IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
Back to discussions
Expand all | Collapse all

How to create a dashboard to display reference Data

  • 1.  How to create a dashboard to display reference Data

    Posted 11/26/20 08:23 AM

    Hello Everyone.

    I am wondering how it is possible to show contents of reference data (reference set for exemple) in a Dashboard item or in the Pulse app.

    Any idea ?



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: How to create a dashboard to display reference Data

    Posted 12/02/20 11:27 AM
    1. As a pulse dashbaord >>> mutate the aql filter below to to meet your need

    SELECT sourceip as 'Source Ip', destinationip as 'Destination Ip',COUNT(*) from flows WHERE REFERENCESETCONTAINS('Botnet C&C IPs',sourceip) GROUP BY 'Source Ip' last 2 HOURS

    2.As a dashbaord, create a normal search with all needed filters, save it and check the use in dashbaord check box.



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: How to create a dashboard to display reference Data

    Posted 12/02/20 01:23 PM

    Thank you kariuki



    #QRadar
    #Support
    #SupportMigration


Related Content