What can you do with the IBM QRadar integration?

LiveContext exposes 20 operations on IBM QRadar, covering reference set, ariel search, offense and offense note. Common uses include pulling the events behind an offense for enrichment, identifying which internal hosts an offense targeted and removing a temporary watchlist created for an incident.

LiveContext

All integrations

IBM QRadar integration

IBM QRadar SIEM REST API for security operations: read and triage offenses, assign them, flag them for follow up, close them with a documented reason and keep an audit trail of notes, run AQL searches over the events and flows in the Ariel data store, resolve the source and destination addresses an offense is built from, browse the asset model, and maintain the reference sets that rules and searches match against. QRadar is deployed on premise, so the console host is part of the credential alongside the authorized service token.

20 toolsAPI keyAPI docs

Connect IBM QRadar How integrations work

Common IBM QRadar use cases

pulling the events behind an offense for enrichment
identifying which internal hosts an offense targeted
removing a temporary watchlist created for an incident
checking whether an analyst is already handling an offense
waiting for an AQL search to finish before reading its rows
cleaning up a large search after its rows have been collected
pulling the full context of an offense that triggered an alert
reading the events behind an offense once the search has completed
building a triage queue of open offenses above a magnitude threshold
removing an address from a blocklist after it was found to be benign

What you can do with IBM QRadar

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Reference set, 4 operations

POSTcreate_reference_set
Creates a QRadar reference set that rules and searches can match against.
DELETEdelete_reference_set
Deletes a QRadar reference set with all of its values.
GETget_reference_set
Reads a QRadar reference set and the values stored in it.
GETlist_reference_sets
Lists QRadar reference sets with their element type and size.

Ariel search, 3 operations

POSTcreate_search
Starts a QRadar AQL search and returns the search identifier to poll.
DELETEdelete_search
Deletes a QRadar AQL search and releases the disk its results occupy.
GETget_search_status
Polls a QRadar AQL search and reports whether it has finished.

Offense, 3 operations

GETget_offense
Returns one QRadar offense with its magnitude, status, rules and address identifiers.
GETlist_offenses
Lists QRadar offenses with their magnitude, status and contributing rules.
POSTupdate_offense
Assigns, protects, flags or closes a QRadar offense.

Offense note, 2 operations

POSTadd_offense_note
Records an investigation note against a QRadar offense.
GETlist_offense_notes
Reads the investigation notes recorded against a QRadar offense.

Reference set value, 2 operations

POSTadd_reference_set_value
Adds an indicator to a QRadar reference set so rules start matching it.
DELETEdelete_reference_set_value
Removes a single indicator from a QRadar reference set.

Ariel search result, 1 operation

GETget_search_results
Returns the rows of a finished QRadar AQL search.

Asset, 1 operation

GETlist_assets
Lists the assets QRadar knows about with their interfaces and properties.

Closing reason, 1 operation

GETlist_closing_reasons
Lists the QRadar closing reasons and their identifiers.

Destination address, 1 operation

GETlist_local_destination_addresses
Resolves QRadar local destination address identifiers into the targeted addresses.

Offense type, 1 operation

GETlist_offense_types
Lists the QRadar offense types so an offense_type number can be resolved to a name.

Source address, 1 operation

GETlist_source_addresses
Resolves QRadar source address identifiers into the actual addresses of an offense.

Use IBM QRadar from Claude Code, Cursor or Codex

Connect IBM QRadar in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its IBM QRadar operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect IBM QRadar

Create your workspace
Sign up free. Nothing to install.
Connect IBM QRadar once
Add your IBM QRadar connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.

IBM QRadar integration FAQ

What can you do with the IBM QRadar integration?: LiveContext exposes 20 operations on IBM QRadar, covering reference set, ariel search, offense and offense note. Common uses include pulling the events behind an offense for enrichment, identifying which internal hosts an offense targeted and removing a temporary watchlist created for an incident.