Skip to content
Get packs

QRadar Security Event Correlation

Guides an agent through investigating and correlating IBM QRadar SIEM offenses using AQL queries and rules.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

Once installed, the agent can help a security analyst work through IBM QRadar, a widely used security information and event management (SIEM) system. It writes AQL (Ariel Query Language) queries to pull events related to an offense, pivots on suspicious IPs, drafts correlation and building-block rules that link failed and successful logins or unusual data transfers, and suggests ways to reduce false-positive alerts. A bundled Python script can also call the QRadar REST API directly to run searches and manage reference sets.

Great for

  • SOC analysts who already use IBM QRadar and want help writing AQL searches
  • Detection engineers building or tuning multi-stage correlation rules
  • Teams trying to reduce false-positive offenses in QRadar

Skip it if

  • Users without a QRadar deployment, since the queries and rules only work inside that product (version 7.5+ is stated).
  • Log source onboarding or parsing work, which the skill itself says requires administrator access and DSM editor knowledge.
  • Production tuning without review: rules and reference-set changes affect live detection and could hide real attacks if applied untested.

Try asking

  • “Write an AQL query to pull all events contributing to offense 12345 and sort them by time.”
  • “Draft a correlation rule that raises an offense when brute-force failures are followed by a successful login from the same source IP.”
  • “Find the top sources of false-positive offenses from the last 30 days and suggest tuning steps.”
  • “Build an AQL search that flags possible data exfiltration through large outbound flows after many DNS queries.”
Step-by-step guide: how to use QRadar Security Event CorrelationInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    correlating-security-events-in-qradar.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip correlating-security-events-in-qradar.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip correlating-security-events-in-qradar.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Test every AQL query and rule in a non-production QRadar environment before applying it to live detection.
  • Review the script's SSL setting: by default it disables certificate verification (verify_ssl=False), so enable verification for production hosts.
  • Give the agent only a read-scoped API token when investigating, and keep rule-changing permissions separate.

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.