IBM QRadar

What is this product?

A SIEM that correlates related events into a single Offense instead of flooding the analyst with separate alerts, and scores it with a number called Magnitude. Its query language, AQL, looks like SQL.

About the company

IBM is a century-old US technology company. It acquired QRadar in 2011 through Q1 Labs, and the product became one of the best-known SIEMs in the Middle East.

What does an analyst do inside it?

• Opens the Offense and reviews the events it was built from.
• Writes an AQL query to search the raw events by user or address.
• Checks the Log Source to confirm the data is complete.
• Closes the Offense with a clear reason, or escalates it.

Its search language

These examples are written in the syntax the product itself accepts.

• SELECT * FROM events WHERE hostname='FIN-WS-014'
• SELECT sourceip FROM events WHERE eventoutcome='failure' GROUP BY sourceip

The field names it uses

• logsourcetype
• hostname
• username
• sourceip
• destinationip
• eventname
• eventoutcome

Where does it show up in the job market?

Widely used by government bodies and banks across the Arab region; many local SOCs build their internal training on it.

Tools in the same category

• Splunk Enterprise Security
• Microsoft Sentinel
• LogRhythm SIEM
• Wazuh
• Elastic Stack (ELK)