IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  How to decode Base64 property in Ariel AQL

    Posted Mon October 11, 2021 05:45 AM

    Greetings,

    I have some properties encoded as Base64.

    Kindly I need to know the best solution to decode the Base64 property to readable text using AQL.

    Kindly advise



    #QRadar
    #Support
    #SupportMigration


  • 2.  RE: How to decode Base64 property in Ariel AQL

    Posted Mon October 11, 2021 07:41 AM

    You can use the custom AQL function which is part of this content pack on the X-Force App Exchange.

    https://exchange.xforce.ibmcloud.com/hub/extension/db91b644801492a45ad194cd4e6a7aa9

    Paul



    #QRadar
    #Support
    #SupportMigration


  • 3.  RE: How to decode Base64 property in Ariel AQL

    Posted Mon October 11, 2021 08:03 AM

    Hello Paul,

    I already downloaded and installed this extension and I tried the following AQL syntax but the result is always empty.

    select "Property 1" as P1, CODEC::BASE64('d','P1')

    from events where LOGSOURCEGROUPNAME(devicegrouplist) = 'Test Group'

    Kindly do you have any suggestions regarding this?

    The "Property 1" is an alphanumeric property.



    #QRadar
    #Support
    #SupportMigration


  • 4.  RE: How to decode Base64 property in Ariel AQL

    Posted Mon October 11, 2021 08:27 AM

    Your P1 needs to be in double quotes both times ...

    For example - this works just fine on my test system:

    SELECT "ZXZ_STUFF", CODEC::BASE64('d',"ZXZ_STUFF") FROM events WHERE qid = 44250019 LAST 5 MINUTES

    Paul



    #QRadar
    #Support
    #SupportMigration


  • 5.  RE: How to decode Base64 property in Ariel AQL

    Posted Mon October 11, 2021 08:50 AM

    I also tried your example and the search is running normally but the problem is that I am getting blank results with a message at the bottom of the page showing "Refreshing results..."

    and it is taking too much time and no results appear


    If I limit my search to 1, I got the result instantly



    #QRadar
    #Support
    #SupportMigration


Related Content