When configuring a Smart Alert in Advanced Mode within IBM QRadar Use Case Manager, you can define how the alert's trigger condition is evaluated. The system provides two distinct threshold types for this purpose. A 'Static' threshold uses a fixed, user-defined value. An alert is generated when the monitored property's value crosses this predefined number. In contrast, an 'Adaptive' threshold is dynamic. It establishes a baseline by analyzing historical data over a specified period and triggers an alert when the current value deviates significantly from this learned baseline, which is useful for detecting anomalous behavior.

A. Single: This is not a recognized threshold type. While a static threshold uses a single value, the official term for the type is 'Static'.

C. Progressive: This term is not used for threshold types in QRadar Smart Alerts. It might be conceptually similar to adaptive, but it is not the correct terminology.

E. Neutral: This is not a valid threshold type. Thresholds are defined by a value to be exceeded or fallen below, not a neutral state.

1. IBM QRadar SIEM Documentation. (2023). Creating a smart alert. IBM Knowledge Center. Retrieved from https://www.ibm.com/docs/en/qradar-siem/7.5?topic=manager-creating-smart-alert.

Reference Point: In the procedure for creating a smart alert, Step 6 for Advanced Mode explicitly states: "In the Threshold type list, select one of the following options: Static, Adaptive".