QRadar: How to properly create an AQL Search for a Threshold Rule

Resolving The Problem

   A saved AQL Search with a Group By is not honored when trying to use within a Threshold Rule:

1. Log in to the QRadar UI
2. Click Log Activity tab
3. Use the following AQL Query in Advanced Search:
   select sourceip, destinationip, logsourceid, starttime, category, qid FROM events GROUP BY starttime last 15 MINUTES
   
4. Click Search and View the Results.
5. Click Save Criteria.
6. Use the Name "Test Threshold" for 5-minute interval, Include in my Quick Searches, Share with Everyone.
   
   
   
7. Click OK.
   
8. Click Rules > Add Threshold Rule
   
   
   
9. The saved search "Test Threshold" is not a grouped search. You must specify at least one column in the Group By list to create a rule of this type. Edit the saved search and try again.
   

1. Repeat step 3 above using this AQL Query in Advanced Search
   select sourceip, destinationip, logsourceid, COUNT(starttime) as starttime_count, starttime, category, qid FROM events GROUP BY starttime last 15 MINUTES
2. Click Search and View the Results.
3. Click Save Criteria.
4. Use the Name "Test Threshold" for 5-minute interval, Include in my Quick Searches, Share with Everyone.
   
   
5. Click OK.
6. Click Rules > Add Threshold Rule
7. Click Next.
   
   
   
   Results: You can now create a Threshold Rule.