[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6ET7AFQCHRJ4X79GSBEVNF6":3,"skill-same:01M6ET7AFQCHRJ4X79GSBEVNF6":89},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":50,"commitSha":51,"skillDirectory":52,"forksCount":53,"repositoryHtmlUrl":54,"repositoryHomepageUrl":6,"ownerHtmlUrl":55,"ownerBlogUrl":6,"ownerDescription":56,"updatedAt":57,"install":58,"resources":71},"01M6ET7AFQCHRJ4X79GSBEVNF6","correlating-security-events-in-qradar",null,"Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.","luokai0\u002Fai-agent-skills-by-luo-kai","luokai0","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F266954973?v=4","01M6E16VNT42JB8B3X3254QWJ7","luo kai","01M6E16VTFVP6S5XJF1V1MPV90",14,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fcorrelating-security-events-in-qradar\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"security","events","qradar","correlating security events in qradar","sources","false","across","query","log","use","Building Blocks","SOC-operations","ibm","offense-management","aql","endpoint","network","soc","siem","cybersecurity","2026-11-10 10:12:30",false,"---\nname: correlating-security-events-in-qradar\ndescription: >\n  Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules,\n  building blocks, and offense management to detect multi-stage attacks across network, endpoint,\n  and application log sources. Use when SOC analysts need to investigate QRadar offenses, build\n  correlation rules, or tune detection logic for reducing false positives.\ndomain: cybersecurity\nsubdomain: soc-operations\ntags: [soc, qradar, siem, aql, correlation, offense-management, ibm]\nversion: \"1.0\"\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Correlating Security Events in QRadar\n\n## When to Use\n\nUse this skill when:\n- SOC analysts need to investigate QRadar offenses and correlate events across multiple log sources\n- Detection engineers build custom correlation rules to identify multi-stage attacks\n- Alert tuning is required to reduce false positive offenses and improve signal quality\n- The team migrates from basic event monitoring to behavior-based correlation\n\n**Do not use** for log source onboarding or parsing — that requires QRadar administrator access and DSM editor knowledge.\n\n## Prerequisites\n\n- IBM QRadar SIEM 7.5+ with offense management enabled\n- AQL knowledge for ad-hoc event and flow queries\n- Log sources normalized with proper QID mappings (Windows, firewall, proxy, endpoint)\n- User role with offense management, rule creation, and AQL search permissions\n- Reference sets\u002Fmaps configured for whitelist and watchlist management\n\n## Workflow\n\n### Step 1: Investigate an Offense with AQL\n\nOpen an offense in QRadar and query contributing events using AQL (Ariel Query Language):\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       sourceIP, destinationIP, username,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       QIDNAME(qid) AS event_name,\n       category, magnitude\nFROM events\nWHERE INOFFENSE(12345)\nORDER BY startTime ASC\nLIMIT 500\n```\n\nPivot on the source IP to find all activity:\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       destinationIP, destinationPort, username,\n       QIDNAME(qid) AS event_name,\n       eventCount, category\nFROM events\nWHERE sourceIP = '192.168.1.105'\n  AND startTime > NOW() - 24*60*60*1000\nORDER BY startTime ASC\nLIMIT 1000\n```\n\n### Step 2: Build a Custom Correlation Rule\n\nCreate a multi-condition rule detecting brute force followed by successful login:\n\n**Rule 1 — Brute Force Detection (Building Block):**\n```\nRule Type: Event\nRule Name: BB: Multiple Failed Logins from Same Source\nTests:\n  - When the event(s) were detected by one or more of [Local]\n  - AND when the event QID is one of [Authentication Failure (5000001)]\n  - AND when at least 10 events are seen with the same Source IP\n    in 5 minutes\nRule Action: Dispatch new event (Category: Authentication, QID: Custom_BruteForce)\n```\n\n**Rule 2 — Brute