What is a benefit of using a span port, mirror port, or network tap as flow sources for QRadar?
A . These sources are marked with a current timestamp.
B . These sources show the ASN number of the remote system.
C . These sources show the username that generated the flow.
D . These sources include payload for layer 7 application analysis.
Answer: D
Explanation:
Reference:
https://www.ibm.com/developerworks/community/forums/html/topic?id=dd3861e0-f630-4a53-94c3b426a47b6e02