IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
  • 1.  Comments in AQL

    Posted Mon January 16, 2023 12:48 PM
    Edited by Wendy Batten Tue January 17, 2023 08:35 AM
    Hello,

    is there an option to use comments in AQL?

    For example:

    select UTF8(payload)
    from events
    where sourceip = '10.10.10.10'
    //This sourceip is server xyc (this is a comment)
    last 1 day

    Thanks and greetings
    Daniel

    ------------------------------
    Daniel Wagner
    ------------------------------


  • 2.  RE: Comments in AQL

    Posted Tue January 24, 2023 12:13 PM
    Edited by Arnaud Chemla Tue January 24, 2023 12:14 PM
    Hello Daniel,

    You can use /* */ to write comments within your AQL requests.



    Hope that helps.

    Cheers.

    Arnaud.





  • 3.  RE: Comments in AQL

    Posted Thu January 26, 2023 01:01 PM
    I hope IBM considers adding comment syntax to its QRadar Ariel Query Language Guide.

    ------------------------------
    Thomas Luizzi
    ------------------------------