How to Export Events from IBM QRadar

The cleanest way to get raw events out of QRadar is the Ariel REST API. Run an AQL query that selects UTF8(payload), wait for the search to finish, and pull the results as JSON. You end up with the original log lines exactly as your log sources sent them. The Log Activity tab can export search results too, but not in a format LogTotal reads today. 

QRadar sits at the center of a lot of SOCs, and sooner or later someone needs a slice of its data outside the console: an IR partner, a second opinion, a quick check without building a new rule. Prime Core has 23,656 detection rules for QRadar, mapped to 674 MITRE ATT&CK techniques. Below is how to pull a clean slice of raw events, sanitize it, and investigate it for free in LogTotal.

This guide covers QRadar SIEM, on-premises and software. If your company was on QRadar SaaS, which IBM sold to Palo Alto Networks in 2024, you may have moved to Cortex XSIAM since.

Get Started For Free

Before you start

An authorized service token. Create one under Admin → Authorized Services and give it an expiry date. The token carries a user role and a security profile. The security profile decides which log sources and networks it can see. If it’s narrower than your own, the API quietly returns fewer events than Log Activity shows you. That’s the most common “where did my events go?” moment with QRadar exports.

Retention. Events live as long as your retention buckets allow (Admin → Event Retention). If the window you need is older than that, there’s nothing left to export.

Network access. The API runs on the console’s HTTPS port. Consoles often use self-signed certificates; point curl at the right CA with –cacert rather than switching verification off.

Step 1: Write the AQL query

Select the payload plus a few fields for context:

SELECT DATEFORMAT(starttime, 'yyyy-MM-dd HH:mm:ss') AS event_time,
       LOGSOURCENAME(logsourceid) AS log_source,
       QIDNAME(qid) AS event_name,
       UTF8(payload) AS payload
FROM events
WHERE LOGSOURCENAME(logsourceid) = 'web-03'
START '2026-10-19 00:00' STOP '2026-10-20 00:00'

A few notes from experience:

• UTF8(payload) is the important part. Without it, the payload comes back as encoded bytes, not readable log text.
• Narrow it. Filter by log source name, or by type with LOGSOURCETYPENAME(devicetype) ILIKE ‘%Linux%’, and keep the window tight.
• START / STOP for exact windows, LAST 24 HOURS for relative ones.
• Test it first in Log Activity → Advanced Search. It’s the same AQL, and you’ll see the event count before you export.

Windows events collected through WinCollect arrive as text payloads, not as EVTX. What you export is that text.

Step 2: Run it through the Ariel API

Save this as qradar_export.sh. It starts the search, waits for it, and writes one raw payload per line:

#!/usr/bin/env bash
set -euo pipefail

QRADAR="https://qradar.example.com"
TOKEN="${QRADAR_TOKEN:?set QRADAR_TOKEN first}"
AQL="SELECT UTF8(payload) AS payload FROM events WHERE LOGSOURCENAME(logsourceid) = 'web-03' START '2026-10-19 00:00' STOP '2026-10-20 00:00'"

# 1. start the search (-G puts the query in the URL, -X POST keeps the method)
SID=$(curl -sS -G -X POST -H "SEC: $TOKEN" -H "Accept: application/json" \
  --data-urlencode "query_expression=$AQL" \
  "$QRADAR/api/ariel/searches" | jq -r '.search_id')

# 2. wait for it to finish
while :; do
  STATUS=$(curl -sS -H "SEC: $TOKEN" "$QRADAR/api/ariel/searches/$SID" | jq -r '.status')
  [ "$STATUS" = "COMPLETED" ] && break
  if [ "$STATUS" = "ERROR" ] || [ "$STATUS" = "CANCELED" ]; then echo "Search $STATUS"; exit 1; fi
  sleep 5
done

# 3. fetch results: raw payloads, one per line
curl -sS -H "SEC: $TOKEN" -H "Accept: application/json" \
  "$QRADAR/api/ariel/searches/$SID/results" | jq -r '.events[].payload' > web-03_qradar_1019.log

Want structured events instead, with time and log source as fields? Select those columns in the AQL and use jq -c ‘.events[]’ in the last step. You get one JSON object per line.

For very large result sets, fetch the results in pages with a Range header, for example -H “Range: items=0-49999”, then the next 50,000.

Step 3: Upload, sanitize and review in LogTotal

1. Upload. Open logtotal.com and drop in the file. 
2. Sanitize. Look it over before you continue.
3. Review. 

When it goes wrong