IBM QRadar SIEM Integration Guide

Overview

The IBM QRadar SIEM integration connects your NINA workflows to the QRadar REST API, enabling operations against offenses, analytics rules, Ariel searches, asset management, reference data, staged configuration, vulnerability management, and supporting services — all directly from your workflows.

IBM QRadar is an enterprise SIEM platform that collects, normalises, and correlates log and network flow data from across your environment to detect threats and generate offenses.

Status

We currently support 21 API modules across the full QRadar REST API surface:

• Offense Management (SIEM): List, retrieve, update, and close offenses; manage notes, closing reasons, offense types, offense saved searches, and source/destination addresses
• Analytics Rules: List, retrieve, update, and delete rules, building blocks, and ADE rules; manage custom actions, custom action scripts, and rule groups; poll async dependency and delete task results
• Ariel Searches: Submit AQL queries, poll search status, retrieve results and metadata; manage saved searches, saved search groups, lookups, tagged fields, tagged field categories, flow VLANs, and AQL functions
• Reference Data: Create, populate, and delete reference maps, maps of sets, and tables; bulk-load entries; manage async dependent tasks
• Reference Data Collections: Create, populate, and delete reference sets; manage entries individually or in bulk; poll bulk update task results
• Asset Model: List, create, update, and delete assets; manage asset model configuration, asset property types, and asset saved search groups
• Vulnerability Management (QVM): Query networks, open services, and vulnerability instance saved searches; retrieve asset and vulnerability results; assign tickets
• Network Lookup Services: Submit and retrieve WHOIS, DNS, dig, and port scan lookup tasks; retrieve geolocation data
• Staged Configuration: Manage users, roles, security profiles, certificates (CSR, end-entity, root CA), deployment hosts and status, remote networks and services, flow applications, backup schedules, and YARA rules
• Forensics: Manage capture recoveries and tasks; create and retrieve forensics cases; poll case creation task status
• GUI App Framework: Manage application creation tasks, application definitions, application instances, named services, and user role associations
• QNI (Network Insights): Manage QNI host configurations and stacking stack configurations
• QRM (Risk Manager): Manage model groups, question groups, simulation groups, QRM saved search groups, and topology saved search groups
• Dynamic Search: Manage saved queries and query schemas; retrieve schema fields, functions, and operators
• Data Classification: Manage DSM event mappings, high-level and low-level event categories, and QID records
• Disaster Recovery: Manage Ariel copy profiles for disaster recovery
• Backup and Restore: Initiate and manage backups and restores; retrieve HA action status; update iptables pre-file
• Bandwidth Manager: Manage bandwidth configurations and filters
• System: Retrieve QRadar version and build information; manage authorization settings, password policies, email servers, EULAs, server configuration, network interfaces, timezones, locales, and encodings
• Access: Retrieve authentication login attempt records
• OCSF: Retrieve offenses in OCSF (Open Cybersecurity Schema Framework) format

---

Credential Configuration

The QRadar integration authenticates using a static SEC token passed in the SEC request header. No token refresh or OAuth flow is required.

Authentication Method

API Key (SEC Token)

Field	Description	Example
Token	QRadar SEC authentication token	12345678-1234-1234-1234-123456789abc
Base URL	QRadar console base URL	https://qradar.example.com

How to create a QRadar SEC token:

1. Log in to the QRadar console as an administrator
2. Navigate to Admin > User Management > Authorized Services
3. Click Add Authorized Service
4. Enter a service name (e.g., "NINA Integration") and select the appropriate user role
5. Set an expiry date or leave blank for no expiry
6. Click Create Service
7. Copy the generated token — it will not be shown again

Minimum required permissions depend on which resources you use. Use a dedicated authorized service account with the least privilege necessary for your workflows.

Creating a QRadar Credential

1. Navigate to the Credentials section in NINA
2. Click Add New Credential
3. Fill in the credential details:
   • Name: A descriptive name (e.g., "QRadar Production")
   • Integration Service: Select "IBM QRadar SIEM"
   • Auth Type: Select "API Key"
   • Token: Enter your SEC token
   • Base URL: Enter your QRadar console URL (e.g., https://qradar.example.com)
4. Click Save

---

Supported Resources and Operations

---

Access

Retrieve authentication login attempt records.

Operation	Name	Description
listLoginAttempts	List Login Attempts	Gets the list of login attempts.

---

Analytics

Manage QRadar analytics rules, building blocks, ADE rules, custom actions, and rule groups.

