I added an example from a case that seemed similar
in the support forum post that
@Darren H. mentioned as I was going to link to this oost as well. Support forums are moving to a new platform in 2020, so I want to make sure this content gets migrated to the new forums, which is why I updated the support forum post.
------------------------------
Jonathan Pechta
QRadar Support Content Lead
Support forums: ibm.biz/qradarforums
jonathan.pechta1@ibm.com------------------------------
Original Message:
Sent: Wed February 05, 2020 10:13 AM
From: Darren H.
Subject: Rules fired count with in one month
Hi Abdul,
Not clear what version you're using, but a quick search shows there is something more like what you want here:
https://developer.ibm.com/answers/questions/456339/count-of-offenses-createdclosed/
Do a bit of AQL experimenting and search for something like "CRE Rule" (not Offense in your case) - then tune the required payload from there.
------------------------------
Darren H.
Original Message:
Sent: Wed February 05, 2020 08:15 AM
From: Abdul Qudoos
Subject: Rules fired count with in one month
Thanks for reply...Actually I want total number of rules with their names which has been fired in 30 days ??The above discussion on reddit explained the offenses closed by users which didn't correspond to my question.
------------------------------
Abdul Qudoos
Original Message:
Sent: Mon February 03, 2020 11:04 PM
From: Jonathan Pechta
Subject: Rules fired count with in one month
Offenses are accessible via offense API, not in AQL. With AQL you can check if a log source contributed to that offense by its offense ID within a certain time frame. You can get information on who closed a specific offense as that generates an Audit event in QRadar that can be found via AQL.
The best method to determine your answer would be to query from the interactive API using the /siem/offenses endpoint. Be aware, you must be using QRadar 7.3.2 to leverage this API field. There was a fairly recently subreddit discussion on this same question here for more details: https://www.reddit.com/r/QRadar/comments/e5ivxz/aql_query/
------------------------------
Jonathan Pechta
QRadar Support Content Lead
Support forums: ibm.biz/qradarforums
jonathan.pechta1@ibm.com
Original Message:
Sent: Mon February 03, 2020 12:37 PM
From: Abdul Qudoos
Subject: Rules fired count with in one month
I need to determine if there is any AQL query or any alternative way to find list of rules fired in one month with count(number of times each rule fired) in one month.
------------------------------
Abdul Qudoos
------------------------------