An administrator needs to combine multiple extraction and calculation-based properties into a single property. Which Ariel Query Language (AQL) statement can be used?

Question

Options

• AAQL-based custom properties
• BAQL functions and SELECT, FROM, or database names
• CAQL functions and AQL-based custom properties
• DAQL functions

• A
  83% (19)
• B
  9% (2)
• C
  4% (1)
• D
  4% (1)

Explanation

AQL-based custom properties (option A) are specifically designed in IBM QRadar to let administrators define a single, reusable property using AQL expressions that combine multiple extraction operations and mathematical or logical calculations - exactly what the question describes.

Why the distractors are wrong:

• B is incorrect because SELECT, FROM, and database names are structural components of AQL queries, not mechanisms for packaging combined properties into a single reusable unit.
• C is a trap - while AQL functions can be used inside AQL-based custom properties, the statement that accomplishes the goal is the custom property itself, not the pairing of the two.
• D is incorrect because AQL functions (e.g., CONCAT, LOWER) are utility operations within a query; alone, they don't create a persistent, combined property.

Memory tip: Think of it this way - a "custom property" is the container you define once and reuse everywhere. AQL functions are just the tools you might use inside that container. The question asks for the statement (the thing you create), not the tools inside it - that points directly to AQL-based custom properties.

No community discussion yet for this question.