IBM QRadar

Connect your own self-hosted IBM QRadar console by saving its base URL plus a SEC token, after checking it actually works. Get a token from QRadar: Admin > Authorized Services > Add Authorized Service.

List the connected IBM QRadar instances.

Disconnect a QRadar instance: deletes the saved SEC token. Nothing in QRadar itself is changed.

Start a new Ariel Query Language (AQL) search against QRadar's events/flows data. Returns a search id -- poll get_search_status, then get_search_results once done.

Read an Ariel search's current status -- whether it's done, and its progress percentage.

Read a page of results from a completed (or still-running) Ariel search.

Cancel a running Ariel search.

List QRadar Offenses (correlated security incidents), optionally filtered by status (OPEN/HIDDEN/CLOSED).

Read one QRadar Offense in full by its id.

Update a QRadar Offense: close it, assign it to a user, or change its protected/follow-up flags. Only given fields change.

List the closing reasons configured on the connected QRadar instance -- needed before closing an Offense.

Add an internal investigation note to a QRadar Offense.

List Reference Sets (named lists of indicators, e.g. IPs/domains/hashes) configured on the connected QRadar instance.

List the elements (values) stored inside one Reference Set.

Create a new Reference Set (a named list of indicators) on the connected QRadar instance.

Add one value (e.g. a malicious IP or domain) to an existing Reference Set.

Remove one value from a Reference Set.

Permanently delete a Reference Set and all of its elements. Cannot be undone.

List correlation Rules configured on the connected QRadar instance (read-only -- editing rules is out of scope).

List Log Sources (event ingestion feeds) configured on the connected QRadar instance, with their status.

Build one aggregated health report across every open Offense on the connected QRadar instance: counts by severity, unassigned Offenses, and Log Sources reporting an error state.