IBM Security QRadar

 View Only

Offense Query

  • 1.  Offense Query

    Posted 20 days ago

    Hi everyone:

    i'm trying to make a dashboard item with offense data, i would like create query, but a cant find the id offense, someone know the name of the field id_offense to use in query, I wold like some like this

    This is my query
    SELECT QIDNAME(qid) as evento,DATEFORMAT(starttime, 'dd-MM-YYY HH:MM:SS') as "Date"
    FROM events
    where domainid =2 and logsourceid = 163 and evento ILIKE 'LATAM%%'
    ORDER BY date DESC
    LAST {time_span}
    Thans in advnace

    Luis Enrique Rodriguez Martinez