IBM Security QRadar AQL Plugin FAQ

Use these frequently asked questions and answers to help you understand the IBM® Security QRadar® AQL Plugin.

Why should I use Grafana?

Grafana is a visualization tool that unifies your existing data, wherever it lives, into a single dashboard. Use the QRadar AQL Plugin to build visualizations directly from QRadar data, while also using Grafana for other data sources.

What does the QRadar AQL Plugin do?

The plugin allows Grafana to connect to your QRadar instance and retrieve data to present through visualizations. Sample dashboards are included in the QRadar AQL Plugin for you to import to the instance.

What is a Grafana data source backend plugin?

Data source plugins communicate with external sources of data and return the data in a format that is compatible with Grafana. When you add a data source plugin, you can immediately use the data in any of your existing dashboards. Use data source plugins when you want to import data from external systems.

Does the QRadar AQL Plugin work with any AQL database?

No, the plugin interacts only with QRadar APIs.

How do I get started with the QRadar AQL Plugin and Grafana dashboards?

The QRadar AQL Plugin is available from the Grafana Plugin Catalog. A link to the plugin can also be found on the IBM App Exchange (https://exchange.xforce.ibmcloud.com/hub).

You can install the plugin, configure a data source, and immediately import working dashboards to visualize your QRadar data. For more information, see Installing the IBM Security QRadar AQL Plugin in your Grafana instance.

The QRadar AQL Plugin includes sample dashboards that you can use as a reference for creating your own dashboards. For more information, see Importing sample dashboards.

Does the QRadar AQL Plugin support all AQL operators and functions?

QRadar AQL Plugin 1.0 supports a subset of AQL operators and functions. The future release will support more operations and functions. To resolve issues with the AQL, contact Customer Support (www.ibm.com/support/).

Does the QRadar AQL Plugin support dashboard template variables?

Yes, dashboard template variables are supported. The bundled sample dashboard in the QRadar AQL Plugin includes examples of dashboard template variables. For more information, see Configuring a dashboard variable and Importing sample dashboards.

Who supports the QRadar AQL Plugin?

The QRadar AQL Plugin is supported by IBM Support.

Can the QRadar AQL Plugin be used to create dashboards that interact with Pulse dashboards?

No, you cannot use the QRadar AQL Plugin with existing Pulse dashboards.

Does the QRadar AQL Plugin support dashboards with multiple data sources?

Yes, each dashboard panel can use data from one or more sources.