A QRadar analyst develops an advanced search on the Log Activity tab and presses the shortcut "Ctrl + Space" in the search field. What information is displayed?

In the QRadar Log Activity or Network Activity tabs, when using the advanced search field which supports Ariel Query Language (AQL), pressing "Ctrl + Space" invokes the content-assist or auto-complete feature. This feature is designed to help analysts build queries more quickly and accurately by displaying a contextual list of available AQL elements. The list includes AQL functions (e.g., DATEFORMAT), fields/properties (e.g., sourceip, username), and keywords (e.g., SELECT, FROM, WHERE).

A. This option is incorrect because it omits AQL keywords (like SELECT, GROUP BY), which are a critical part of the syntax and are included in the content-assist list.
B. AQL does not expose database tables and relationships in this manner; it provides a structured query language for the events and flows databases.
D. This option incorrectly includes "tables" and "views," which are not the terms used for the primary AQL data sources (events, flows) shown in content-assist.

- IBM QRadar Ariel Query Language (AQL) Guide, Version 7.5.0. "Building AQL queries in the user interface." This section describes the use of the advanced search field and mentions that the content assistance feature (activated by Ctrl+Space) provides a list of functions, saved searches, keywords, and fields.