Querying event and flow data to find specific offenses

Search for specific event and flow data by creating Ariel Query Language (AQL) searches in the QRadar Analyst Workflow Query Builder.

1. From the navigation menu (), click Search, and select the Advanced builder tab.
2. Type one of the following keywords in the Query Builder to start a query:
   • IP address
   • URL
   • MD5/SHA-1/SHA-256 hash
3. Select one of the predefined searches from the list that appears as you enter a keyword.
4. Review and edit the query template to refine your search, and then click Run query.
   Tip:

   • Syntax tokens are color-coded based on token class.
   • For a syntactically correct AQL string, paired parentheses are underscored when the cursor is placed between them.

     (startTime, 'MMM dd hh:mm a')

5. Click Filter to further refine your search results and then select an offense to view more details.
6. To run an existing search result, select the query in the Last Search field to add it to the Query Builder, and then click Run query.
7. Optional: Expand the Training and resources section to learn more about AQL queries.

SELECT sourceip, destinationip, username 
FROM events 
WHERE username = 'test name' 
GROUP by sourceip, destinationip 
ORDER BY sourceip DESC 
LIMIT 10 
LAST 2 DAYS