IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  AQL Query OR Use Case

    Posted 10/27/22 09:54 AM
    Hi,
    We have integrated SentinelOne, I have queries to write use case to alert if a file name/Hash value is detected as malicious, and it should not be actioned (mitigated/Quarantined/Deleted) within a few min (ex.: 5min).

    SELECT "File Hash","Filename","Action","Hostname",DATEFORMAT(starttime,'DD-MM-yyy hh:mm') AS 'Start Time' FROM events WHERE "File Hash" IS NOT NULL AND ACTION!='mitigated' AND ACTION!='deleted'



    Thanks
    Arunkumar



    ------------------------------
    Arunkumar R
    ------------------------------


Related Content