Force Succeeded (Correlation Rule):**\n```\nRule Type: Offense\nRule Name: COR: Brute Force with Subsequent Successful Login\nTests:\n  - When an event matches the building block BB: Multiple Failed Logins from Same Source\n  - AND when an event with QID [Authentication Success (5000000)] is detected\n    from the same Source IP within 10 minutes\n  - AND the Destination IP is the same for both events\nRule Action: Create offense, set severity to High, set relevance to 8\n```\n\n### Step 3: Use AQL for Cross-Source Correlation\n\nCorrelate authentication failures with network flows to detect lateral movement:\n\n```sql\nSELECT e.sourceIP, e.destinationIP, e.username,\n       QIDNAME(e.qid) AS event_name,\n       e.eventCount,\n       f.sourceBytes, f.destinationBytes\nFROM events e\nLEFT JOIN flows f ON e.sourceIP = f.sourceIP\n  AND e.destinationIP = f.destinationIP\n  AND f.startTime BETWEEN e.startTime AND e.startTime + 300000\nWHERE e.category = 'Authentication'\n  AND e.sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) = 'Authentication Failure'\n      AND startTime > NOW() - 3600000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 20\n  )\n  AND e.startTime > NOW() - 3600000\nORDER BY e.startTime ASC\n```\n\nDetect data exfiltration by correlating DNS queries with large outbound flows:\n\n```sql\nSELECT sourceIP, destinationIP,\n       SUM(sourceBytes) AS total_bytes_out,\n       COUNT(*) AS flow_count\nFROM flows\nWHERE sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) ILIKE '%DNS%'\n      AND destinationIP NOT IN (\n        SELECT ip FROM reference_data.sets('Internal_DNS_Servers')\n      )\n      AND startTime > NOW() - 86400000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 500\n  )\n  AND destinationPort NOT IN (80, 443, 53)\n  AND startTime > NOW() - 86400000\nGROUP BY sourceIP, destinationIP\nHAVING SUM(sourceBytes) > 104857600\nORDER BY total_bytes_out DESC\n```\n\n### Step 4: Configure Reference Sets for Context Enrichment\n\nCreate reference sets for dynamic whitelists and watchlists:\n\n```bash\n# Create reference set via QRadar API\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Known_Pen_Test_IPs\",\n    \"element_type\": \"IP\",\n    \"timeout_type\": \"LAST_SEEN\",\n    \"time_to_live\": \"30 days\"\n  }'\n\n# Add entries\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\u002FKnown_Pen_Test_IPs\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -d \"value=10.0.5.100\"\n```\n\nUse reference sets in rule conditions to exclude known benign activity:\n\n```\nTest: AND when the Source IP is NOT contained in any of [Known_Pen_Test_IPs]\nTest: AND when the Destination IP is contained in any of [Critical_Asset_IPs]\n```\n\n### Step 5: Tune Offense Generation\n\nReduce false positives by adding building block filters:\n\n```sql\n-- Find top false positive generators\nSELECT QIDNAME(qid) AS event_name,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       COUNT(*) AS event_count,\n       COUNT(DISTINCT sourceIP) AS unique_sources\nFROM events\nWHERE INOFFENSE(\n    SELECT offenseId FROM offenses\n    WHERE status = 'CLOSED'\n      AND closeReason = 'False Positive'\n      AND startTime > NOW() - 30*24*60*60*1000\n  )\nGROUP BY qid, logSourceId\nORDER BY event_count DESC\nLIMIT 20\n```\n\nApply tuning:\n- Add high-frequency false positive sources to reference set exclusions\n- Increase event thresholds on noisy rules (e.g., 10 failed logins -> 25 for service accounts)\n- Set offense coalescing to group related events under a single offense\n\n### Step 6: Build Custom Dashboard for Correlation Monitoring\n\nCreate a QRadar Pulse dashboard with key correlation metrics:\n\n```sql\n-- Active offenses by category\nSELECT offenseType, status, COUNT(*) AS offense_count,\n       AVG(magnitude) AS avg_magnitude\nFROM offenses\nWHERE status = 'OPEN'\nGROUP BY offenseType, status\nORDER BY offense_count DESC\n\n-- Mean time to close offenses\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd') AS day,\n       AVG(closeTime - startTime) \u002F 60000 AS avg_close_minutes,\n       COUNT(*) AS closed_count\nFROM offenses\nWHERE status = 'CLOSED'\n  AND startTime > NOW() - 30*24*60*60*1000\nGROUP BY DATEFORMAT(startTime, 'yyyy-MM-dd')\nORDER BY day\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **AQL** | Ariel Query Language — QRadar's SQL-like query language for searching events, flows, and offenses |\n| **Offense** | QRadar's correlated incident grouping multiple events\u002Fflows under a single investigation unit |\n| **Building Block** | Reusable rule component that categorizes events without generating offenses, used as input to correlation rules |\n| **Magnitude** | QRadar's calculated offense severity combining relevance, severity, and credibility scores (1-10) |\n| **Reference Set** | Dynamic lookup table in QRadar for whitelists, watchlists, and enrichment data used in rules |\n| **QID** | QRadar Identifier — unique numeric ID mapping vendor-specific events to normalized categories |\n| **Coalescing** | QRadar's mechanism for grouping related events into a single offense to reduce analyst workload |\n\n## Tools & Systems\n\n- **IBM QRadar SIEM**: Enterprise SIEM platform with event correlation, offense management, and AQL query engine\n- **QRadar Pulse**: Dashboard framework for building custom visualizations of offense and event metrics\n- **QRadar API**: RESTful API for automating reference set management, offense operations, and rule deployment\n- **QRadar Use Case Manager**: App for mapping detection rules to MITRE ATT&CK framework coverage\n- **QRadar Assistant**: AI-powered analysis tool helping analysts investigate offenses with natural language\n\n## Common Scenarios\n\n- **Brute Force to Compromise**: Correlate failed auth events with subsequent successful login from same source\n- **Lateral Movement Chain**: Track authentication events across multiple internal hosts from a single source\n- **C2 Beaconing**: Correlate periodic DNS queries with low-entropy payloads to unusual domains\n- **Privilege Escalation**: Correlate user account changes (group additions) with prior suspicious authentication\n- **Data Exfiltration**: Correlate large outbound flow volumes with prior internal reconnaissance activity\n\n## Output Format\n\n```\nQRADAR OFFENSE INVESTIGATION — Offense #12345\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nOffense Type:   Brute Force with Subsequent Access\nMagnitude:      8\u002F10 (Severity: 8, Relevance: 9, Credibility: 7)\nCreated:        2024-03-15 14:23:07 UTC\nContributing:   247 events from 3 log sources\n\nCorrelation Chain:\n  14:10-14:22  — 234 Authentication Failures (EventCode 4625) from 192.168.1.105 to DC-01\n  14:23:07     — Authentication Success (EventCode 4624) from 192.168.1.105 to DC-01 (user: admin)\n  14:25:33     — New Process: cmd.exe spawned by admin on DC-01\n  14:26:01     — Net.exe user \u002Fadd detected on DC-01\n\nSources Correlated:\n  Windows Security Logs (DC-01)\n  Sysmon (DC-01)\n  Firewall (Palo Alto PA-5260)\n\nDisposition:    TRUE POSITIVE — Escalated to Incident Response\nTicket:         IR-2024-0432\n```\n","# Correlating Security Events in QRadar\n\n## When to Use\n\nUse this skill when:\n- SOC analysts need to investigate QRadar offenses and correlate events across multiple log sources\n- Detection engineers build custom correlation rules to identify multi-stage attacks\n- Alert tuning is required to reduce false positive offenses and improve signal quality\n- The team migrates from basic event monitoring to behavior-based correlation\n\n**Do not use** for log source onboarding or parsing — that requires QRadar administrator access and DSM editor knowledge.