Threat Hunting with AQL: From Reactive to Proactive

Hi,

In this article I want to tell you about what may be QRadar’s most powerful yet least-used feature: AQL. Once you learn it, you stop waiting for alerts and start looking for the threat yourself. That shift is exactly what we call threat hunting.

In earlier articles we covered offense analysis and MITRE mapping. Those were the reactive side of the job. This one is dedicated to the proactive side — the hunt.

The Difference Between Reactive and Proactive

Traditional SOC work is reactive. An alert arrives, and you investigate it. That’s necessary but not enough, because you only see what a rule manages to catch.

Threat hunting is different. You go looking, inside the data, for a threat that no rule has fired on and no one has noticed yet. The way to do that is to query QRadar’s database directly.

The reactive approach waits for an alert; the proactive approach searches for the threat.

What Is AQL and What Does It Do?

AQL, the Ariel Query Language, lets you query QRadar’s event and flow data directly.

Here’s the good news: if you know SQL, learning AQL takes very little time. The two languages are quite close. And even if you don’t know SQL, the logic is intuitive; once you grasp it, you gain a skill that stays with you.

The basic skeleton of AQL has three parts:

• SELECT: Which fields do you want to see? (source IP, username, event count…)
• FROM: Where are you pulling the data from? (events or flows)
• WHERE: Which conditions are you looking for? (a specific category, IP, user…)

Add the LAST clause for the time range, and you’ve built the foundation of most hunting queries.

The basic skeleton of an AQL query: SELECT, FROM, WHERE, and LAST.

A Simple Query

Get Ali Rıza Yüksektepe’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Say you want to see the sources with the most failed authentications in the last 24 hours. The query looks like this:

SELECT sourceip, username, COUNT(*) AS attempts
FROM events
WHERE category = 'Authentication Failure'
GROUP BY sourceip
ORDER BY attempts DESC
LAST 24 HOURS

This query lists the sources that stand out from the noise. An IP with a very high attempt count is a candidate to investigate right away.

What Makes Hunting Stronger: Reference Sets

The real power of AQL shows when you work with dynamic lists rather than static values. For example, you can put your critical users in a reference set and call that list from your query:

Two Other Two Tools of Hunting

AQL is powerful on its own, but two more methods complete it:

• Time series analysis: By tracking a behavior over time, you catch abnormal spikes. For example, a value that is usually 10 per day suddenly hitting 500 is a clue in itself.
• Payload analysis: Where normalized fields fall short, you drop into the raw log content. IoCs — indicators of compromise (a suspicious domain, hash, or IP) — are often hidden right there.

When you use these three together, you make visible the silent threats a rule could never catch.

Hunting is a loop: it starts with a hypothesis and completes by turning the finding into a permanent rule.

Practical Tips

• Start narrow. First tighten the time range and conditions. Broad queries that scan the whole database are slow and overwhelming.
• Use indexed fields. Building your queries on indexed fields speeds up results noticeably.
• Hunt with a hypothesis. Starting with a concrete question — “Is there after-hours access to critical accounts?” — is far more productive than aimless scanning.
• Turn findings into rules. If you convert a pattern you caught while hunting into a permanent rule, you’ll catch it automatically next time.

Wrapping Up

AQL is the tool that turns you from an analyst waiting for alerts into a hunter looking for threats. When you combine the SELECT–FROM–WHERE skeleton with reference sets, time series, and payload analysis, your defense stops being reactive and becomes proactive.

If you’d like to write AQL queries from scratch and see real hunting scenarios hands-on, I gave this topic special attention in my QRadar course (Turkish narration with full English subtitles). Leaving it here in case you want to go deeper:

QRadar SIEM Analyst: Analysis, Engineering and Threat Hunting.

In the next article, we’ll get into rule and Building Block design.

Hope this was useful. See you in the next one.