{"slug":"correlating-security-events-in-qradar","source_name":"correlating-security-events-in-qradar","name":"Correlating Security Events In Qradar","description":"Correlates security events in IBM QRadar SIEM using AQL (Ariel Query Language), custom rules, building blocks, and offense management to detect multi-stage attacks across network, endpoint, and application log sources. Use when SOC analysts need to investigate QRadar offenses, build correlation rules, or tune detection logic for reducing false positives.","version":1,"lift":{"pass_rate_delta_pts":22.73,"pass_rate_pct":36.4,"total_cases":22,"passed_cases":8,"tokens_delta_pct":80.8,"turns_delta_pct":0,"verdict":"mixed","benchmark_model":"gemini-3.6-flash","grading_method":"judged","completed_at":"2026-07-28T01:18:39.782049+00:00"},"skill_score":0.3636,"benchmark_models":[{"model":"gemini-3.6-flash","headline":true,"delta_pts":22.73,"with_pass_pct":36.4,"without_pass_pct":13.6,"tokens_delta_pct":80.8,"turns_delta_pct":0,"total_cases":22,"cases_aggregated":22,"verdict":"mixed","never_hurt":true,"completed_at":"2026-07-28T01:18:39.782049+00:00","run_id":"b11a31b9-0b45-4466-b373-e081d3ef9e75","version_number":1,"is_latest_version":true,"gate":null}],"trust":{"skill_safety":"passed","safety_status":"clean","intent_verdict":null,"content_status":"clean","indexable":true},"license":"Apache-2.0","install_count":0,"manifest_hash":"1b70a23833ff1b1a8ca6178037d40021d859e8b89a600a32137e8368a01a09fb","raw_url":"https://app.decimal.ai/s/correlating-security-events-in-qradar/SKILL.md","scorecard_url":"https://app.decimal.ai/skills/correlating-security-events-in-qradar"}