# IBM QRadar AQL Searches & Reports — Ariel Query Language, Dashboards & Data Accumulation Source: https://ai.techclick.in/blog_ibm_qradar_aql_searches_reports Markdown: https://ai.techclick.in/blog_ibm_qradar_aql_searches_reports.md Publisher: Techclick Infosec Pvt Ltd Master IBM QRadar AQL searches and reports in 2026: write Ariel Query Language queries, build saved searches, create time-series dashboards, schedule reports, and use data accumulation for trend analysis across your SIEM estate. IBM QRadar AQL Searches & Reports — Ariel Query Language, Dashboards & Data Accumulation student learning map A visual study map for IBM QRadar AQL Searches & Reports — Ariel Query Language, Dashboards & Data Accumulation showing learning path, evidence, traps, and practice sequence. TECHCLICK STUDY MAP IBM QRadar AQL Searches & Reports — Ariel Query... IBM · learn the flow, prove with evidence, avoid unsafe shortcuts 1. Start 🎯 By the end you will be able to 2. Understand Pick where you want to start 3. Prove ① Ariel Query Language — the SQL... 4. Practice ② Saved searches — your reusable... How to use this page First build the mental model, then connect the concept to a realistic production decision. Finish by testing yourself. Techclick Infosec Pvt Ltd | ai.techclick.in | Training Contact: WhatsApp +91 92772 29456 Content-specific feature visual for this lesson: use it as the 60-second map before reading the full detail. Most analysts think… Many QRadar users treat the search bar as a last resort — something you only open when an offense has already fired. That leaves most of the Ariel database untouched and most operational questions unanswered. AQL is a first-class investigation tool . Write it, save it, pin it to a dashboard, schedule it as a report, and accumulate it for long-term trending. Understanding that four-step pipeline — query → save → visualise → report — is what separates analysts who react to offenses from engineers who proactively hunt across months of data with a few lines of SQL-like syntax. ## ① Ariel Query Language — the SQL of QRadar AQL (Ariel Query Language) is a SQL-like language for querying the Ariel database . The two primary tables are events (log data from all sources) and flows (network session data from QFlow sensors). A basic search follows standard SQL structure: SELECT picks columns, FROM names the table, WHERE filters, GROUP BY aggregates, and ORDER BY sorts results. A simple example: SELECT sourceip, destinationip, eventcount FROM events WHERE category = 5018 LAST 24 HOURS returns all authentication failure events in the last day. The LAST N HOURS/MINUTES/DAYS clause is QRadar-specific and avoids timestamp arithmetic. AQL also supports QIDMAP , CATEGORYMAP and PROTOCOLMAP lookup functions to convert raw numeric IDs into readable names directly inside the query. Common aggregate patterns: use COUNT(*) with GROUP BY username to count events per user, SUM(eventcount) for totals, and UNIQUE(sourceip) (QRadar extension) to count distinct source IPs. Every AQL column reference is case-insensitive, and QDP (QRadar Data Platform) deployments share the same AQL surface as traditional on-prem deployments. Figure 1 — AQL query execution path in QRadar Every AQL search travels from the console through the Ariel query engine to indexed event and flow data, then returns results. - AQL query execution path in QRadar AQL input console or API call Query engine parse + optimise AQL Ariel DB events or flows table Aggregate GROUP BY / COUNT Results table or chart output Every AQL search travels from the console through the Ariel query engine to indexed event and flow data, then returns results. Use QIDMAP() to avoid raw numeric IDs Raw AQL returns numeric QIDs, categories and protocol codes. Wrap them: QIDMAP(qid) returns the event name, CATEGORYMAP(category) returns the category label, and PROTOCOLMAP(protocolid) returns the protocol name. Add these in your SELECT and your results are immediately readable without a lookup table. Quick check · Q1 of 10 · Remember Which AQL time clause avoids manual timestamp arithmetic in a QRadar search? a) BETWEEN '2026-01-01' AND '2026-01-02' b) LAST N HOURS / MINUTES / DAYS c) WHERE starttime > NOW() - 86400 d) TIME_RANGE PREVIOUS_DAY Correct: b. QRadar AQL adds the LAST N HOURS/MINUTES/DAYS clause as a QRadar-specific extension that handles relative time without manual timestamp math. BETWEEN and epoch arithmetic are valid SQL but not the idiomatic AQL approach. 