Event and flow searches

You can perform searches on the Log Activity, Network Activity, and Offenses tabs.

Use search and index options in IBM QRadar that improve search performance and return quicker results. To find specific criteria, advanced searches use AQL search strings.

You can specify filter criteria to search for events, flows, and offenses. After you perform a search, you can save the search criteria and the search results.

If your QRadar administrator configured resource restrictions to set time or data limitations on event and flow searches, the resource restriction icon () appears next to the search criteria.