IBM QRadar
  • 19 Oct 2023
  • 2 Minutes to read
  • Dark
    Light
  • PDF

IBM QRadar

  • Dark
    Light
  • PDF

Article Summary

IBM QRadar is a Security Information and Event Management (SIEM) solution that enables security teams to detect, prioritize and response to threats across the enterprise.

Types of Assets Fetched

This adapter fetches the following types of assets:

  • Devices
  • Users

Parameters

  1. Host Name or IP Address (required) - The hostname or IP address of the IBM QRadar server.
  2. User Name and Password (optional, default: empty) - The credentials for a user account that has the permissions to fetch assets.
NOTE

If API Token is not supplied, these fields are required.

  1. API Token (optional, default: empty) - An API Key associated with a user account that has the Required Permissions to fetch assets.
NOTE

If User Name and Password are not supplied, this field is required.

  1. Verify SSL - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

  2. HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.

  3. HTTPS Proxy User Name (optional) - The user name to use when connecting to the value supplied in Host Name or IP Address via the value supplied in HTTPS Proxy.

  4. HTTPS Proxy Password (optional) - The password to use when connecting to the server using the HTTPS Proxy.

To learn more about common adapter connection parameters and buttons, see Adding a New Adapter Connection.

image.png

APIs

Axonius uses IBM QRadar REST API V11.0.

Required Permissions

The value supplied in API Token must have read access to devices.

Both of these methods produce a token that is only displayed once. Please be sure to copy down the token at the end of the creation process as it can't be viewed again.

IBM QRadar On Cloud users may need to also whitelist the IP address of the Axonius instance. Instructions on doing so can be found here: Editing or deleting an allowlisted IP address

Version Matrix

This adapter has only been tested with the versions marked as supported, but may work with other versions. Please contact Axonius Support if you have a version that is not listed and it is not functioning as expected.

VersionSupportedNotes
IBM QRadar V7.3.0 and higher

Was this article helpful?

Changing your password will log you out immediately. Use the new password to log back in.
First name must have atleast 2 characters. Numbers and special characters are not allowed.
Last name must have atleast 1 characters. Numbers and special characters are not allowed.
Enter a valid email
Enter a valid password
Your profile has been successfully updated.