\n\n## Prerequisites\n\n- IBM QRadar SIEM 7.5+ with offense management enabled\n- AQL knowledge for ad-hoc event and flow queries\n- Log sources normalized with proper QID mappings (Windows, firewall, proxy, endpoint)\n- User role with offense management, rule creation, and AQL search permissions\n- Reference sets\u002Fmaps configured for whitelist and watchlist management\n\n## Workflow\n\n### Step 1: Investigate an Offense with AQL\n\nOpen an offense in QRadar and query contributing events using AQL (Ariel Query Language):\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       sourceIP, destinationIP, username,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       QIDNAME(qid) AS event_name,\n       category, magnitude\nFROM events\nWHERE INOFFENSE(12345)\nORDER BY startTime ASC\nLIMIT 500\n```\n\nPivot on the source IP to find all activity:\n\n```sql\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd HH:mm:ss') AS event_time,\n       destinationIP, destinationPort, username,\n       QIDNAME(qid) AS event_name,\n       eventCount, category\nFROM events\nWHERE sourceIP = '192.168.1.105'\n  AND startTime > NOW() - 24*60*60*1000\nORDER BY startTime ASC\nLIMIT 1000\n```\n\n### Step 2: Build a Custom Correlation Rule\n\nCreate a multi-condition rule detecting brute force followed by successful login:\n\n**Rule 1 — Brute Force Detection (Building Block):**\n```\nRule Type: Event\nRule Name: BB: Multiple Failed Logins from Same Source\nTests:\n  - When the event(s) were detected by one or more of [Local]\n  - AND when the event QID is one of [Authentication Failure (5000001)]\n  - AND when at least 10 events are seen with the same Source IP\n    in 5 minutes\nRule Action: Dispatch new event (Category: Authentication, QID: Custom_BruteForce)\n```\n\n**Rule 2 — Brute Force Succeeded (Correlation Rule):**\n```\nRule Type: Offense\nRule Name: COR: Brute Force with Subsequent Successful Login\nTests:\n  - When an event matches the building block BB: Multiple Failed Logins from Same Source\n  - AND when an event with QID [Authentication Success (5000000)] is detected\n    from the same Source IP within 10 minutes\n  - AND the Destination IP is the same for both events\nRule Action: Create offense, set severity to High, set relevance to 8\n```\n\n### Step 3: Use AQL for Cross-Source Correlation\n\nCorrelate authentication failures with network flows to detect lateral movement:\n\n```sql\nSELECT e.sourceIP, e.destinationIP, e.username,\n       QIDNAME(e.qid) AS event_name,\n       e.eventCount,\n       f.sourceBytes, f.destinationBytes\nFROM events e\nLEFT JOIN flows f ON e.sourceIP = f.sourceIP\n  AND e.destinationIP = f.destinationIP\n  AND f.startTime BETWEEN e.startTime AND e.startTime + 300000\nWHERE e.category = 'Authentication'\n  AND e.sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) = 'Authentication Failure'\n      AND startTime > NOW() - 3600000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 20\n  )\n  AND e.startTime > NOW() - 3600000\nORDER BY e.startTime ASC\n```\n\nDetect data exfiltration by correlating DNS queries with large outbound flows:\n\n```sql\nSELECT sourceIP, destinationIP,\n       SUM(sourceBytes) AS total_bytes_out,\n       COUNT(*) AS flow_count\nFROM flows\nWHERE sourceIP IN (\n    SELECT sourceIP FROM events\n    WHERE QIDNAME(qid) ILIKE '%DNS%'\n      AND destinationIP NOT IN (\n        SELECT ip FROM reference_data.sets('Internal_DNS_Servers')\n      )\n      AND startTime > NOW() - 86400000\n    GROUP BY sourceIP\n    HAVING COUNT(*) > 500\n  )\n  AND destinationPort NOT IN (80, 443, 53)\n  AND startTime > NOW() - 86400000\nGROUP BY sourceIP, destinationIP\nHAVING SUM(sourceBytes) > 104857600\nORDER BY total_bytes_out DESC\n```\n\n### Step 4: Configure Reference Sets for Context Enrichment\n\nCreate reference sets for dynamic whitelists and watchlists:\n\n```bash\n# Create reference set via QRadar API\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -H \"Content-Type: application\u002Fjson\" \\\n  -d '{\n    \"name\": \"Known_Pen_Test_IPs\",\n    \"element_type\": \"IP\",\n    \"timeout_type\": \"LAST_SEEN\",\n    \"time_to_live\": \"30 days\"\n  }'\n\n# Add entries\ncurl -X POST \"https:\u002F\u002Fqradar.example.com\u002Fapi\u002Freference_data\u002Fsets\u002FKnown_Pen_Test_IPs\" \\\n  -H \"SEC: YOUR_API_TOKEN\" \\\n  -d \"value=10.0.5.100\"\n```\n\nUse