over Guardium sent by Syslog
https://developer.ibm.com/answers/questions/439685/correlation-alert-over-guardium-sent-by-syslog.html
Hello, I configured an alert based on the failed login and I am sending it with SYSLOG to an external SIEM, we checked what is arriving there and this is what it's shipping:
<25>Mar 28 15:25:20 srvtst-l104v guard_sender[26332]: #012#012Alert Name: Failed Log In. Alert Description: Failed Log In.#012Current value: 57.0 #012Base query value: 0.0 #012Threshold: 0.0 #012Query period: 3/28/18 - 3/28/18 #012Alert Classification: HIGH #012Category: #012Severity: HIGH#012#012Recommended Action:#012#012 #012#012Alert Details#012Timestamp DB User Name Source Address Destination Address Database Protocol Count of Exceptions #0122018-03-12 14:31:39 SCHEDUSER XXX.XXX.XXX.158 XXX.XXX.XXX.159 MS SQL SERVER 8 #0122018-03-28 15:20:05 SCHEDUSER XXX.XXX.XXX.158 XXX.XXX.XXX.159 MS SQL SERVER 49
so it's like it's shipping the whole query result ALSO with the column name, the SIEM is not able to understand this format, is it possible to send this correlation alert with a template similar to the one for Archsight?
thanksguardiumsyslogcorrelationsyslogsWed, 28 Mar 2018 16:25:18 GMTFrancesco Q.QRadar - Rule processing behaviour with Building Blocks
https://developer.ibm.com/answers/questions/428281/qradar-rule-processing-behaviour-with-building-blo.html
**Background**
- I am currently working with a QRadar (7.2.8) environment that has identified a requirement to implement Domains and Global Correlation (we have multiple Event Processors). We have developed a plan that will allow us to implement Domains without initially impacting the creation of offenses. The plan requires us to change all existing rules to System-Wide rules before the domains are created. i.e. we will add the domain test: “*and when domain is one of the following: Shared Data*” to the top of every rule, and then create and populate the domains. Once this is complete, we can begin testing of domain specific rules, removing System Wide rules where appropriate.
**Issue**
- The issue I’m having is that the Building Blocks used within the rules do not follow the System Wide processing directive that applies to the rest of the rule. i.e. Even though a rule has the domain test: “*and when domain is one of the following: Shared Data*”, this does not apply to any Building Block within the rule, the building Block is ‘per Domain’.
Additionally, and whilst unrelated to Domains, I realise the same principal applies to Rule Correlation (Global vs Local). Even if we set the rule to use Global correlation, the Building Blocks within the rule do their own thing – which by default is to use local correlation.
**Solution?**
- A solution I have considered is to make a copy of the Building Blocks that appear in System Wide rules, and modify them to be System Wide Building Blocks. These building blocks would be used in System Wide rules. And similarly, if I want a Global correlation rule, I need to copy the relevant Building Blocks and modify them to use Global correlation.
But this approach means I need as many as 4 copies of each Building Block, one for each of 4 rule scenarios:
1. Domain Processing = per-Domain, Correlation = Local
2. Domain Processing = per-Domain, Correlation = Global
3. Domain Processing = System Wide, Correlation = Local
4. Domain Processing = System Wide, Correlation = Global
Am I wrong? Have I missed something obvious?
Is there any best-practice guidance regarding the way this issue should be managed?
What happens if a patch or system update modifies the original out-of-the-box Building Blocks? How will I know that the 3 copies I’ve made need updating?
I’d appreciate any feedback with other peoples experience and approach to this issue.
Thanksqradarrulesdomainrule designercorrelationdomainslocalglobalWed, 31 Jan 2018 23:30:48 GMTDB02Why correlation does not work by using new column as Event identity in NOI Event Analytics
https://developer.ibm.com/answers/questions/426435/why-correlation-does-not-work-by-using-new-column.html
I created a new column in ObjectServer and reporter DB, JDBC gateway map file updated as well.
When I create configuration for Event Analytics with overwrite Override global event identity, and use the new created column as Event identity, although the pattern of seasonality and related events can be discovered, when deploy the rule, it does not work, no Synthetic event was raised, no ParentIdentifier are polulated.impactanalyticsnoicorrelationcolumnidentityWed, 24 Jan 2018 05:39:56 GMTHaipengZhangGamma Correlation (Partial)
https://developer.ibm.com/answers/questions/422924/gamma-correlation-partial.html
Can I run a Goodman and Kruskal's gamma partial correlation test in SPSS using syntax commands? What commands should I use? Many thanks.spssstatisticsextensibilitycorrelationMon, 08 Jan 2018 18:11:25 GMTBRaggioSpearman's correlation increasing sample size?
https://developer.ibm.com/answers/questions/418100/spearmans-correlation-increasing-sample-size.html
I've run Spearman's correlations on a weighted sample, and found that my sample size is greater than my actual sample size (N = 948 vs. N= 870, respectively). I am at a loss for how this could be possible, but have noted that if I run the unweighted sample, the N returns to normal. Is this a function of how the Spearman command compares ranks? I am hesitant to report my results for the incorrect N without knowing the explanation.
Thank you.spssspss24correlationnonparametricMon, 11 Dec 2017 18:13:28 GMTsamantha017Sample size calculator?
https://developer.ibm.com/answers/questions/417081/sample-size-calculator.html
Is there a sample size calculator that can compute sample size based on the findings form a previous study (using the study's N, correlation/effect size, required power)?spsssamplecorrelationpowersamplepowerTue, 05 Dec 2017 23:10:06 GMTRTurnConfidence intervals for Spearman partial correlations?
https://developer.ibm.com/answers/questions/417080/confidence-intervals-for-spearman-partial-correlat.html
I can't find a way to compute confidence intervals for Spearman partial correlations.
In SPSS, Spearman partial correlations can be conducted using syntax. Is it possible to compute confidence intervals the same way and if so can this be done with bootstrapping? Or is there an alternative?spsssyntaxcorrelationnonparametricTue, 05 Dec 2017 23:01:12 GMTRTurnHow do I get a polychoric matrix (correlation) ?
https://developer.ibm.com/answers/questions/415859/how-do-i-get-a-polychoric-matrix-correlation.html
I need to get a polychoric matrix by spsscorrelationmatrixWed, 29 Nov 2017 15:16:32 GMTmayra_blanco