ADE Rules

Operation	Name	Description
listAdeRules	List Ade Rules	Retrieves a list of ADE rules.
getAdeRules	Get Ade Rules	Retrieves an ADE rule.
updateAdeRules	Update Ade Rules	Updates the ADE rule owner or enabled/disabled only.
deleteAdeRules	Delete Ade Rules	Deletes an ADE rule (starts async dependency check).
listAdeRulesDependents	List Ade Rules Dependents	Retrieves objects that depend on the ADE rule. NoPaging.
getAdeRulesAdeRuleDeleteTasks	Get Ade Rules Ade Rule Delete Tasks	Retrieves the ADE rule delete task status.
getAdeRulesAdeRuleDependentTasks	Get Ade Rules Ade Rule Dependent Tasks	Retrieves the ADE rule dependent task status.
updateAdeRulesAdeRuleDependentTasks	Update Ade Rules Ade Rule Dependent Tasks	Cancels the ADE rule dependent task.
listAdeRulesAdeRuleDependentTasksResults	List Ade Rules Ade Rule Dependent Tasks Results	Retrieves ADE rule dependent task results.

Building Blocks

Operation	Name	Description
listBuildingBlocks	List Building Blocks	Retrieves a list of building block rules.
getBuildingBlocks	Get Building Blocks	Retrieves a building block rule.
updateBuildingBlocks	Update Building Blocks	Updates the building block rule owner or enabled/disabled only.
deleteBuildingBlocks	Delete Building Blocks	Deletes a building block rule (starts async dependency check).
listBuildingBlocksDependents	List Building Blocks Dependents	Retrieves objects that depend on the building block rule. NoPaging.
getBuildingBlocksBuildingBlockDeleteTasks	Get Building Blocks Building Block Delete Tasks	Retrieves the building block delete task status.
getBuildingBlocksBuildingBlockDependentTasks	Get Building Blocks Building Block Dependent Tasks	Retrieves the building block dependent task status.
updateBuildingBlocksBuildingBlockDependentTasks	Update Building Blocks Building Block Dependent Tasks	Cancels the building block dependent task.
listBuildingBlocksBuildingBlockDependentTasksResults	List Building Blocks Building Block Dependent Tasks Results	Retrieves building block dependent task results.

Custom Actions

Operation	Name	Description
listCustomActionsActions	List Custom Actions Actions	Retrieves a list of available custom actions.
createCustomActionsActions	Create Custom Actions Actions	Creates a new custom action.
getCustomActionsActions	Get Custom Actions Actions	Retrieves a custom action by ID.
updateCustomActionsActions	Update Custom Actions Actions	Updates an existing custom action.
deleteCustomActionsActions	Delete Custom Actions Actions	Deletes an existing custom action.
listCustomActionsInterpreters	List Custom Actions Interpreters	Retrieves a list of available custom action interpreters.
getCustomActionsInterpreters	Get Custom Actions Interpreters	Retrieves a custom action interpreter by ID.
listCustomActionsScripts	List Custom Actions Scripts	Retrieves a list of custom action script file metadata.
createCustomActionsScripts	Create Custom Actions Scripts	Creates a new custom action script file.
getCustomActionsScripts	Get Custom Actions Scripts	Retrieves custom action script file metadata by ID.
updateCustomActionsScripts	Update Custom Actions Scripts	Updates an existing custom action script file.
deleteCustomActionsScripts	Delete Custom Actions Scripts	Deletes an existing custom action script file.

Rules and Rule Groups

Operation	Name	Description
listRules	List Rules	Retrieves a list of rules.
getRules	Get Rules	Retrieves a rule.
updateRules	Update Rules	Updates the rule owner or enabled/disabled only.
deleteRules	Delete Rules	Deletes a rule (starts async dependency check).
listRulesDependents	List Rules Dependents	Retrieves objects that depend on the rule. NoPaging.
getRulesRuleDeleteTasks	Get Rules Rule Delete Tasks	Retrieves the rule delete task status.
getRulesRuleDependentTasks	Get Rules Rule Dependent Tasks	Retrieves the rule dependent task status.
updateRulesRuleDependentTasks	Update Rules Rule Dependent Tasks	Cancels the rule dependent task.
listRulesRuleDependentTasksResults	List Rules Rule Dependent Tasks Results	Retrieves rule dependent task results.
listRuleGroups	List Rule Groups	Retrieves a list of rule groups.
getRuleGroups	Get Rule Groups	Retrieves a rule group.
updateRuleGroups	Update Rule Groups	Updates the owner of a rule group.
deleteRuleGroups	Delete Rule Groups	Deletes a rule group.
listRulesOffenseContributions	List Rules Offense Contributions	Retrieves rule and offense contribution references.

---

Ariel

Manage QRadar Ariel AQL searches, databases, saved searches, lookups, tagged fields, and AQL functions.

Databases

Operation	Name	Description
listDatabases	List Databases	Retrieves a list of available Ariel database names.
getDatabases	Get Databases	Retrieves the columns defined for a specific Ariel database.

