QRadar AQL

SELECT * FROM events WHERE eventName='Logon Failure'

AQL query in QRadar that selects logon failure events, the basis for authentication hunting in IBM's SIEM.

Run it in QRadar when you want to filter failed authentication events with the SIEM's own language: AQL (Ariel Query Language) selects from the normalized events table — eventName='Logon Failure' is the name QRadar assigns to Windows 4625 and to failures from other sources after normalization. It's the way to search over QRadar's data model (normalized eventNames) instead of raw logs: the same query sees Windows, VPN, and application failures. The basis for detection rules and saved SOC searches.

Don't use it if your sources aren't normalized to the expected eventName: QRadar depends on DSMs (parsers for each source) — without the Windows DSM or with custom mapping, the logon failure may have a different eventName and the query returns empty. Verify with SELECT DISTINCT eventName FROM events first. Performance: SELECT * over wide ranges is expensive; narrow with the time range and select only the needed fields. And watch out: AQL is powerful but different from SQL in the details (aggregation function syntax, CASTs); syntax errors are a daily bread when starting out.