Special Thanks to Mutaz Alsallal (IBM Poland) for the material shown here.
Here are some of the AQL commands so you can copy/paste:
select * from events START '2016-06-07 10:29:00' STOP '2016-06-07 13:53:00'
SELECT * FROM events WHERE magnitude BETWEEN 1 AND 5
SELECT * FROM events WHERE sourceip = '192.168.60.56' and destinationip != '64.4.44.76' START '2016-06-07 10:29:00' STOP '2016-06-07 13:53:00'
select * from events where not INCIDR('9.128.28.0/24',sourceip)
SELECT qidname(qid), * FROM events WHERE qidname(qid) ILIKE '%logon%' START '2016-06-07 10:29:00' STOP '2016-06-07 13:53:00'
