Searching and Reporting
Searching and Reporting tests whether you can retrieve the right QRadar data with AQL and turn it into a repeatable report. It covers query structure, saved searches, report creation, scheduling, and distribution.
AQL essentials
AQL queries events or flows with SELECT, FROM, WHERE, GROUP BY, ORDER BY, and a LAST time clause. Use aggregation such as COUNT, SUM, and AVG to answer volume and trend questions, then add fields for detail. Log Activity searches events; Network Activity searches flows. Saving criteria creates a saved search that can feed dashboards and reports.
Reporting workflow
- Start from a saved search or report template.
- Choose layout and content: chart, table, or text.
- Preview with the intended time range.
- Schedule on-demand or recurring; set distribution and format such as PDF or CSV.
- Check report permissions and branding.
- Confirm the schedule time zone and relative time window.
Worked example: Weekly failed-login report. AQL: SELECT username, sourceip, COUNT(*) AS failures FROM events WHERE category='Authentication' AND outcome='Failure' GROUP BY username, sourceip ORDER BY failures DESC LAST 7 DAYS. Save it as Weekly Failed Logins, create a report with a table, schedule Monday 06:00, output PDF, and distribute to the SOC list. Reasoning: aggregation keeps the report small; the saved search is reusable; the schedule makes it repeatable. Verify whether LAST 7 DAYS is relative to run time before publishing.
Traps
- Reporting raw events instead of aggregated results.
- Using a relative time clause without checking when the schedule runs.
- Forgetting report permissions or distribution lists.
- Not saving the search, so the report cannot be maintained.
- Choosing CSV when the audience needs a formatted PDF.