• EXECUTION
  • MONITORING
  • DATA
  • HUMAN

How to run AQL searches with your AI agent

Connect your AI to IBM QRadar to run complex Ariel Query Language searches without leaving your chat interface.

Ask AI about this page

Short answer

How can I run AQL searches using my AI?

You provide a query, and your agent handles the execution and status tracking in QRadar. It pulls the data once the search finishes so you can ask questions about the logs immediately. You get direct access to Ariel Query Language results through your agent.

Search outcomes

Where your data lands

What happens after you submit a query.

EXECUTION

Query starts

The AI sends your AQL string to QRadar. It handles the initial handoff so you don't have to use the QRadar UI.

MONITORING

Progress tracking

The agent checks if the search is still running or if it has finished. You don't need to manually poll for updates.

DATA

Results ready

Once the search completes, the AI pulls the raw data. You can then ask for summaries or specific patterns in the logs.

HUMAN

Manual review

You decide if the results are sufficient. If the query fails or needs tuning, you provide the corrected AQL.

The workflow

What your AI does when a search is requested.

The AI manages the lifecycle of an Ariel Query from submission to data retrieval.

  1. Submit the query

    The agent takes your natural language request or raw AQL and sends it to the QRadar engine.

    execute_aql

  2. Track progress

    The AI periodically checks the status of the running search to see if it is still processing.

    get_aql_status

  3. Fetch data

    When the status shows the search is done, the agent grabs the resulting dataset.

    get_aql_results

  4. Analyze findings

    The agent processes the returned logs to answer your specific questions about the security events.

    get_aql_results

Try it

Copy these to start.

Use these prompts to trigger searches in QRadar.

Starting points

Replace the bracketed text with your actual QRadar parameters or specific log queries.

IBM QRadar Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — IBM QRadar capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "ibm-qradar-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp"
    }
  }
}
Copy into chat04

  • Run an AQL search for all login failures in the last hour.

  • Execute this AQL query: SELECT * FROM events WHERE sourceip = '192.168.1.1' AND last = 3600.

  • Check the status of my last AQL search to see if it's finished.

  • Get the results for the AQL search I just ran and summarize the top offending IP addresses.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect IBM QRadar once, then ask.

Connect your account in one click. Your credentials stay encrypted, and you can immediately start querying logs through your preferred AI client.

Connect IBM QRadar to your AI

FAQ

How AQL searches behave

  • 01

    Can the AI change my QRadar configurations?

    No. The AI can only execute searches and read results. It cannot modify system settings or user permissions.

  • 02

    Does the AI delete any logs?

    No. The tools are strictly read-only for AQL operations. No data is ever deleted or altered by the AI.

  • 03

    Can I run a search if I don't know AQL?

    Yes. You can describe what you want to find in plain English, and the AI will attempt to write the AQL for you.

  • 04

    How does the AI know when a long search is done?

    The AI uses a status check tool to monitor the search progress until the data is ready to be pulled.

  • 05

    Can the AI create new AQL queries for me?

    Yes. You can ask it to draft a query based on specific event criteria, which it then executes.

  • More questions about IBM QRadar? See everything the IBM QRadar Connector can do

Connect IBM QRadar to Claude, Cursor, ChatGPT & more