IBM QRadar Events: How To Export And Analyze

By SOC Prime Team
Publication Date: 2026-10-29 13:15:00

The cleanest way to get raw events out of QRadar is the Ariel REST API. Run an AQL query that selects UTF8(payload), wait for the search to finish, and pull the results as JSON. You end up with the original log lines exactly as your log sources sent them. The Log Activity tab can export search results too, but not in a format LogTotal reads today.

QRadar sits at the center of a lot of SOCs, and sooner or later someone needs a slice of its data outside the console: an IR partner, a second opinion, a quick check without building a new rule. Prime Core has 23,656 detection rules for QRadar, mapped to 674 MITRE ATT&CK techniques. Below is how to pull a clean slice of raw events, sanitize it, and investigate it for free in LogTotal.

This guide covers QRadar SIEM, on-premises and software. If your company was on QRadar SaaS, which IBM sold to Palo Alto Networks in 2024, you may have moved to Cortex XSIAM since.

Get Started For Free