Grafana-AQL integration for QRadar SIEM

Grafana
1

Hello.

I have been trying to make some custom AQL queries in Grafana to my IBM QRADAR Siem. But the query results are blank.
Also, I have tested the integrations, and I can see the default IBM QRADAR SIEM dashboards in my Grafana working Properly.

Do you know if there is any missconfiguration that i must check?

Thanks!

Regards,

2

welcome @guillermomartinez

Are you including some filter on that query?

3

Hello @yosiasz !

Yes, I’m using some filters in the AQL Filter. Also, I’m using some custon fields, but in the query inspector it saids that it found 0 results. I Test the same query in QRADAR, and it shows me the results, so, the query is working.

Thanks!

1 Like
4

so check the Query Inspector, copy the generated query and run it outside of grafana in some AQL query tool

also check browser console and network tab

5

I done it using postman, for example, uing postman, doing exactly what is the api AQL Qeury proceess, and it work properly to.

6

also check browser console and network tab. is it a rest api endpoint? can you post the json generated from postman?

are you using infinity?

7

I’m not using infinity. I’m using the IBM QRADAR Plugin from Grafana

1 Like
8

I had the same problem and with the help of IBM support reviewing the dashboards that come with the plugin, we noticed that you have to specify the datatype of the custom property.

SELECT 
  LONG(starttime/(1000*60)) AS minute,
  starttime AS stime,
  "Events per Second Raw - Average 1 Min" AS double,
  STR(parent) AS str
FROM events
WHERE logsourceid=65 AND str IN (
  SELECT str 
  FROM (
    SELECT Parent as str,
    "Events per Second Raw - Average 1 Min" AS double
    FROM events
    WHERE parent <> NULL AND logsourceid=65
    GROUP BY str
    ORDER BY double DESC
    LIMIT 5
    $__timeFilter(starttime)
  )
)
GROUP BY minute, str
ORDER BY minute DESC
$__timeFilter(starttime)

So to grab a custom property with a space in the name. I have had to do the following STR(“Machine Identifier”).

1 Like
9

So the key factor is defining the data type for the custom property.

They plan on making it easier in future versions of the data source.

STR(parent) AS parent
OR
(“parent”) AS str

“Events per Second Raw - Average 1 Min” AS double
LONG(starttime/(1000*60)) AS minute