reference sets in rule conditions to exclude known benign activity:\n\n```\nTest: AND when the Source IP is NOT contained in any of [Known_Pen_Test_IPs]\nTest: AND when the Destination IP is contained in any of [Critical_Asset_IPs]\n```\n\n### Step 5: Tune Offense Generation\n\nReduce false positives by adding building block filters:\n\n```sql\n-- Find top false positive generators\nSELECT QIDNAME(qid) AS event_name,\n       LOGSOURCENAME(logSourceId) AS log_source,\n       COUNT(*) AS event_count,\n       COUNT(DISTINCT sourceIP) AS unique_sources\nFROM events\nWHERE INOFFENSE(\n    SELECT offenseId FROM offenses\n    WHERE status = 'CLOSED'\n      AND closeReason = 'False Positive'\n      AND startTime > NOW() - 30*24*60*60*1000\n  )\nGROUP BY qid, logSourceId\nORDER BY event_count DESC\nLIMIT 20\n```\n\nApply tuning:\n- Add high-frequency false positive sources to reference set exclusions\n- Increase event thresholds on noisy rules (e.g., 10 failed logins -> 25 for service accounts)\n- Set offense coalescing to group related events under a single offense\n\n### Step 6: Build Custom Dashboard for Correlation Monitoring\n\nCreate a QRadar Pulse dashboard with key correlation metrics:\n\n```sql\n-- Active offenses by category\nSELECT offenseType, status, COUNT(*) AS offense_count,\n       AVG(magnitude) AS avg_magnitude\nFROM offenses\nWHERE status = 'OPEN'\nGROUP BY offenseType, status\nORDER BY offense_count DESC\n\n-- Mean time to close offenses\nSELECT DATEFORMAT(startTime, 'yyyy-MM-dd') AS day,\n       AVG(closeTime - startTime) \u002F 60000 AS avg_close_minutes,\n       COUNT(*) AS closed_count\nFROM offenses\nWHERE status = 'CLOSED'\n  AND startTime > NOW() - 30*24*60*60*1000\nGROUP BY DATEFORMAT(startTime, 'yyyy-MM-dd')\nORDER BY day\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|-----------|\n| **AQL** | Ariel Query Language — QRadar's SQL-like query language for searching events, flows, and offenses |\n| **Offense** | QRadar's correlated incident grouping multiple events\u002Fflows under a single investigation unit |\n| **Building Block** | Reusable rule component that categorizes events without generating offenses, used as input to correlation rules |\n| **Magnitude** | QRadar's calculated offense severity combining relevance, severity, and credibility scores (1-10) |\n| **Reference Set** | Dynamic lookup table in QRadar for whitelists, watchlists, and enrichment data used in rules |\n| **QID** | QRadar Identifier — unique numeric ID mapping vendor-specific events to normalized categories |\n| **Coalescing** | QRadar's mechanism for grouping related events into a single offense to reduce analyst workload |\n\n## Tools & Systems\n\n- **IBM QRadar SIEM**: Enterprise SIEM platform with event correlation, offense management, and AQL query engine\n- **QRadar Pulse**: Dashboard framework for building custom visualizations of offense and event metrics\n- **QRadar API**: RESTful API for automating reference set management, offense operations, and rule deployment\n- **QRadar Use Case Manager**: App for mapping detection rules to MITRE ATT&CK framework coverage\n- **QRadar Assistant**: AI-powered analysis tool helping analysts investigate offenses with natural language\n\n## Common Scenarios\n\n- **Brute Force to Compromise**: Correlate failed auth events with subsequent successful login from same source\n- **Lateral Movement Chain**: Track authentication events across multiple internal hosts from a single source\n- **C2 Beaconing**: Correlate periodic DNS queries with low-entropy payloads to unusual domains\n- **Privilege Escalation**: Correlate user account changes (group additions) with prior suspicious authentication\n- **Data Exfiltration**: Correlate large outbound flow volumes with prior internal reconnaissance activity\n\n## Output Format\n\n```\nQRADAR OFFENSE INVESTIGATION — Offense #12345\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\nOffense Type:   Brute Force with Subsequent Access\nMagnitude:      8\u002F10 (Severity: 