Skip to main content

IBM QRadar EDR

IBM QRadar EDR (Endpoint Detection and Response) is an advanced cybersecurity platform designed for threat detection, investigation, and response across enterprise endpoints. This solution provides comprehensive visibility into endpoint activities, enabling security teams to identify, analyze, and remediate security incidents, malware infections, ransomware attacks, and advanced persistent threats (APTs) targeting workstations, servers, laptops, and other computing devices.

CategoryEDR
DirectionQuery source
Sign-inNone
Query languagesSTIX

Before you start​

warning

The setup page can't take credentials for IBM QRadar EDR yet. Create the connection, then contact Huntbase support to finish signing it in.

For the vendor's own instructions, see QRadar EDR API application documentation.

Connect IBM QRadar EDR​

  1. Go to Connections and click New connection, or click New connection on the IBM QRadar EDR product page.
  2. On Product, pick IBM QRadar EDR and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your IBM QRadar EDR lives:

FieldRequiredNotes
Server AddressYesThe hostname of your QRadar EDR Hive server.
PortYesSet the port number that is associated with the hostname or IP address. Defaults to 443.
Self-Signed Cert (PEM)NoProvide a self-signed or CA-signed certificate to securely communicate with the data source.

Query it​

Once connected, IBM QRadar EDR can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.

Next steps​