IBM Security QRadar SOAR

 View Only
Expand all | Collapse all

AQL Threshold rule using the HAVING clause not working

  • 1.  AQL Threshold rule using the HAVING clause not working

    Posted Wed January 25, 2023 03:36 AM
    HI all,

    I am trying to create a threshold rule using an AQL saved search, the saved search is retrieving the data as its supposed, but when I tries to create a threshold rule I receive the following error on the rule finish page:

    "The accumulated data view cannot be created because your saved search contains HAVING clause."

    The query looks like this:

    SELECT "userName" AS 'Username', logsourcename(logSourceId) AS 'Log Source', COUNT(*) AS 'Count'
    from events where ( "creEventList"='100063' AND Username IS NOT NULL)
    GROUP BY "userName", logSourceId
    HAVING COUNT(*) > '9.0' order by "Count"

    Appreciate your help,

    ------------------------------
    Haitham Aletiewi
    ------------------------------


  • 2.  RE: AQL Threshold rule using the HAVING clause not working

    Posted Thu January 26, 2023 04:29 AM
    Hi Haitham,

    Since this is QRadar AQL you might get a better response posting it in the QRadar community rather than the SOAR community.

    ------------------------------
    BEN WILLIAMS
    ------------------------------

    Original Message