Searching events

You can search for all authentication events that IBM QRadar received in the last 6 hours.

1. Click the Log Activity tab.
2. On the toolbar, select Search > New Search.
3. In the Time Range pane, define the time range for the event search:
   1. Click Recent.
   2. In the Recent list, select Last 6 Hours.
4. In the Search Parameters pane, define the search parameters:
   1. In the first list, select Category [Indexed].
   2. In the second list, select Equals to.
   3. In the High Level Category list, select Authentication.
   4. In the Low Level Category list, accept the default value of Any.
   5. Click Add Filter.
5. In the Column Definition pane, select Event Name in the Display list and drag it to the Columns list.
6. Click Search.