Searches

Operation	Name	Description
listSearches	List Searches	Retrieves a list of Ariel searches.
createSearches	Create Searches	Submits an AQL search query.
getSearches	Get Searches	Retrieves the status of an Ariel search.
updateSearches	Update Searches	Updates (cancels) an in-progress Ariel search.
deleteSearches	Delete Searches	Deletes an Ariel search.
listSearchesMetadata	List Searches Metadata	Retrieves result metadata for a completed Ariel search.
listSearchesResults	List Searches Results	Retrieves the results of a completed Ariel search.

Key parameters for createSearches:

• query_expression (required) — AQL query string (e.g., SELECT * FROM events LAST 5 MINUTES)

Saved Searches

Operation	Name	Description
listSavedSearches	List Saved Searches	Retrieves a list of Ariel saved searches.
getSavedSearches	Get Saved Searches	Retrieves an Ariel saved search.
updateSavedSearches	Update Saved Searches	Updates an Ariel saved search owner.
deleteSavedSearches	Delete Saved Searches	Deletes an Ariel saved search (starts async dependency check).
listSavedSearchesDependents	List Saved Searches Dependents	Retrieves objects that depend on the saved search. NoPaging.
getSavedSearchDeleteTasks	Get Saved Search Delete Tasks	Retrieves the saved search delete task status.
getSavedSearchDependentTasks	Get Saved Search Dependent Tasks	Retrieves the saved search dependent task status.
updateSavedSearchDependentTasks	Update Saved Search Dependent Tasks	Cancels a saved search dependent task.
listSavedSearchDependentTasksResults	List Saved Search Dependent Tasks Results	Retrieves saved search dependent task results.
listEventSavedSearchGroups	List Event Saved Search Groups	Retrieves a list of event Ariel saved search groups.
getEventSavedSearchGroups	Get Event Saved Search Groups	Retrieves an event Ariel saved search group.
updateEventSavedSearchGroups	Update Event Saved Search Groups	Updates the owner of an event Ariel saved search group.
deleteEventSavedSearchGroups	Delete Event Saved Search Groups	Deletes an event Ariel saved search group.
listFlowSavedSearchGroups	List Flow Saved Search Groups	Retrieves a list of flow Ariel saved search groups.
getFlowSavedSearchGroups	Get Flow Saved Search Groups	Retrieves a flow Ariel saved search group.
updateFlowSavedSearchGroups	Update Flow Saved Search Groups	Updates the owner of a flow Ariel saved search group.
deleteFlowSavedSearchGroups	Delete Flow Saved Search Groups	Deletes a flow Ariel saved search group.

Lookups and Tagged Fields

Operation	Name	Description
listLookups	List Lookups	Retrieves a list of all tagged field lookups. NoPaging.
createLookups	Create Lookups	Creates a new tagged field lookup.
getLookups	Get Lookups	Retrieves a tagged field lookup by name.
updateLookups	Update Lookups	Updates a tagged field lookup.
deleteLookups	Delete Lookups	Deletes a tagged field lookup.
listTaggedfields	List Taggedfields	Retrieves a list of tagged fields.
createTaggedfields	Create Taggedfields	Creates a new tagged field.
getTaggedfields	Get Taggedfields	Retrieves a tagged field.
updateTaggedfields	Update Taggedfields	Updates a tagged field.
deleteTaggedfields	Delete Taggedfields	Deletes a tagged field.
listTaggedfieldcategories	List Taggedfieldcategories	Retrieves a list of tagged field categories.
createTaggedfieldcategories	Create Taggedfieldcategories	Creates a new tagged field category.
getTaggedfieldcategories	Get Taggedfieldcategories	Retrieves a tagged field category.
updateTaggedfieldcategories	Update Taggedfieldcategories	Updates a tagged field category.
deleteTaggedfieldcategories	Delete Taggedfieldcategories	Deletes a tagged field category.

Flow VLANs

Operation	Name	Description
listFlowVlans	List Flow Vlans	Retrieves a list of available flow VLAN IDs.
createFlowVlans	Create Flow Vlans	Creates a new flow VLAN field.
getFlowVlans	Get Flow Vlans	Retrieves a flow VLAN ID object.
deleteFlowVlans	Delete Flow Vlans	Deletes a flow VLAN ID and removes associated domain mappings.

AQL Functions and Keywords

Operation	Name	Description
listFunctions	List Functions	Retrieves AQL functions for a database. NoPaging.
getFunctions	Get Functions	Retrieves an AQL function by name for a given database.
listParserKeywords	List Parser Keywords	Retrieves AQL parser keywords. NoPaging.
createProcessorsAqlMetadata	Create Processors Aql Metadata	Parses an AQL expression and returns query metadata.
createValidatorsAql	Create Validators Aql	Validates an AQL query expression.