👉 So far: AQL is SQL-like: SELECT columns FROM events or flows WHERE filters LAST N HOURS. Use QIDMAP(), CATEGORYMAP() and UNIQUE() to enrich results directly in the query. ## ② Saved searches — your reusable baseline Once a search returns the results you need, click Save Criteria to persist it under a name visible to you or shared with all users. A saved search stores the full AQL (or GUI filter set), the selected columns, the default time range and the sort order. Shared saved searches are the team's canonical baseline — everyone runs the same query, so counts are comparable across shifts. ### Quick filters and column management On the results page you can apply Quick Filters on top of the saved criteria without rewriting AQL — useful for pivoting on a single IP or username during an investigation. The Add Column option adds QRadar-enriched fields such as asset data, geographic location or custom properties without touching the underlying AQL. Saved searches also drive the search index — marking a search as indexed tells QRadar to pre-compute results on ingest, dramatically speeding up dashboard loads for high-cardinality queries. Name discipline matters: prefix team searches with a category tag (e.g. [SOC] Failed logins by user ) so they sort together. Export saved searches as XML for change management and import them into a new deployment or staging environment. Figure 2 — Saved search reuse layers One saved search underpins investigation, dashboards, scheduled reports and data accumulation — write it once, use everywhere. Saved search reuse layers Raw AQL SELECT … FROM events WHERE … LAST 24 HOURS Saved search named, shared, time-range + column config stored Dashboard item time-series chart refreshed on poll interval Scheduled report HTML/PDF emailed on cron — daily/weekly/monthly Data accumulation rolled-up counts beyond raw retention window One saved search underpins investigation, dashboards, scheduled reports and data accumulation — write it once, use everywhere. 🗄️ Ariel Database tap to flip The columnar time-series store inside QRadar that holds all normalized events and flows. AQL queries target it directly via the events and flows tables. 🔍 AQL SELECT tap to flip Ariel Query Language follows SQL: SELECT columns FROM events/flows WHERE filters, plus QRadar extensions like LAST N HOURS, QIDMAP() and UNIQUE(). 📌 Saved Search tap to flip A named, shareable AQL query with column config and time range. The foundation for dashboards, scheduled reports and data accumulation. 📈 Data Accumulation tap to flip A scheduled aggregation job that writes rolled-up event counts to a separate store, keeping trend data alive long after raw events roll off the retention window. Quick check · Q2 of 10 · Understand What is the main benefit of marking a saved search as indexed in QRadar? a) It pre-computes results on ingest so dashboard loads are faster for high-cardinality queries b) It emails results automatically every hour c) It encrypts the search criteria d) It exports the search to PDF format Correct: a. Marking a saved search as indexed tells QRadar to pre-aggregate the results at ingest time. This dramatically speeds up dashboard refresh for searches that group by high-cardinality fields like username or sourceip. Email scheduling, encryption and PDF export are separate features. 👉 So far: Save Criteria persists your AQL as a named, shared search with column config and time range. Mark high-traffic searches as indexed so dashboards load fast. ## ③ Dashboards and time-series visualisations QRadar dashboards are composed of dashboard items — each item is a saved search, an offense summary, a system health widget or a custom chart. To add a search result as a chart: open the search, click Add to Dashboard , choose a chart type (bar, line, pie, table) and pick a target dashboard. The chart refreshes on the dashboard's configured poll interval. Time-series items are the most powerful. Instead of a single count, a time-series chart shows how an event count or flow volume changed over time — essential for spotting slow-burn attacks, usage anomalies and baseline drift. Enable time-series on a saved search by choosing a time-grouping (per hour, per day) and an aggregate function. Multiple saved searches on one dashboard give you correlated views: failed logins next to successful logins next to VPN connections on the same time axis tells a story that individual tables cannot. Role-based dashboard sharing means a CISO dashboard shows executive KPIs while an L1 analyst dashboard shows live offense counts and source-IP heat maps — both drawing from the same saved searches underneath. Keep dashboard item counts reasonable; too many simultaneous refreshes slow the console for everyone. Figure 3 — QRadar dashboard data sources Every dashboard item pulls from one of these sources — saved searches feed the majority of operational and executive views. QRadar dashboard data sources QRadar Dashboard role-based layout Saved AQL search Offense summary System health Time-series chart Flow volume graph Custom properties Every dashboard item pulls from one