correlating-security-events-in-qradar - QRadar Security Event Correlation
Correlates security events in IBM QRadar SIEM using AQL and custom rules to detect multi-stage attacks
Tags
Updated: 2026-06-30Capabilities
Typical Inputs
Typical Outputs
What this skill does
- investigate QRadar offenses
- query events using AQL
- build correlation rules
- create building blocks
- configure reference sets
- analyze authentication failures
- correlate network flows
- tune detection logic
- create custom dashboards
- manage reference sets
Inputs
- QRadar offense ID
- log sources
- AQL query
- rule parameters
- reference set data
- network flow data
- event logs
Outputs
- correlation rules
- QRadar offenses
- custom events
- reference sets
- dashboard widgets
- offense reports
Requirements
- IBM QRadar SIEM 7.5+
- offense management enabled
- AQL search permissions
- rule creation permissions
- normalized log sources