IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  AQL Query OR Use Case

    Posted Thu October 27, 2022 09:54 AM
    Hi,
    We have integrated SentinelOne, I have queries to write use case to alert if a file name/Hash value is detected as malicious, and it should not be actioned (mitigated/Quarantined/Deleted) within a few min (ex.: 5min).

    SELECT "File Hash","Filename","Action","Hostname",DATEFORMAT(starttime,'DD-MM-yyy hh:mm') AS 'Start Time' FROM events WHERE "File Hash" IS NOT NULL AND ACTION!='mitigated' AND ACTION!='deleted'



    Thanks
    Arunkumar



    ------------------------------
    Arunkumar R
    ------------------------------


Related Content