Searching data from IBM X-Force Exchange with advanced search criteria

For complex queries, you can search and filter data from X-Force Exchange by using Advanced Search expressions.

About this task

Advanced searches return data from the Log Activity or the Network Activity tab in QRadar.

URL searches cannot be returned from the Network Activity tab because the URL information is provided by the event data.

For a list of parameters and functions available when you search for data from IBM X-Force Exchange, see https://exchange.xforce.ibmcloud.com/faq#ipr_categories_list

Procedure

  1. Click the Log Activity tab.
  2. On the Search toolbar, select the Advanced Search.
  3. Type an AQL query expression.

    The following table describes some common search expressions.

    Table 1. X-Force advanced search expressions
    Description Example
    Searches for HTTP hosts from flows that match a bad category. 
    select * from flows where 
XFORCE_URL_CATEGORY("HTTP Host") in ('Anonymization Services','Malware', 
'Botnet Command and Control Server', 'Spam URLs', 'Cryptocurrency Mining', 'Bots', 'Phishing URLs')
    Searches for URLs found in events that match a bad category. 
    select * from events where 
XFORCE_URL_CATEGORY("UrlHost") in ('Anonymization Services','Malware', 'Botnet Command and Control Server', 
'Spam URLs', 'Cryptocurrency Mining', 'Bots', 'Phishing URLs')
    Searches for IP addresses that match a bad category with a confidence factor above 75. 
    select * from events where 
XFORCE_IP_CONFIDENCE('Anonymization Services',destinationaddress) > 75 OR XFORCE_IP_CONFIDENCE('Malware',destinationaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Botnet Command and Control Server',destinationaddress) > 75 OR XFORCE_IP_CONFIDENCE('Spam',destinationaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Cryptocurrency Mining',destinationaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Scanning IPs',destinationaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Bots',destinationaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Anonymization Services',sourceaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Malware',sourceaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Botnet Command and Control Server',sourceaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Spam',sourceaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Cryptocurrency Mining',sourceaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Scanning IPs',sourceaddress) > 75 OR 
XFORCE_IP_CONFIDENCE('Bots',sourceaddress) > 75
    Searches associated with a URL. 
    select url, 
XFORCE_URL_CATEGORY(url) 
as myCategories from events where 
XFORCE_URL_CATEGORY(url) IS NOT NULL
    Searches associated with a source IP address. 
    select sourceip, 
XFORCE_IP_CATEGORY(sourceip) 
as IPcategories from events where 
XFORCE_IP_CATEGORY(destinationip) in ('Malware', 'Botnet Command and Control Server', 
'Spam', 'Cryptocurrency Mining', 'Scanning IPs', 'Bots', 'Phishing')
  4. Click Search.