Skip to main content

IBM QRadar

IBM QRadar is a comprehensive Security Information and Event Management (SIEM) platform that provides real-time security intelligence, threat detection, and incident response capabilities for enterprise environments. As a leading security analytics and log management solution, QRadar collects, normalizes, correlates, and analyzes security events and network flows from across an organization's IT infrastructure to identify potential security threats, compliance violations, and anomalous behavior.

CategorySIEM
DirectionQuery source
Sign-inNone
Query languagesSTIX, AQL
Query templates1
Websiteibm.com

Before you start​

warning

The setup page can't take credentials for IBM QRadar yet. Create the connection, then contact Huntbase support to finish signing it in.

Watch out for
  • Requires QRadar 7.3.3 or later, with the IBM QRadar Content Extension for Sysmon, Custom Properties for Microsoft Windows, and Custom Properties Dictionary content extensions installed.

For the vendor's own instructions, see IBM QRadar authorized service token documentation.

Connect IBM QRadar​

  1. Go to Connections and click New connection, or click New connection on the IBM QRadar product page.
  2. On Product, pick IBM QRadar and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your IBM QRadar lives:

FieldRequiredNotes
Server AddressYesThe hostname or IP address of the QRadar Console.
PortYes443. Defaults to 443.
Self-Signed Cert (PEM)NoProvide a self-signed or CA-signed certificate to securely communicate with the data source.

Query it​

Once connected, IBM QRadar can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.
AQLNative QRadar Ariel queries, sent as written.

Example: AQL​

Recent events for a user — Raw AQL passthrough to retrieve recent events for a username.

SELECT * FROM events WHERE username = '{{username}}' LAST 1 HOURS

IBM QRadar ships with 1 query template. Find them in Library › Queries — see Query templates.

Next steps​