Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Microsoft Sentinel Migration: Export QRadar Data to Target Platform

4 September 2026Doc update+31 / −29 lines

In brief

Updated the page’s capitalization, metadata, step formatting, wording, and navigation heading from “Next steps” to “Related content.”

What Defender admins need to know

Administrators get clearer presentation and navigation when following QRadar data export guidance; no action is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: "Microsoft Sentinel migration:Migration: Export QRadar dataData to target platformTarget Platform" description: Export historical QRadar data for Microsoft Sentinel migration by using the QRadar REST API and AQL queries, with guidance on limiting query scope and preparing for ingestion. author: EdB-MSFT ms.author: edbaynash ms.topic: how-to ms.date: 06/15/07/01/2026 ai-usage: ai-assisted ms.custom: msecd-doc-authoring-10141016

#Customer intent: As a security engineer, I want to export historical data from QRadar using AQL queries and the QRadar REST API so that I can migrate it to a new platform for analysis and compliance purposes.

:::image type="content" source="media/migration-export-ingest/export-data.png" alt-text="Diagram illustrating steps involved in export and ingestion." lightbox="media/migration-export-ingest/export-data.png" border="false":::

To export your QRadar data, you use the QRadar REST API to run Ariel Query Language (AQL) queries on data stored in an Ariel database. Because the export process is resource intensive, we recommend that you use small time ranges in your queries, and only migrate the data you need.

Create AQL query

Perform the following steps toTo create or select an AQL query for export.export:

  1. In the QRadar Console, select the Log Activity tab.

  2. Create a new AQL search query or select a saved search query to export the data. Ensure that the query includes the START and STOP functions to set the date and time range.

    Learn how to use AQL and how to save search criteria in AQL.

  3. Copy the AQL query for later use.

  4. Encode the AQL query to the URL encoded format. Paste the query you copied in step 3 into the URL Encode/Decode tool. Copy the encoded format output.

Execute search query

You can execute the search query using one of these methods. methods:

  • QRadar Console user ID.: To use this method, ensure that the console user ID being used for data migration is assigned to a security profile that can access the data you need for the export.
  • API token.: To use this method, generate an API token in QRadar.

To execute the search query:

  1. Log in to the system from which you'll download the historical data. Ensure that this system has access to the QRadar Console and QRadar API on TCP/443 via HTTPS.

  2. To execute the search query that retrieves the historical data, open a command prompt and run one of these commands:

    • For the QRadar Console user ID method, run: 

      curl -s -X POST -u <enter_qradar_console_user_id> -H 'Version: 12.0' -H 'Accept: application/json' 'https://<enter_qradar_console_ip_or_hostname>/api/ariel/searches?query_expression=<enter_encoded_AQL_from_previous_step>'

    • For the API token method, run: 

      curl -s -X POST -H 'SEC: <enter_api_token>' -H 'Version: 12.0' -H 'Accept: application/json' 'https://<enter_qradar_console_ip_or_hostname>/api/ariel/searches?query_expression=<enter_encoded_AQL_from_previous_step>

      The search job execution time may vary, depending on the AQL time range and amount of queried data. We recommended that you run the query in small time ranges, and to query only the data you need for the export.

      The output should return a status, such as COMPLETED, EXECUTE, WAIT, a progress value, and a search_id value. For example:

  3. Copy the value in the search_id field. You'll use this ID to check the progress and status of the search query execution, and to download the results after the search execution is complete.

  4. To check the status and the progress of the search, run one of these commands:

    • For the QRadar Console user ID method, run: 

      curl -s -X POST -u <enter_qradar_console_user_id> -H 'Version: 12.0' -H 'Accept: application/json' 'https:// <enter_qradar_console_ip_or_hostname>/api/ariel/searches/<enter_search_id_from_previous_step>'

    • For the API token method, run: 

      curl -s -X POST -H 'SEC: <enter_api_token>' -H 'Version: 12.0' -H 'Accept: application/json' 'https:// <enter_qradar_console_ip_or_hostname>/api/ariel/searches/<enter_search_id_from_previous_step>'

  5. Review the output. If the value in the status field is COMPLETED, continue to the next step. If the status isn't COMPLETED, check the value in the progress field, and after 5-10 minutes, run the command you ran in step 4.

  6. Review the output and ensure that the status is COMPLETED.

  7. Run one of these commands to download the results or returned data from the JSON file to a folder on the current system:

    • For the QRadar Console user ID method, run: 

      curl -s -X GET -u <enter_qradar_console_user_id> -H 'Version: 12.0' -H 'Accept: application/json' 'https:// <enter_qradar_console_ip_or_hostname>/api/ariel/searches/<enter_search_id_from_previous_step>/results' > <enter_path_to_file>.json

    • For the API token method, run: 

      curl -s -X GET -H 'SEC: <enter_api_token>' -H 'Version: 12.0' -H 'Accept: application/json' 'https:// <enter_qradar_console_ip_or_hostname>/api/ariel/searches/<enter_search_id_from_previous_step>/results' > <enter_path_to_file>.json

  8. To retrieve the data that you need to export, create the AQL query (steps 1-4) and execute the query (steps 1-7) again. Adjust the time range and search queries to get the data you need.

Next stepsRelated content