Building search queries

Although STIX2 is gaining recognition as an industry standard, it is not yet widely known to all security professionals. The query builder helps you to create a search query for IBM Prerequisite Scanner, URLs, MD5 hashes, and more.

1. Go to Data Explorer > Federated Search, and click the Advanced builder tab.
2. Click the STIX tab.
3. In the query text field, enter your query in the following format: OBSERVABLE_TYPE PROPERTY OPERATOR VALUE
   The query builder displays a context helper that provides the following parameters.

   Parameter	Description
   Observable type	Observables in STIX 2 are the stateful properties or measurable events that relate to the operation of computers and networks. For more information about the different types, see Cyber Observable Objects.
   Property	Each observable type has required properties. For more information about the different properties for each type, see Cyber Observable Objects.
   Operator	The operator in a query parameter is set to equal by default. Choose the operator that is appropriate for your query parameter. Make sure to add an operator between all query parameters to avoid syntax errors.
   Value	The observable value depends on the specified observable type and property.

4. Group search parameters by using square brackets.
5. Set one or more timeframes to query.
   Tip: In the STIX language, the time range is shown in Coordinated Universal Time (UTC).
   1. Add a custom START and STOP date and time.
   2. Click to select from the quick ranges supplied with START.
   3. Click to use current date and time with STOP.
6. Select one or more data sources to query. All data sources are selected by default. Click the data sources menu to update the selection.
7. Click Run query to retrieve your target data across your selected data sources. The query results vary depending on your connected data sources.

The Ariel Query Language (AQL) is a structured query language that you use to query and manipulate event and flow data from the Ariel database in IBM QRadar.

1. Go to Data Explorer > Federated Search, and click the Advanced builder tab.
2. Click the AQL tab.
3. In the query text field, start constructing your query in the format of the following example.

   SELECT magnitude, sourceip, destinationip, destinationport, QIDNAME(qid) 
   AS 'Event Name', LOGSOURCENAME(logsourceid) 
   AS 'Log Source', CONCAT(CATEGORYNAME(highLevelCategory), '.', CATEGORYNAME(category)) 
   AS 'Category Name', DATEFORMAT(startTime, 'MMM dd hh:mm a') 
   AS 'Start Time' 
   FROM events 
   WHERE TEXT SEARCH '127.0.0.1' 
   LIMIT 1000 
   LAST 2 HOURS

   Important: An error might occur when a LIMIT clause is not included in your statement. Use a LIMIT clause to limit the number of results that are returned to a specific number. For example, LIMIT 20 to limit the output to 20 results.

   You must place the LIMIT clause before the START and STOP clauses, as in the following example.

   SELECT *
   FROM events
   LIMIT 20
   START '2021-01-01 00:00'
   STOP '2021-01-01 01:00'