Integration

IBM QRadar integration

IBM QRadar SIEM REST API for security operations: read and triage offenses, assign them, flag them for follow up, close them with a documented reason and keep an audit trail of notes, run AQL searches over the events and flows in the Ariel data store, resolve the source and destination addresses an offense is built from, browse the asset model, and maintain the reference sets that rules and searches match against. QRadar is deployed on premise, so the console host is part of the credential alongside the authorized service token.

Connect IBM QRadar How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in IBM QRadar.Built from the 20 IBM QRadar tools below, on the connection you add once.

Common IBM QRadar use cases

pulling the events behind an offense for enrichment
identifying which internal hosts an offense targeted
removing a temporary watchlist created for an incident
checking whether an analyst is already handling an offense
waiting for an AQL search to finish before reading its rows
cleaning up a large search after its rows have been collected
pulling the full context of an offense that triggered an alert
reading the events behind an offense once the search has completed
building a triage queue of open offenses above a magnitude threshold
removing an address from a blocklist after it was found to be benign

What you can do with IBM QRadar

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Reference set, 4 operations

create_reference_setCreate reference setPOSTCreates a QRadar reference set that rules and searches can match against.
delete_reference_setDelete reference setDELETEDeletes a QRadar reference set with all of its values.
get_reference_setGet reference setGETReads a QRadar reference set and the values stored in it.
list_reference_setsList reference setsGETLists QRadar reference sets with their element type and size.

Ariel search, 3 operations

create_searchCreate searchPOSTStarts a QRadar AQL search and returns the search identifier to poll.
delete_searchDelete searchDELETEDeletes a QRadar AQL search and releases the disk its results occupy.
get_search_statusGet search statusGETPolls a QRadar AQL search and reports whether it has finished.

Offense, 3 operations

get_offenseGet offenseGETReturns one QRadar offense with its magnitude, status, rules and address identifiers.
list_offensesList offensesGETLists QRadar offenses with their magnitude, status and contributing rules.
update_offenseUpdate offensePOSTAssigns, protects, flags or closes a QRadar offense.

Offense note, 2 operations

add_offense_noteAdd offense notePOSTRecords an investigation note against a QRadar offense.
list_offense_notesList offense notesGETReads the investigation notes recorded against a QRadar offense.

Reference set value, 2 operations

add_reference_set_valueAdd reference set valuePOSTAdds an indicator to a QRadar reference set so rules start matching it.
delete_reference_set_valueDelete reference set valueDELETERemoves a single indicator from a QRadar reference set.

Ariel search result, 1 operation

get_search_resultsGet search resultsGETReturns the rows of a finished QRadar AQL search.

Asset, 1 operation

list_assetsList assetsGETLists the assets QRadar knows about with their interfaces and properties.

Closing reason, 1 operation

list_closing_reasonsList closing reasonsGETLists the QRadar closing reasons and their identifiers.

Destination address, 1 operation

list_local_destination_addressesList local destination addressesGETResolves QRadar local destination address identifiers into the targeted addresses.

Offense type, 1 operation

list_offense_typesList offense typesGETLists the QRadar offense types so an offense_type number can be resolved to a name.

Source address, 1 operation

list_source_addressesList source addressesGETResolves QRadar source address identifiers into the actual addresses of an offense.

Use IBM QRadar from Claude Code, Cursor or Codex

Connect IBM QRadar in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its IBM QRadar operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect IBM QRadar

Create your workspace
Sign up free. Nothing to install.
Connect IBM QRadar once
Add your IBM QRadar connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

IBM QRadar integration FAQ

What can you do with the IBM QRadar integration?

LiveContext exposes 20 operations on IBM QRadar, covering reference set, ariel search, offense and offense note. Common uses include pulling the events behind an offense for enrichment, identifying which internal hosts an offense targeted and removing a temporary watchlist created for an incident.