of these sources — saved searches feed the majority of operational and executive views. Too many dashboard items kills console performance Every dashboard item fires a search query on its poll interval. If ten analysts each have dashboards with twenty items refreshing every minute, the Ariel query engine is under constant load. Group related searches into fewer items, set realistic poll intervals (five or ten minutes for most charts), and use indexed searches for the highest-traffic widgets. ### ▶ Watch a failed-login AQL search become a live dashboard chart Follow how one AQL query goes from the search bar to a pinned time-series chart. Press Play for the healthy path, then Break it to see the classic missed step. ① Write AQL Analyst types: SELECT username, COUNT(*) AS cnt FROM events WHERE category = 5018 GROUP BY username LAST 7 DAYS ORDER BY cnt DESC ▼ ② Save criteria Click Save Criteria, name it '[SOC] Failed logins by user 7d', set it as Shared so all team members see the same baseline. ▼ ③ Pin to dashboard Open the SOC dashboard, click Add Item, select the saved search, choose Bar Chart with daily time-series grouping and set a 10-minute poll interval. ▼ ④ Chart goes live The dashboard item refreshes automatically. The CISO can see at a glance if failed logins spiked overnight — no manual query needed. Press Play to step through the AQL-to-dashboard path. Then press Break it . ▶ Play Next ▶ ⚠ Break it ↺ Reset Quick check · Q3 of 10 · Apply A CISO wants to see failed login counts per hour over the last 30 days on their executive dashboard. What is the right QRadar feature combination? a) A raw AQL query run manually each morning b) An offense rule that triggers an email c) A saved search with time-series grouping pinned as a dashboard item d) A network activity filter exported to CSV Correct: c. A saved search with per-hour time-series grouping, pinned to the CISO dashboard as a chart item, will auto-refresh and show the trend over 30 days. Manual runs, offense emails and CSV exports do not provide a live, auto-updating dashboard view. 👉 So far: Dashboard items are pinned saved searches rendered as bar, line, pie or table charts. Time-series items group by hour or day to reveal trend patterns — essential for baseline drift and slow-burn detection. ## ④ Scheduled reports and data accumulation Reports in QRadar are scheduled output documents — HTML or PDF — that combine one or more saved searches, charts and text containers. The Report Wizard walks you through: choose a template, add content containers (charts, tables, free text), set a schedule (daily, weekly, monthly, on-demand) and set recipients. Reports can be emailed directly from QRadar or placed in a shared folder. A weekly firewall summary or a monthly executive compliance report is a three-minute setup once your saved searches exist. ### Data accumulation — surviving the retention window Data accumulation is the answer to 'we only keep 90 days of raw events but I need six months of trend data'. You configure an accumulation profile against a saved search: QRadar runs the aggregation query periodically and writes the rolled-up counts to the accumulation store. Trend reports then query the accumulation data, not the raw Ariel tables. This lets you show monthly login-failure trends, quarterly bandwidth summaries or year-over-year security posture metrics without bloating raw storage. Combine accumulation data with a time-series dashboard item and you get a living trend chart that updates automatically. Figure 4 — Raw events vs accumulated data Raw Ariel storage is bounded by the retention policy; data accumulation extends trend visibility indefinitely at low storage cost. Raw events vs accumulated data Raw Ariel events Full event detail available Bounded by retention window High storage cost per day Best for deep investigation Accumulated data Aggregated counts only Survives beyond retention Very low storage overhead Best for long-term trending Raw Ariel storage is bounded by the retention policy; data accumulation extends trend visibility indefinitely at low storage cost. Priya at a Mumbai fintech faces this Priya's L1 team runs a manual AQL search every morning to count failed logins by user, copying results into a spreadsheet. There is no visibility into trends, and last month's data is already gone past the 60-day Ariel retention window. Likely cause No saved searches, no dashboards and no data accumulation profile are configured — every insight is one-off and ephemeral. Diagnosis Open QRadar ▸ Log Activity ▸ Advanced Search — the AQL is sound but never saved. Dashboards tab shows only default system items. Report Wizard has not been used. Log Activity ▸ Save Criteria + Dashboards ▸ Add Item + Admin ▸ Data Accumulation Fix Save the AQL as a shared search, pin