> ## Documentation Index
> Fetch the complete documentation index at: https://docs.myrmex.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# IBM QRadar

> Connect IBM QRadar to Myrmex over its REST API — create an authorized service token and add the integration.

import { Note, Steps, Step, CardGroup, Card, Tip } from '@mintlify/components';

Connect your **IBM QRadar** SIEM so Myrmex can query events and flows, review offenses, and enrich investigations. Myrmex reaches QRadar over its **REST API** (HTTPS) through a [Collector](/documentation/agent-endpoint-security/collector-mode) on your network. Every search runs **live, on demand** — Myrmex returns only what you ask for at that moment and copies or stores nothing from QRadar on its side. Credentials are resolved on your side and never pass through the model.

## What Myrmex Can Do

<CardGroup cols={2}>
  <Card title="Query events & flows" icon="magnifying-glass">
    Run searches against QRadar events and flows to answer investigation questions — read-only.
  </Card>

  <Card title="Review offenses" icon="triangle-exclamation">
    List and inspect offenses to understand what QRadar has already correlated.
  </Card>

  <Card title="Enrich investigations" icon="sitemap">
    Pull live context on hosts, users, and indicators to support [alert](/documentation/detection-response/alerts) triage.
  </Card>

  <Card title="Live, nothing stored" icon="bolt">
    Myrmex queries QRadar in real time and returns only the result you asked for — no copy is kept on the Myrmex side.
  </Card>
</CardGroup>

## Before You Start

* A **Collector** that can reach the QRadar console over HTTPS (default port `443`). See [Collector mode](/documentation/agent-endpoint-security/collector-mode).
* A QRadar **user role** and **security profile** that can read events, flows, and offenses (read-only is enough for analysis).
* An **authorized service token** — you create this in Step 1.

## Step 1 — Create the Credential in QRadar

<Steps>
  <Step title="Open Authorized Services">
    In the QRadar console, go to **Admin → User Management → Authorized Services**.
  </Step>

  <Step title="Add an authorized service">
    Click **Add Authorized Service**, give it a name, and assign a **User Role** and **Security Profile** that scope what the token can read.
  </Step>

  <Step title="Generate and copy the token">
    Set an expiry (or no expiry), create the service, and copy the generated **token**. QRadar expects this token in the `SEC` HTTP header, which Myrmex sends for you.
  </Step>
</Steps>

<Tip>
  Start with a read-only role and security profile. Grant broader access only if you later want the agents to act, not just analyze.
</Tip>

## Step 2 — Add the Integration in Myrmex

From the **Directory**, choose **Add Integration → IBM QRadar**, then fill in:

| Field                     | Description                                                                                 |
| ------------------------- | ------------------------------------------------------------------------------------------- |
| **Name**                  | A unique name for this QRadar instance.                                                     |
| **Description**           | Optional note to identify the deployment.                                                   |
| **Protocol**              | `http` or `https` (use `https`).                                                            |
| **URL**                   | QRadar API management interface IP or hostname with port (e.g. `127.0.0.1`).                |
| **Port**                  | The API port.                                                                               |
| **Authentication Method** | `api-key`.                                                                                  |
| **API Token**             | The authorized service token created in Step 1.                                             |
| **API Key Name**          | HTTP header used to send the token. QRadar uses `SEC` (the default).                        |
| **Collector**             | The [Collector](/documentation/agent-endpoint-security/collector-mode) that reaches QRadar. |

## Connect

Click **Connect** to validate the REST connection and finish. QRadar then appears under **Environment → Integrations**, and you can ask about it in the Workspace or through the [Integration Specialist agent](/documentation/multi-agent-system/integration-specialist-agent).

<Note>
  Prefer HTTPS with a valid certificate on the console. If your API is exposed on a non-default port, include it in the URL field.
</Note>