IBM Security QRadar

 View Only
  • 1.  Offense Query

    Posted Wed May 29, 2024 10:54 AM

    Hi everyone:

    i'm trying to make a dashboard item with offense data, i would like create query, but a cant find the id offense, someone know the name of the field id_offense to use in query, I wold like some like this

    This is my query
    SELECT QIDNAME(qid) as evento,DATEFORMAT(starttime, 'dd-MM-YYY HH:MM:SS') as "Date"
    FROM events
    where domainid =2 and logsourceid = 163 and evento ILIKE 'LATAM%%'
    ORDER BY date DESC
    LAST {time_span}
    Thans in advnace

    Luis Enrique Rodriguez Martinez

  • 2.  RE: Offense Query

    IBM Champion
    Posted 2 days ago
    Edited by Karl Jaeger 2 days ago


    I think you are mixing multiple problems here. Thx for the screenshot that helped indeed!

    1. offense id is described in the API , pls check 2nd picture. The name is "offense_id" and you have to check table for offenses rather than for events cause its different! Of ourse there is a relationship between those two tables but only if the event has assigned an offense!
    2. I have modified your query and created a pulse widget which can be used to create a new dashboard. I believe that what you want is a new pulse dashboard although there are other dashboards as well. Pls be a little bit more espedific when posting questions cause your enquiry will have zero replies for a long time. 
    3. my simple AQL for events being related to events is SELECT 'offense_id' as offenseid FROM events where hasoffense = 1 ORDER BY offenseid DESC LAST 100 HOURS
    4. pls test your queries in log activity first before creating new widgets and dashboards in pulse. first Picture has dashboard widget

    [Karl] [Jaeger] [#ibmchampion]
    [QRadar Specialist]
    [Siegen] [Germany]