Key parameters for listFunctions:

• database (required) — Ariel database name (e.g., events, flows)

Key parameters for getFunctions:

• function_name (required) — AQL function name
• database (required) — Ariel database name

Key parameters for createProcessorsAqlMetadata:

• query_expression (required) — AQL query string to parse

---

Asset Model

Manage QRadar assets and asset saved searches.

Operation	Name	Description
listAssets	List Assets	Retrieves a list of assets.
createAssets	Create Assets	Creates or updates an asset.
updateAssets	Update Assets	Updates existing assets.
deleteAssets	Delete Assets	Deletes assets.
listConfiguration	List Configuration	Retrieves asset model configuration.
createConfiguration	Create Configuration	Updates asset model configuration.
listProperties	List Properties	Retrieves a list of asset property types.
listSavedSearchGroups	List Saved Search Groups	Retrieves a list of asset saved search groups.
getSavedSearchGroups	Get Saved Search Groups	Retrieves an asset saved search group.
updateSavedSearchGroups	Update Saved Search Groups	Updates the owner of an asset saved search group.
deleteSavedSearchGroups	Delete Saved Search Groups	Deletes an asset saved search group.
listSavedSearchesResults	List Saved Searches Results	Retrieves results of an asset saved search.

---

Backup and Restore

Manage QRadar backups, restores, and high-availability actions.

Operation	Name	Description
listBackups	List Backups	Retrieves a list of backups.
createBackups	Create Backups	Initiates a new backup.
getBackups	Get Backups	Retrieves a backup by ID.
updateBackups	Update Backups	Updates a backup.
deleteBackups	Delete Backups	Deletes a backup.
getHaAction	Get Ha Action	Retrieves the current HA action status.
listRestores	List Restores	Retrieves a list of restore operations.
createRestores	Create Restores	Initiates a restore operation.
getRestores	Get Restores	Retrieves a restore operation by ID.
updateRestores	Update Restores	Updates a restore operation.
deleteRestores	Delete Restores	Deletes a restore record.
updateIptablesPrefile	Update Iptables Prefile	Updates the iptables pre-file configuration.

---

Bandwidth Manager

Manage QRadar bandwidth configurations and filters.

Operation	Name	Description
listConfigurations	List Configurations	Retrieves a list of bandwidth configurations.
createConfigurations	Create Configurations	Creates a new bandwidth configuration.
getConfigurations	Get Configurations	Retrieves a bandwidth configuration by ID.
updateConfigurations	Update Configurations	Updates a bandwidth configuration.
deleteConfigurations	Delete Configurations	Deletes a bandwidth configuration.
listFilters	List Filters	Retrieves a list of bandwidth filters.
createFilters	Create Filters	Creates a new bandwidth filter.
getFilters	Get Filters	Retrieves a bandwidth filter by ID.
updateFilters	Update Filters	Updates a bandwidth filter.
deleteFilters	Delete Filters	Deletes a bandwidth filter.

---

Data Classification

Manage DSM event mappings, log source categories, and QID records.

Operation	Name	Description
listDsmEventMappings	List Dsm Event Mappings	Retrieves a list of DSM event mappings.
createDsmEventMappings	Create Dsm Event Mappings	Creates a new DSM event mapping.
getDsmEventMappings	Get Dsm Event Mappings	Retrieves a DSM event mapping by ID.
updateDsmEventMappings	Update Dsm Event Mappings	Updates a DSM event mapping.
listHighLevelCategories	List High Level Categories	Retrieves a list of high-level event categories.
getHighLevelCategories	Get High Level Categories	Retrieves a high-level category by ID.
listLowLevelCategories	List Low Level Categories	Retrieves a list of low-level event categories.
getLowLevelCategories	Get Low Level Categories	Retrieves a low-level category by ID.
listQidRecords	List Qid Records	Retrieves a list of QID records.
createQidRecords	Create Qid Records	Creates a new QID record.
getQidRecords	Get Qid Records	Retrieves a QID record by ID.
updateQidRecords	Update Qid Records	Updates a QID record.

---

Disaster Recovery

Manage Ariel copy profiles for disaster recovery.

Operation	Name	Description
listArielCopyProfiles	List Ariel Copy Profiles	Retrieves a list of Ariel copy profiles.
createArielCopyProfiles	Create Ariel Copy Profiles	Creates a new Ariel copy profile.
getArielCopyProfiles	Get Ariel Copy Profiles	Retrieves an Ariel copy profile by ID.
updateArielCopyProfiles	Update Ariel Copy Profiles	Updates an Ariel copy profile.
deleteArielCopyProfiles	Delete Ariel Copy Profiles	Deletes an Ariel copy profile.

---

Dynamic Search

Manage saved queries and query schemas for the QRadar dynamic search engine.

