An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining to the top abnormal events of the most bandwidth-intensive IP addresses. How can the…

Question

Options

• ABuild an AQL query using the QRadar Scratchpad
• BCombine GROUP BY and ORDER BY clauses in a single query
• CUse the IBM DataStudio to create the query
• DBuild an AQL query using the QRadar GUI using Assets > Search Filter

• A
  12% (5)
• B
  79% (33)
• C
  7% (3)
• D
  2% (1)

Explanation

Combining GROUP BY and ORDER BY in a single AQL (Ariel Query Language) query is the correct approach because GROUP BY aggregates event data per IP address while ORDER BY ranks those groups by bandwidth consumption - together they produce a sorted, filtered view of the top offenders. A is wrong because "QRadar Scratchpad" is not a real QRadar feature or tool for building AQL queries. C is wrong because IBM DataStudio is a GUI tool for relational databases (like DB2) and has no role in querying QRadar's Ariel data store. D is wrong because Assets > Search Filter is used to manage and filter network asset inventory, not to query event or flow data.

Memory tip: Think of it as a leaderboard - GROUP BY puts players on teams (per IP), and ORDER BY ranks the teams by score (bandwidth). You always need both to build a "top N" list in AQL.

No community discussion yet for this question.