8, Relevance: 9, Credibility: 7)\nCreated:        2024-03-15 14:23:07 UTC\nContributing:   247 events from 3 log sources\n\nCorrelation Chain:\n  14:10-14:22  — 234 Authentication Failures (EventCode 4625) from 192.168.1.105 to DC-01\n  14:23:07     — Authentication Success (EventCode 4624) from 192.168.1.105 to DC-01 (user: admin)\n  14:25:33     — New Process: cmd.exe spawned by admin on DC-01\n  14:26:01     — Net.exe user \u002Fadd detected on DC-01\n\nSources Correlated:\n  Windows Security Logs (DC-01)\n  Sysmon (DC-01)\n  Firewall (Palo Alto PA-5260)\n\nDisposition:    TRUE POSITIVE — Escalated to Incident Response\nTicket:         IR-2024-0432\n```\n",{"name":5,"tags":44,"author":46,"domain":38,"license":15,"version":47,"subdomain":48,"description":49},[36,21,37,33,45,32,31],"correlation","mahipal","1.0","soc-operations","Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.\n","main","4d2fb89cdfb75f3f6fd3c6c5ec9ad90ea129eb3c","ai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fcorrelating-security-events-in-qradar",1,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai","https:\u002F\u002Fgithub.com\u002Fluokai0","a solo builder.","2026-05-06 04:29:04",{"source":8,"skillName":5,"commands":59,"prompt":69,"zipAvailable":70},[60,63,66],{"tool":61,"command":62},"npx","npx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill correlating-security-events-in-qradar",{"tool":64,"command":65},"bunx","bunx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill correlating-security-events-in-qradar",{"tool":67,"command":68},"pnpm","pnpm dlx skills add luokai0\u002Fai-agent-skills-by-luo-kai --skill correlating-security-events-in-qradar","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fcorrelating-security-events-in-qradar\u002FSKILL.md",true,[72,77,83],{"path":73,"resourceType":73,"resourceTypeDesc":74,"sizeBytes":75,"sourceHtmlUrl":76},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fcorrelating-security-events-in-qradar\u002FLICENSE",{"path":78,"resourceType":79,"resourceTypeDesc":80,"sizeBytes":81,"sourceHtmlUrl":82},"references\u002Fapi-reference.md","REFERENCE","参考文档",2295,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fcorrelating-security-events-in-qradar\u002Freferences\u002Fapi-reference.md",{"path":84,"resourceType":85,"resourceTypeDesc":86,"sizeBytes":87,"sourceHtmlUrl":88},"scripts\u002Fagent.py","SCRIPT","脚本",6651,"https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F21-external-registries\u002F08-pinkpixel-collection\u002Fcorrelating-security-events-in-qradar\u002Fscripts\u002Fagent.py",[90,118,135,164,196,233],{"skillNo":91,"name":92,"nameZh":6,"description":93,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":39},"01M6F2SKTE208174C7S7JJCZC7","write-contracts","Generates secure Aptos Move V2 smart contracts with Object model, Digital Asset integration, security patterns, and storage type guidance. Includes comprehensive storage decision framework for optimal data structure selection. Triggers on: 'write contract', 'create NFT collection', 'build marketplace', 'implement minting', 'generate Move module', 'create token contract', 'build DAO', 'implement staking'. Ask storage questions when: 'store', 'track', 'registry', 'mapping', 'list', 'collection'.","MIT","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fwrite-contracts\u002FSKILL.md",[],[98,99,100,101,102,103,104,105,106,107,108,109,110,111,112,113,114,115,116,117],"write","contracts","write contracts","storage","secure","create","generate","collection","model","decision","ask","smart-contracts","selection","objects","structure","nft","token","aptos","critical","move",{"skillNo":119,"name":120,"nameZh":6,"description":121,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":122,"categories":123,"keywords":124,"publishedAt":39},"01M6F2RFXJ6T9MKW0A7N7GM45B","web-search","通用网络搜索技能，支持多引擎搜索（百度、必应、DuckDuckGo），无需API密钥即可获取实时信息","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fweb-search-ex-skill\u002FSKILL.md",[],[125,126,127,128,129,130,131,132,133,134],"web","search","web