Hi,
its a few days i instaled a new Qradar ESM. At this moment i created new rules on this new Qradar, but my expirence is on ArcSight ESM.

My doubt is very easy to solved, but i need to be sure to create this on the simple way.

My example

You see the condition "OR"? On Qradar its possible to create AQL filter or create "rule" and than apply to the new rule. But there is no easier way?

Thanks

------------------------------
Ismael Silva
------------------------------

Hi Ismael,
thats what everyone is searching for starting with QRadar ;-). A solution are Building Blocks. Create a Rule with the first 4 conditions, export them as a Buildng Block and do that with the other 2 conditions. Then create a rule "and when an event matches any of the following rules" matching the the 2 Building Blocks you created.

------------------------------
Martin Schmitt
------------------------------

(just adding the link to the knowledge centre page)

------------------------------
Dusan VIDOVIC
------------------------------

Original Message:
Sent: Fri August 12, 2022 02:57 AM
From: Martin Schmitt
Subject: Doubts about Qradar rules (event rules)

Hi Ismael,
thats what everyone is searching for starting with QRadar ;-). A solution are Building Blocks. Create a Rule with the first 4 conditions, export them as a Buildng Block and do that with the other 2 conditions. Then create a rule "and when an event matches any of the following rules" matching the the 2 Building Blocks you created.

------------------------------
Martin Schmitt
------------------------------

Hi Ismael,
in addition to the comments about using "OR" in rules an BBs, you can use OR in AQL as suggested. Eg a atatement like this "select * from events where "Source Host Name" = 'kalinux' OR "Source Host Name" = 'mypc'" would be perfectly valid and your sample can be coded as AQL if you like. Moreover you can use your oqn AQL search in your rules instead of using the rule test options.

------------------------------
[Karl] [Jaeger] [Business Partner]
[QRadar Specialist]
[pro4bizz]
[Karlsruhe] [Germany]
[4972190981722]
------------------------------

Original Message:
Sent: Fri August 12, 2022 07:00 AM
From: Dusan VIDOVIC
Subject: Doubts about Qradar rules (event rules)

(just adding the link to the knowledge centre page)

------------------------------
Dusan VIDOVIC
------------------------------


Original Message:
Sent: Fri August 12, 2022 02:57 AM
From: Martin Schmitt
Subject: Doubts about Qradar rules (event rules)

Hi Ismael,
thats what everyone is searching for starting with QRadar ;-). A solution are Building Blocks. Create a Rule with the first 4 conditions, export them as a Buildng Block and do that with the other 2 conditions. Then create a rule "and when an event matches any of the following rules" matching the the 2 Building Blocks you created.

------------------------------
Martin Schmitt