IBM QRadar
The IBM QRadar connector (qradar, category siem) pulls offenses (magnitude→severity) and normalizes each into the AiSOC alert shape, mapping the source severity onto the five-tier ladder (info | low | medium | high | critical).
Setup
- In Connectors -> Add connector, choose IBM QRadar.
- Fill in the connection fields shown in the wizard (endpoint URL + API token; secrets are stored in the credential vault, never in plaintext).
- Click Test connection to verify credentials, then Save. The in-process scheduler begins polling on the default cadence.
Events flow through ingest (OCSF normalize) -> Kafka -> fusion, where detections fire and alerts are auto-triaged (copilot).
Configuration reference
| Field | Label | Type | Required | Default | Notes |
|---|---|---|---|---|---|
console_url | Console URL | string | yes | — | — |
sec_token | SEC Token | secret | yes | — | encrypted at rest · QRadar authorized-service SEC token. |
verify_tls | Verify TLS certificate | boolean | no | True | Disable only for consoles using an internal/self-signed CA. |
Credential handling
sec_token is encrypted at rest by the credential vault before the row is written, and decrypted only at poll time. The value is never logged and never returned by the API. See credential vault.