search","搜索","baidu","bing","duckduckgo","百度","多引擎","internet",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":146,"publishedAt":39},"01M6F2K968G1FZEZFPW2E6B222","solo-build","Execute implementation plan tasks with TDD workflow, auto-commit, and phase gates. Use when user says \"build it\", \"start building\", \"execute plan\", \"implement tasks\", \"ship it\", or references a track ID. Do NOT use for planning (use \u002Fplan) or scaffolding (use \u002Fscaffold).","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fsolo-build\u002FSKILL.md",[141],{"categoryNo":142,"categoryName":143,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[147,148,149,150,151,152,153,154,126,155,156,157,98,158,159,160,26,161,162,163],"build","solo","solo build","MCP","workflow","commit","tasks","code","Bash","plan","read","auto","references","context7","scaffolding","ship it","project",{"skillNo":165,"name":166,"nameZh":6,"description":167,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":168,"categories":169,"keywords":176,"publishedAt":39},"01M6F2GKN39SGHSPWYB3662YC8","react-email","Use when building HTML email templates with React components, adding a visual email editor to an application using the React Email visual editor, rendering emails to HTML, or sending emails with Resend. Covers welcome emails, password resets, notifications, order confirmations, newsletters, transactional emails, and the embeddable email editor component.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Freact-email-skills\u002FSKILL.md",[170,173],{"categoryNo":171,"categoryName":172,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":174,"categoryName":175,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000009","前端开发",[177,178,179,180,181,182,183,184,185,186,187,188,189,28,190,191,192,193,194,195],"react","email","react email","github","editor","components","react components","component","welcome","https","notifications","password","node","html","resend","visual","emails","rendering","with",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":200,"categories":201,"keywords":214,"publishedAt":39},"01M6F2FBVGVDFSG8SSFJGXA40C","APITester Agent-Driven API Testing","Test API endpoints and document responses. Define tests in plain English, run them, get formatted results. Agent-driven Postman alternative.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fopenclaw-api-tester\u002FSKILL.md",[202,205,208,209],{"categoryNo":203,"categoryName":204,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":206,"categoryName":207,"taxonomyType":144,"taxonomyTypeDesc":145},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":142,"categoryName":143,"taxonomyType":144,"taxonomyTypeDesc":145},{"categoryNo":210,"categoryName":211,"taxonomyType":212,"taxonomyTypeDesc":213},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[215,216,217,218,219,220,221,222,223,224,225,226,227,228,229,230,231,232],"testing","api","api testing","driven","APITester Agent Driven API Testing","test","run","postman","results","plain english","tester","endpoints","document","get","define","tests","english","api-tester",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":94,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":239,"publishedAt":39},"01M6F273Y3NGAPVJZ608BC0G9G","hubspot-implementation-plan","Generate a phased implementation plan from a HubSpot audit report. Creates prioritized, sequenced cleanup processes with effort estimates, dependencies, and automation feasibility. Use after running \u002Fhubspot-audit.","https:\u002F\u002Fgithub.com\u002Fluokai0\u002Fai-agent-skills-by-luo-kai\u002Fblob\u002Fmain\u002Fai-agent-skills\u002F22-clawhub-skills\u002Fhubspot-implementation-plan\u002FSKILL.md",[],[156,240,241,242,243,244,245,104,246,247,248,249,250,28,251,252,195,253],"implementation","hubspot","hubspot implementation plan","automation","feasibility","cleanup","planning","report","audit","audit report","phased implementation","dependencies","processes","hubspot audit"]