How to Export Raw Events from IBM QRadar Using the Ariel API
Summary
A practical guide to exporting readable QRadar event payloads with AQL and the Ariel REST API, including token scope, retention, certificate, and troubleshooting considerations, then reviewing the data in LogTotal.
Key points
- Use AQL with UTF8(payload) to export readable raw event text through the Ariel REST API.
- Create an authorized service token and check its security profile, which controls the log sources and networks visible to the export.
- Filter by log source and time window; events outside configured retention cannot be exported.
- The example workflow starts an Ariel search, checks its status, and retrieves results as JSON; large result sets can be fetched using Range headers.
- QRadar exports Windows events as text payloads, not EVTX files; flow data is stored separately from events.
- For self-signed console certificates, use curl with the console’s CA rather than disabling certificate verification.
- The guide suggests uploading and sanitizing the exported file before reviewing it in LogTotal.
Article Details
- Defense Focus
- Export and review raw SIEM event data for incident response or investigation, preserving the original log payloads.
- Detection Methods
- Use filtered AQL searches with a narrow time window and log-source or event-type criteria to retrieve relevant records.
- Test the query in the console's Advanced Search and check the event count before exporting.
- Run an asynchronous search through the Ariel REST API, poll until it completes, then retrieve payloads or structured event results.
- Sanitize exported data before reviewing it in LogTotal.
- Data Sources
- Event records containing timestamps, log-source names, event names, and raw payloads
- WinCollect-collected Windows events, available as text payloads rather than EVTX files
- Flow records containing network connection data
- Rule Types
- AQL searches
- Defensive Actions
- Create an authorized service token with an appropriate security profile and expiry; verify that its access scope includes the log sources needed for the investigation.
- Keep the query within the configured event-retention window and check the console time zone when results are unexpectedly empty.
- Select UTF8(payload) to return readable log text.
- Use the console's CA certificate with curl rather than disabling certificate verification.
- For large result sets, retrieve results in pages using a Range header.
- Export Windows events from the Windows host when actual EVTX files are required.