it as a time-series dashboard item (grouped per day), schedule a weekly HTML report for the CISO, and create a data accumulation profile so monthly counts persist beyond 60 days. Verify The dashboard auto-refreshes hourly. The CISO receives the weekly report by email. Six months later, the accumulation store still shows the month-over-month trend even though raw events have long rolled off. Confirm accumulation is running before raw data rolls off Go to Admin ▸ Data Accumulation ▸ Manage Profiles and verify the Last Run timestamp and status for each profile. A profile that silently failed will show stale results in your trend reports — and by the time you notice, the raw events have already rolled off and cannot be re-accumulated. Quick check · Q4 of 10 · Analyze QRadar retains raw events for 90 days but management needs a 12-month login-failure trend. What solves this? a) Extend the raw Ariel retention window to 12 months for all events b) Export events to CSV each month and aggregate in Excel c) Create a new offense rule with a 12-month time window d) Configure a data accumulation profile on the failed-login saved search Correct: d. Data accumulation runs the aggregated saved search on a schedule and stores rolled-up counts separately — trend data survives beyond the raw retention window at low storage cost. Extending raw retention bloats storage; CSV exports are manual; offense rules are not designed for long-term trend aggregation. 👉 So far: Scheduled reports combine saved searches into HTML or PDF sent on a cron. Data accumulation writes aggregated counts beyond raw retention — configure and verify it before events roll off. ### 🤖 Ask the AI Tutor Tap any question — instant, scoped to this lesson. No login, no waiting. What is the Ariel database in QRadar? What is the AQL syntax for grouping events by username? How do I share a saved search with my whole SOC team? How do I add a saved search to a QRadar dashboard? What is data accumulation and when should I use it? How do I schedule a QRadar report for weekly delivery? Pre-curated from vendor docs + community Q&A, scoped to this lesson. For a live prod issue, paste your export into chat.techclick.in. ## 📝 Wrap-up assessment — six more You've answered 4 inline. Six left. 70% (7 of 10) marks the lesson complete on your profile. Tap Submit all answers at the end. Q5 · Remember Which two primary tables does AQL query in the Ariel database? a) events and flows b) logs and sessions c) alerts and packets d) rules and offenses Correct: a. AQL targets the events table for log-source data and the flows table for QFlow network-session data. Logs, sessions, alerts, packets, rules and offenses are not AQL table names. Q6 · Understand What does the QRadar-specific UNIQUE() function do in an AQL SELECT? a) Removes duplicate rows from the output b) Counts distinct values of a column (like COUNT DISTINCT) c) Encrypts the column value d) Joins two tables on a common key Correct: b. UNIQUE(column) is a QRadar AQL extension equivalent to COUNT(DISTINCT column). It counts the number of distinct values in the specified column across the result set — useful for counting unique source IPs or unique usernames. Q7 · Apply An analyst wants every team member to run the same failed-login AQL and see the same column layout. What is the fastest setup? a) Email the AQL text to each analyst so they can paste it b) Create an offense rule that duplicates the search output c) Save the search with 'Share with all users' checked so it appears under Shared Searches for everyone d) Export results to CSV and share the file daily Correct: c. Saving with 'Share with all users' makes the search visible to every analyst under Shared Searches. Email/paste, offense rules and CSV exports are all manual or indirect approaches that do not enforce a consistent column layout. Q8 · Analyze A dashboard has 25 items each refreshing every minute. Analysts report the console is sluggish. What is the most likely cause? a) QRadar has too many log sources b) The network switch is dropping packets c) AQL syntax errors in the saved searches d) Excessive concurrent Ariel queries from dashboard item refreshes are overloading the query engine Correct: d. Each dashboard item fires an Ariel query on its poll interval. 