Connect your own self-hosted IBM QRadar SIEM console to run Ariel (AQL) searches, triage and update Offenses, manage Reference Data sets, and inspect Rules and Log Sources -- from Imperal. Uses you...
What this app can do
21 tools registered
Connect QradarFree
Connect your own self-hosted IBM QRadar console by saving its base URL plus a SEC token, after checking it actually works. Get a token from QRadar: Admin > Authorized Services > Add Authorized Service.
List ConnectionsFree
List the connected IBM QRadar instances.
Disconnect QradarFree
Disconnect a QRadar instance: deletes the saved SEC token. Nothing in QRadar itself is changed.
Search Ariel12 tok
Start a new Ariel Query Language (AQL) search against QRadar's events/flows data. Returns a search id -- poll get_search_status, then get_search_results once done.
Get Search Status4 tok
Read an Ariel search's current status -- whether it's done, and its progress percentage.
Get Search Results8 tok
Read a page of results from a completed (or still-running) Ariel search.
Cancel Search4 tok
Cancel a running Ariel search.
List Offenses8 tok
List QRadar Offenses (correlated security incidents), optionally filtered by status (OPEN/HIDDEN/CLOSED).
Get Offense4 tok
Read one QRadar Offense in full by its id.
Update Offense16 tok
Update a QRadar Offense: close it, assign it to a user, or change its protected/follow-up flags. Only given fields change.
List Closing Reasons4 tok
List the closing reasons configured on the connected QRadar instance -- needed before closing an Offense.
Add Offense Note8 tok
Add an internal investigation note to a QRadar Offense.
List Reference Sets8 tok
List Reference Sets (named lists of indicators, e.g. IPs/domains/hashes) configured on the connected QRadar instance.
List Reference Set Data8 tok
List the elements (values) stored inside one Reference Set.
Create Reference Set16 tok
Create a new Reference Set (a named list of indicators) on the connected QRadar instance.
Add Reference Set Element12 tok
Add one value (e.g. a malicious IP or domain) to an existing Reference Set.
Delete Reference Set Element12 tok
Remove one value from a Reference Set.
Delete Reference Set16 tok
Permanently delete a Reference Set and all of its elements. Cannot be undone.
List Rules8 tok
List correlation Rules configured on the connected QRadar instance (read-only -- editing rules is out of scope).
List Log Sources8 tok
List Log Sources (event ingestion feeds) configured on the connected QRadar instance, with their status.
Audit Deployment Health40 tok
Build one aggregated health report across every open Offense on the connected QRadar instance: counts by severity, unassigned Offenses, and Log Sources reporting an error state.