Guide · Agent skill

How to use the QRadar Security Event Correlation agent skill

Updated 2026-10-29 · written with AI from the project's own documentation and checked against our catalogue data

This guide explains how to install and use the correlating-security-events-in-qradar skill, a packaged set of instructions that lets an AI agent help with IBM QRadar SIEM work. It is aimed at SOC analysts and detection engineers who already run QRadar and want help writing searches and rules. By the end you will know what the skill does, how to add it to your agent, and how to ask for the kinds of help it is built for.

QRadar Security Event Correlationmukul975/Anthropic-Cybersecurity-Skills · Apache-2.0 Download the skill

Quick start

1Confirm your QRadar version and permissions. Check that you run IBM QRadar SIEM 7.5 or later with offense management enabled, and that your account can manage offenses, create rules and run AQL searches.
2Create an API token. Generate a QRadar API token if you plan to use the included script or the curl examples. Store it somewhere safe.
3Download and unzip the skill. Download the ZIP from this page and unzip it so the folder is named correlating-security-events-in-qradar.
4Place the folder where your agent can find it. Put it in ~/.claude/skills/ for personal use or in a project's .claude/skills/ folder, or upload it in the Claude apps under Settings → Capabilities → Skills.
5Ask a specific QRadar question. Describe the offense, IP, or detection problem in plain language and mention QRadar so the skill is triggered.
6Review the output before running it. Check AQL field names and rule thresholds against your deployment, and confirm any API calls target a host you are authorised to use.
7Apply changes through a controlled process. Test new rules and reference-set changes outside production where possible, then apply them through your normal change process.

What is an agent skill and what does this one do?

An agent skill is a folder containing a SKILL.md file and optional supporting files. When it is installed, an AI agent can read those instructions and follow them when your request matches the skill's description. This one is built for IBM QRadar SIEM and covers investigating offenses, writing correlation rules, and tuning detection logic.

The skill tells the agent how to write AQL (Ariel Query Language) queries to pull events tied to an offense, pivot on a suspicious IP, and join events with network flows to look for lateral movement or data exfiltration. It also drafts building-block and correlation rules, such as linking repeated failed logins to a later successful login, and suggests ways to reduce false-positive offenses.

Write AQL searches for offense investigation and IP pivoting
Draft building-block and correlation rules
Build reference sets for whitelists and watchlists
Suggest tuning steps for false-positive offenses

What do you need before you start?

The skill assumes a working QRadar environment and the right permissions. It does not replace QRadar itself, and its queries and rules only run inside that product.

IBM QRadar SIEM 7.5 or later with offense management enabled
A QRadar user account with offense, rule creation, and AQL search permissions
A QRadar API token, needed for the included script and the curl examples
Python 3, needed for scripts/agent.py, which uses only the standard library

Install the skill from the ZIP file

Download the ZIP for this skill from this page and unzip it. To make it available to Claude Code for yourself, place the folder in ~/.claude/skills/. To share it with one project only, place it in that project's .claude/skills/ folder.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.

Personal install: ~/.claude/skills/correlating-security-events-in-qradar/
Project install: .claude/skills/correlating-security-events-in-qradar/ inside your project
Claude apps: Settings → Capabilities → Skills → upload

Trigger the skill with natural requests

You do not need a special command. Describe the QRadar task in plain language and mention QRadar or the offense you are working on. The skill's description targets SOC analysts investigating offenses, building correlation rules, and tuning detection logic, so requests in those areas are the ones most likely to use it.

"Write an AQL search for the contributing events of offense 12345."
"Pivot on source IP 192.168.1.105 for the last 24 hours in QRadar."
"Draft a QRadar correlation rule for brute force followed by a successful login from the same source."
"Suggest how to reduce false-positive offenses from our service accounts in QRadar."

Example: investigate an offense with AQL

The skill includes an AQL query that lists events in a given offense in time order, with the event name, log source and magnitude. Replace the offense ID with your own. The skill also includes a pivot query that finds all activity from one source IP over the past day.

Review every query in your own QRadar before running it against production data, and confirm the field names match your deployment.

SELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       sourceIP, destinationIP, username,
       LOGSOURCENAME(logSourceId) AS log_source,
       QIDNAME(qid) AS event_name,
       category, magnitude
FROM events
WHERE INOFFENSE(12345)
ORDER BY startTime ASC
LIMIT 500

Example: correlate repeated failures with a later success

The skill describes a two-rule pattern. A building block counts at least 10 authentication failures from the same source IP within 5 minutes and dispatches a custom event. A correlation rule then creates an offense when that building block is followed by an authentication success from the same source IP within 10 minutes, with the same destination IP.

Treat the thresholds and severity values as starting points to adjust for your environment, not as recommendations for every site.

Building block: BB: Multiple Failed Logins from Same Source
Correlation rule: COR: Brute Force with Subsequent Successful Login

Use reference sets to exclude known benign activity

The skill shows how to create a reference set through the QRadar REST API and add entries to it, then use it in rule tests to exclude known sources such as authorised penetration-test hosts. The example uses an authentication header named SEC with your API token.

Replace the host name and token with your own values. Test changes outside production first, because a wrong exclusion can hide real activity.

curl -X POST "https://qradar.example.com/api/reference_data/sets" \
  -H "SEC: YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Known_Pen_Test_IPs",
    "element_type": "IP",
    "timeout_type": "LAST_SEEN",
    "time_to_live": "30 days"
  }'

Safety notes: scripts and network access

This skill runs scripts and uses the network. The bundled scripts/agent.py can call the QRadar REST API directly to run searches and manage reference sets. The reference file references/api-reference.md lists the base URL pattern, the SEC authentication header, and example endpoints.

Use a token with the least privilege that still does the job, and point the skill only at QRadar hosts you are authorised to use. Read scripts/agent.py before running it. Rules and reference-set changes affect live detection, so review them before applying. The skill itself says that log source onboarding and parsing require QRadar administrator access and DSM editor knowledge, so do not use it for that work.

Keep your API token out of shared files and chat logs
Review generated rules and reference-set changes before applying them
Test tuning changes in a non-production environment where possible

What people use it for

Investigating a single offense by listing its contributing events in time order
Pivoting on a suspicious source IP to see all of its activity over the last day
Drafting a building-block and correlation rule for brute force followed by a successful login
Finding top false-positive generators among recently closed offenses to guide tuning
Building reference sets for known penetration-test hosts or critical asset lists

Frequently asked questions

How do I install the QRadar correlation agent skill?

Download the ZIP from this page and unzip it. Put the folder in ~/.claude/skills/ for personal use, or in a project's .claude/skills/ folder to share it within that project. In the Claude apps, upload it under Settings → Capabilities → Skills.

What does IBM QRadar need to run this skill?

The skill targets IBM QRadar SIEM 7.5 or later with offense management enabled. Your user account needs offense, rule creation and AQL search permissions. For the included script and curl examples you also need an API token and Python 3.

Is this skill free to use?

The skill is licensed under Apache-2.0, as stated on this page. Note that IBM QRadar itself is a separate commercial product that you must already have access to, and this page does not describe QRadar pricing.

Does this work with QRadar versions older than 7.5?

The source lists IBM QRadar SIEM 7.5 or later as the prerequisite. It does not say the skill works on earlier versions, so check your version and the query syntax before relying on it.

What is AQL and do I need to learn it?

AQL is Ariel Query Language, QRadar's SQL-like language for searching events, flows and offenses. The skill writes AQL for you, but you should understand the output well enough to check field names and results.

Why does the skill need an API token and network access?

The bundled scripts/agent.py and the curl examples call the QRadar REST API to run searches and manage reference sets, and they authenticate with a SEC header carrying your token. Use a least-privilege token and only target hosts you are authorised to use.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits SOC analysts and detection engineers who already run IBM QRadar 7.5 or later and want help writing AQL searches, correlation rules and false-positive tuning. It is not useful without a QRadar deployment, and it is not the right tool for log source onboarding or parsing, which the skill itself says needs administrator access and DSM editor knowledge. Review every generated rule and API call before applying it to production.

Download the skill