25 items at 1-minute intervals means 25 concurrent queries per minute. The Ariel query engine becomes saturated. Fix: reduce item count, use indexed searches for high-cardinality widgets, and lengthen poll intervals. Q9 · Evaluate Management needs a 12-month failed-login trend but raw Ariel events are retained for only 90 days. What is the correct solution? a) Configure a data accumulation profile on the failed-login saved search to persist monthly totals b) Extend raw retention to 12 months for all event categories c) Download events to a separate database every 90 days d) Use a QRadar offense rule with a 12-month time correlation window Correct: a. Data accumulation writes aggregated counts to a separate store on a schedule — those totals persist beyond raw retention at very low storage cost. Extending raw retention bloats storage; manual downloads are error-prone; offense correlation windows are not designed for long-term aggregation. Q10 · Evaluate Which combination delivers automated, formatted security summaries to non-technical stakeholders without them accessing the QRadar console? a) Offense email notifications only b) Direct console access via a read-only account c) Scheduled QRadar reports in HTML or PDF format, emailed automatically on a configured interval d) A dashboard shared as a screenshot in a weekly email Correct: c. Scheduled reports in QRadar combine saved searches and charts into a formatted HTML or PDF document emailed on a cron — no console access needed. Offense emails are unformatted alerts; read-only console access requires training; manual screenshot emails are not automated. Submit all answers Try again Lesson complete — saved to your profile. Almost! You need 70% (7 of 10) — re-read the path that tripped you up and tap "Try again". ### 🧠 In your own words Type one line: what is the difference between a QRadar saved search, a dashboard item and a data accumulation profile? Then compare with the expert version. Compare with expert answer Expert version: A saved search is a stored AQL query with column layout and time range — the single source of truth your team runs. A dashboard item is that saved search rendered as a chart (bar, line, pie or table) and auto-refreshed on a poll interval so you get live visibility without running queries manually. A data accumulation profile runs the saved search's aggregation on a schedule and writes the rolled-up counts to a separate store — so monthly or quarterly trend data survives long after raw Ariel events have rolled off the retention window. The hierarchy is: write the AQL once, save it, pin it to dashboards, report on it, and accumulate it for the long term. ### 🗣 Teach a friend Best way to lock it in — explain it in one line to a teammate. Tap to generate a paste-ready summary. Generate my one-liner 📩 Quiz me on this in 7 days. Opt in and we'll email 3 micro-questions on IBM QRadar at Day 1, Day 7 and Day 30 — spaced repetition is how this sticks. Un-tick any time. ### 📖 Glossary AQL (Ariel Query Language) The SQL-like query language used to search events and flows in the QRadar Ariel database. Supports SELECT, FROM, WHERE, GROUP BY, ORDER BY plus QRadar extensions such as LAST N HOURS, QIDMAP() and UNIQUE(). Ariel database QRadar's internal columnar time-series store for all normalized events and flows. The events and flows tables are the primary AQL targets. Saved search A named, shareable AQL query with column configuration and time range, stored in QRadar. Shared saved searches give the whole team a consistent baseline. Dashboard item A widget on a QRadar dashboard that renders a saved search as a chart (bar, line, pie or table) and auto-refreshes on a configured poll interval. Time-series chart A dashboard item that groups a saved search result by time (per hour, per day) to show how event or flow volumes change over a period. Data accumulation A QRadar feature that runs a saved search's aggregation on a schedule and writes rolled-up counts to a separate store, preserving trend data beyond the raw Ariel retention window. QIDMAP() An AQL function that converts a raw numeric QID (event identifier) into its human-readable event name, making query results immediately readable. Scheduled report A QRadar report that automatically combines saved searches and charts into an HTML or PDF document and emails it to configured recipients on a cron schedule. #### 📚 Sources IBM — QRadar SIEM: Ariel Query Language (AQL) reference guide . ibm.com/docs/en/qradar-siem - IBM — QRadar: Creating and managing saved searches . ibm.com/docs/en/qradar-siem - IBM — QRadar: Adding and managing dashboard items and charts . ibm.com/docs/en/qradar-siem - IBM — QRadar: Creating and scheduling reports . ibm.com/docs/en/qradar-siem - IBM — QRadar: Configuring data accumulation to preserve trend data . ibm.com/docs/en/qradar-siem - IBM Security — QRadar SIEM: AQL functions (QIDMAP, CATEGORYMAP, UNIQUE) . ibm.com/docs/en/qradar-siem ### What's next? Mastered searches and reports? Next, learn how QRadar offenses are created and managed — how the correlation engine groups related events into a single offense, how to tune offense rules, and how to work a SOC queue end-to-end. Next · All interview lessons → Practice on exam.techclick.in → --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt