IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Reporting on Open offenses with magnitude greater than 7

    Posted 06/23/22 02:19 PM
    Does anyone have a search or an aql statement I can use to report on open offenses with a magnitude greater than 7? The best I can do is to report on rules that have a magnitude greater than 7.

    ------------------------------
    LUIS LATAS
    ------------------------------


  • 2.  RE: Reporting on Open offenses with magnitude greater than 7

    Posted 07/12/22 11:38 AM
    Hello @LUIS LATAS,

    Hope you are well :)

    Guess is more simple to do it with API or psql statement.

    Sure Its not the right answer, but if i have to do so i will start near that if you have to do this via a search on events  :

    SELECT "CRE Name", MIN("magnitude"), SUM("eventCount") AS 'Event Count (Sum)', COUNT(*) AS 'Count' from events where ( "deviceType"='18' AND "hasOffense"='true' and magnitude >7 ) GROUP BY "CRE Name" order by "Count" desc last 6 hours

    Hope this helps,

    Regards,

    @zoldax​

    ------------------------------
    @zoldax

    https://www.youracclaim.com/users/pascal-weber.029e134d/badges
    ------------------------------



  • 3.  RE: Reporting on Open offenses with magnitude greater than 7

    Posted 07/14/22 09:55 AM
    Thanks.

    ------------------------------
    LUIS LATAS
    ------------------------------