Operation	Name	Description
listSavedQueries	List Saved Queries	Retrieves a list of saved queries.
createSavedQueries	Create Saved Queries	Creates a new saved query.
getSavedQueries	Get Saved Queries	Retrieves a saved query by ID.
deleteSavedQueries	Delete Saved Queries	Deletes a saved query.
listSchemas	List Schemas	Retrieves a list of available query schemas.
getSchemas	Get Schemas	Retrieves a query schema by name.
listSchemasFields	List Schemas Fields	Retrieves the fields defined in a query schema.
listSchemasFunctions	List Schemas Functions	Retrieves the functions available in a query schema.
listSchemasOperators	List Schemas Operators	Retrieves the operators available in a query schema.

---

Forensics

Manage capture recoveries and case management for QRadar Incident Forensics.

Operation	Name	Description
listCaptureRecoveries	List Capture Recoveries	Retrieves a list of capture recoveries.
createCaptureRecoveries	Create Capture Recoveries	Creates a new capture recovery.
getCaptureRecoveries	Get Capture Recoveries	Retrieves a capture recovery by ID.
listCaptureRecoveryTasks	List Capture Recovery Tasks	Retrieves a list of capture recovery tasks.
getCaptureRecoveryTasks	Get Capture Recovery Tasks	Retrieves a capture recovery task by ID.
getCaseManagementCaseCreateTasks	Get Case Management Case Create Tasks	Retrieves a case creation task status.
listCaseManagementCases	List Case Management Cases	Retrieves a list of forensics cases.
createCaseManagementCases	Create Case Management Cases	Creates a new forensics case.
getCaseManagementCases	Get Case Management Cases	Retrieves a forensics case by ID.

---

GUI App Framework

Manage QRadar application lifecycle — creation tasks, definitions, instances, and named services.

Operation	Name	Description
listApplicationCreationTask	List Application Creation Task	Retrieves a list of application creation tasks.
createApplicationCreationTask	Create Application Creation Task	Creates a new application creation task.
getApplicationCreationTask	Get Application Creation Task	Retrieves an application creation task.
updateApplicationCreationTask	Update Application Creation Task	Updates an application creation task.
getApplicationCreationTaskAuth	Get Application Creation Task Auth	Retrieves auth information for an application creation task.
createApplicationCreationTaskAuth	Create Application Creation Task Auth	Creates auth for an application creation task.
listApplicationDefinitions	List Application Definitions	Retrieves a list of application definitions.
createApplicationDefinitions	Create Application Definitions	Creates a new application definition.
getApplicationDefinitions	Get Application Definitions	Retrieves an application definition by ID.
updateApplicationDefinitions	Update Application Definitions	Updates an application definition.
deleteApplicationDefinitions	Delete Application Definitions	Deletes an application definition.
upgradeApplicationDefinitions	Upgrade Application Definitions	Upgrades an application definition.
listApplicationDefinitionsUserRoleId	List Application Definitions User Role Id	Retrieves user role associations for an application definition.
updateApplicationDefinitionsUserRoleId	Update Application Definitions User Role Id	Updates user role associations for an application definition.
deleteApplicationDefinitionsUserRoleId	Delete Application Definitions User Role Id	Removes user role associations from an application definition.
listApplications	List Applications	Retrieves a list of application instances.
createApplications	Create Applications	Creates a new application instance.
getApplications	Get Applications	Retrieves an application instance by ID.
updateApplications	Update Applications	Updates an application instance.
deleteApplications	Delete Applications	Deletes an application instance.
upgradeApplications	Upgrade Applications	Upgrades an application instance.
getApplicationsHostType	Get Applications Host Type	Retrieves the host type for an application.
listNamedServices	List Named Services	Retrieves a list of named services.
getNamedServices	Get Named Services	Retrieves a named service by UUID.

---

QNI

Manage QRadar Network Insights host configurations and stacking.

Operation	Name	Description
listHostsConfigs	List Hosts Configs	Retrieves a list of QNI host configurations.
updateHostsConfigs	Update Hosts Configs	Updates QNI host configurations.
listStackingStacks	List Stacking Stacks	Retrieves a list of stacking stack configurations.
createStackingStacks	Create Stacking Stacks	Creates a new stacking stack.
getStackingStacks	Get Stacking Stacks	Retrieves a stacking stack by ID.
updateStackingStacks	Update Stacking Stacks	Updates a stacking stack.
deleteStackingStacks	Delete Stacking Stacks	Deletes a stacking stack.
listStackingStandaloneHosts	List Stacking Standalone Hosts	Retrieves a list of standalone stacking hosts.

---

QRM

Manage QRadar Risk Manager model groups, question groups, simulation groups, saved search groups, and topology saved search groups.

Operation	Name	Description
listModelGroups	List Model Groups	Retrieves a list of model groups.
getModelGroups	Get Model Groups	Retrieves a model group by ID.
updateModelGroups	Update Model Groups	Updates a model group.
deleteModelGroups	Delete Model Groups	Deletes a model group.
listQrmSavedSearchGroups	List Qrm Saved Search Groups	Retrieves a list of QRM saved search groups.
getQrmSavedSearchGroups	Get Qrm Saved Search Groups	Retrieves a QRM saved search group by ID.
updateQrmSavedSearchGroups	Update Qrm Saved Search Groups	Updates a QRM saved search group.
deleteQrmSavedSearchGroups	Delete Qrm Saved Search Groups	Deletes a QRM saved search group.
listQuestionGroups	List Question Groups	Retrieves a list of question groups.
getQuestionGroups	Get Question Groups	Retrieves a question group by ID.
updateQuestionGroups	Update Question Groups	Updates a question group.
deleteQuestionGroups	Delete Question Groups	Deletes a question group.
listSimulationGroups	List Simulation Groups	Retrieves a list of simulation groups.
getSimulationGroups	Get Simulation Groups	Retrieves a simulation group by ID.
updateSimulationGroups	Update Simulation Groups	Updates a simulation group.
deleteSimulationGroups	Delete Simulation Groups	Deletes a simulation group.
listTopologySavedSearchGroups	List Topology Saved Search Groups	Retrieves a list of topology saved search groups.
getTopologySavedSearchGroups	Get Topology Saved Search Groups	Retrieves a topology saved search group by ID.
updateTopologySavedSearchGroups	Update Topology Saved Search Groups	Updates a topology saved search group.
deleteTopologySavedSearchGroups	Delete Topology Saved Search Groups	Deletes a topology saved search group.

---

QVM

Query vulnerability management data — networks, open services, and vulnerability instance saved searches.

Operation	Name	Description
listNetwork	List Network	Retrieves a list of network objects.
listOpenservices	List Openservices	Retrieves a list of open service records.
listSavedSearchesVulnInstances	List Saved Searches Vuln Instances	Retrieves a list of vulnerability instance saved searches.
listSavedSearchesVulnInstancesResultsAssets	List Saved Searches Vuln Instances Results Assets	Retrieves asset results for a vulnerability instance saved search.
listSavedSearchesVulnInstancesResultsVulnInstances	List Saved Searches Vuln Instances Results Vuln Instances	Retrieves vulnerability instance results for a saved search.
listSavedSearchesVulnInstancesResultsVulnerabilities	List Saved Searches Vuln Instances Results Vulnerabilities	Retrieves vulnerability results for a vulnerability instance saved search.
listSavedSearchesVulnInstancesStatus	List Saved Searches Vuln Instances Status	Retrieves the execution status of a vulnerability instance saved search.
createSavedSearchesVulnInstancesStatus	Create Saved Searches Vuln Instances Status	Triggers execution of a vulnerability instance saved search.
createTicketsAssign	Create Tickets Assign	Assigns tickets to vulnerability instances.
listVulns	List Vulns	Retrieves a list of vulnerability definitions.

---

Reference Data

Manage QRadar reference maps, maps of sets, and tables — including bulk load and dependent task operations.

Reference Maps

Operation	Name	Description
listMaps	List Maps	Retrieves a list of reference maps.
createMaps	Create Maps	Creates a new reference map.
getMaps	Get Maps	Retrieves a reference map by name.
updateMaps	Update Maps	Adds or updates an entry in a reference map.
updateMapsDescription	Update Maps Description	Updates the description of a reference map.
deleteMaps	Delete Maps	Starts async deletion of a reference map.
deleteMaps_2	Delete Maps	Deletes a single entry from a reference map.
bulkLoadMaps	Bulk Load Maps	Bulk loads entries into a reference map.
bulkLoadMaps_2	Bulk Load Maps	Bulk loads entries into a reference map (alternate path).
listMapsDependents	List Maps Dependents	Retrieves objects that depend on a reference map. NoPaging.
getMapDeleteTasks	Get Map Delete Tasks	Retrieves the reference map delete task status.
getMapDependentTasks	Get Map Dependent Tasks	Retrieves the reference map dependent task status.
updateMapDependentTasks	Update Map Dependent Tasks	Cancels a reference map dependent task.
listMapDependentTasksResults	List Map Dependent Tasks Results	Retrieves reference map dependent task results.

Reference Maps of Sets

Operation	Name	Description
listMapOfSets	List Map Of Sets	Retrieves a list of reference maps of sets.
createMapOfSets	Create Map Of Sets	Creates a new reference map of sets.
getMapOfSets	Get Map Of Sets	Retrieves a reference map of sets by name.
updateMapOfSets	Update Map Of Sets	Adds or updates an entry in a reference map of sets.
updateMapOfSetsDescription	Update Map Of Sets Description	Updates the description of a reference map of sets.
deleteMapOfSets	Delete Map Of Sets	Starts async deletion of a reference map of sets.
deleteMapOfSets_2	Delete Map Of Sets	Deletes a single value from a reference map of sets.
bulkLoadMapOfSets	Bulk Load Map Of Sets	Bulk loads entries into a reference map of sets.
bulkLoadMapOfSets_2	Bulk Load Map Of Sets	Bulk loads entries into a reference map of sets (alternate path).
listMapOfSetsDependents	List Map Of Sets Dependents	Retrieves objects that depend on a reference map of sets. NoPaging.
getMapOfSetsDeleteTasks	Get Map Of Sets Delete Tasks	Retrieves the map of sets delete task status.
getMapOfSetsDependentTasks	Get Map Of Sets Dependent Tasks	Retrieves the map of sets dependent task status.
updateMapOfSetsDependentTasks	Update Map Of Sets Dependent Tasks	Cancels a map of sets dependent task.
listMapOfSetsDependentTasksResults	List Map Of Sets Dependent Tasks Results	Retrieves map of sets dependent task results.

Reference Tables

Operation	Name	Description
listTables	List Tables	Retrieves a list of reference tables.
createTables	Create Tables	Creates a new reference table.
getTables	Get Tables	Retrieves a reference table by name.
updateTables	Update Tables	Adds or updates an entry in a reference table.
updateTablesDescription	Update Tables Description	Updates the description of a reference table.
deleteTables	Delete Tables	Starts async deletion of a reference table.
deleteTables_2	Delete Tables	Deletes a single entry from a reference table.
bulkLoadTables	Bulk Load Tables	Bulk loads entries into a reference table.
bulkLoadTables_2	Bulk Load Tables	Bulk loads entries into a reference table (alternate path).
listTablesDependents	List Tables Dependents	Retrieves objects that depend on a reference table. NoPaging.
getTablesDeleteTasks	Get Tables Delete Tasks	Retrieves the reference table delete task status.
getTablesDependentTasks	Get Tables Dependent Tasks	Retrieves the reference table dependent task status.
updateTablesDependentTasks	Update Tables Dependent Tasks	Cancels a reference table dependent task.
listTablesDependentTasksResults	List Tables Dependent Tasks Results	Retrieves reference table dependent task results.

---

Reference Data Collections

Manage QRadar reference sets and set entries.

Operation	Name	Description
listSets	List Sets	Retrieves a list of reference sets.
createSets	Create Sets	Creates a new reference set.
getSets	Get Sets	Retrieves a reference set by name.
updateSets	Update Sets	Adds an entry to a reference set.
deleteSets	Delete Sets	Starts async deletion of a reference set.
listSetsDependents	List Sets Dependents	Retrieves objects that depend on a reference set. NoPaging.
listSetEntries	List Set Entries	Retrieves entries in a reference set.
createSetEntries	Create Set Entries	Creates entries in a reference set.
patchSetEntries	Patch Set Entries	Bulk updates entries in a reference set.
getSetEntries	Get Set Entries	Retrieves a specific entry from a reference set.
updateSetEntries	Update Set Entries	Updates an entry in a reference set.
deleteSetEntries	Delete Set Entries	Deletes an entry from a reference set.
getSetBulkUpdateTasks	Get Set Bulk Update Tasks	Retrieves a bulk update task status.
listSetBulkUpdateTasksResults	List Set Bulk Update Tasks Results	Retrieves bulk update task results.
getSetDeleteTasks	Get Set Delete Tasks	Retrieves the reference set delete task status.
getSetDependentsTasks	Get Set Dependents Tasks	Retrieves the reference set dependents task status.
updateSetDependentsTasks	Update Set Dependents Tasks	Cancels a reference set dependents task.
listSetDependentsTasksResults	List Set Dependents Tasks Results	Retrieves reference set dependents task results.

---

Services

Network and threat intelligence lookup services.

Operation	Name	Description
createDigLookups	Create Dig Lookups	Submits a dig DNS lookup request.
getDigLookups	Get Dig Lookups	Retrieves the result of a dig lookup task.
createDnsLookups	Create Dns Lookups	Submits a DNS lookup request.
getDnsLookups	Get Dns Lookups	Retrieves the result of a DNS lookup task.
listGeolocations	List Geolocations	Retrieves geolocation data. NoPaging.
createPortScans	Create Port Scans	Submits a port scan request.
getPortScans	Get Port Scans	Retrieves the result of a port scan task.
createWhoisLookups	Create Whois Lookups	Submits a WHOIS lookup request.
getWhoisLookups	Get Whois Lookups	Retrieves the result of a WHOIS lookup task.

Note: Dig, DNS, port scan, and WHOIS operations are asynchronous. Submit the request with the create operation and poll with the corresponding get operation using the returned task_id.

---

SIEM

Manage QRadar SIEM offenses, offense types, closing reasons, notes, source and destination addresses, and offense saved searches.

Offenses

Operation	Name	Description
listOffenses	List Offenses	Retrieves a list of offenses currently in the system.
getOffenses	Get Offenses	Retrieves an offense by ID.
updateOffenses	Update Offenses	Updates an offense.
listOffensesAssignableActors	List Offenses Assignable Actors	Retrieves assignable actors for an offense.
listOffensesNotes	List Offenses Notes	Retrieves notes for an offense.
createOffensesNotes	Create Offenses Notes	Creates a note on an offense.
getOffensesNotes	Get Offenses Notes	Retrieves a specific note on an offense.
listOffensesOcsf	List Offenses Ocsf	Retrieves offenses in OCSF format.

Key parameters for updateOffenses:

• offense_id (required) — offense ID
• protected — set protection flag
• follow_up — set follow-up flag
• status — OPEN, HIDDEN, CLOSED
• closing_reason_id — required when setting status to CLOSED
• assigned_to — username to assign the offense to

Key parameters for createOffensesNotes:

• offense_id (required) — offense ID
• note_text (required) — text of the note

Offense Types and Closing Reasons

Operation	Name	Description
listOffenseTypes	List Offense Types	Retrieves all offense types.
getOffenseTypes	Get Offense Types	Retrieves an offense type by ID.
listOffenseClosingReasons	List Offense Closing Reasons	Retrieves a list of offense closing reasons.
createOffenseClosingReasons	Create Offense Closing Reasons	Creates an offense closing reason.
getOffenseClosingReasons	Get Offense Closing Reasons	Retrieves an offense closing reason by ID.

Key parameters for listOffenseClosingReasons:

• include_reserved — include system-reserved reasons (true/false)
• include_deleted — include deleted reasons (true/false)

Key parameters for createOffenseClosingReasons:

• reason (required) — closing reason text

Source and Destination Addresses

Operation	Name	Description
listSourceAddresses	List Source Addresses	Retrieves a list of offense source addresses.
getSourceAddresses	Get Source Addresses	Retrieves an offense source address by ID.
listLocalDestinationAddresses	List Local Destination Addresses	Retrieves a list of offense local destination addresses.
getLocalDestinationAddresses	Get Local Destination Addresses	Retrieves an offense local destination address by ID.

Offense Saved Searches

Operation	Name	Description
listOffenseSavedSearches	List Offense Saved Searches	Retrieves a list of offense saved searches.
getOffenseSavedSearches	Get Offense Saved Searches	Retrieves an offense saved search by ID.
updateOffenseSavedSearches	Update Offense Saved Searches	Updates the owner of an offense saved search.
deleteOffenseSavedSearches	Delete Offense Saved Searches	Starts async deletion of an offense saved search.
listOffenseSavedSearchesDependents	List Offense Saved Searches Dependents	Retrieves objects that depend on an offense saved search. NoPaging.
listOffenseSavedSearchGroups	List Offense Saved Search Groups	Retrieves a list of offense saved search groups.
getOffenseSavedSearchGroups	Get Offense Saved Search Groups	Retrieves an offense saved search group by ID.
updateOffenseSavedSearchGroups	Update Offense Saved Search Groups	Updates the owner of an offense saved search group.
deleteOffenseSavedSearchGroups	Delete Offense Saved Search Groups	Deletes an offense saved search group.
getOffenseSavedSearchDeleteTasks	Get Offense Saved Search Delete Tasks	Retrieves the saved search delete task status.
getOffenseSavedSearchDependentTasks	Get Offense Saved Search Dependent Tasks	Retrieves the saved search dependent task status.
updateOffenseSavedSearchDependentTasks	Update Offense Saved Search Dependent Tasks	Cancels a saved search dependent task.
listOffenseSavedSearchDependentTasksResults	List Offense Saved Search Dependent Tasks Results	Retrieves saved search dependent task results.

---

Staged Config

Manage users, roles, security profiles, certificates, deployment, remote networks and services, flow applications, and YARA rules through the QRadar staged configuration API.

Access: Users, Roles, Security Profiles

Operation	Name	Description
listAccessSecurityProfiles	List Access Security Profiles	Retrieves a list of security profiles.
getAccessSecurityProfiles	Get Access Security Profiles	Retrieves a security profile by ID.
listAccessUserRoles	List Access User Roles	Retrieves a list of user roles.
getAccessUserRoles	Get Access User Roles	Retrieves a user role by ID.
listAccessUsers	List Access Users	Retrieves a list of users.
createAccessUsers	Create Access Users	Creates a new user.
getAccessUsers	Get Access Users	Retrieves a user by ID.
updateAccessUsers	Update Access Users	Updates a user.
deleteAccessUsers	Delete Access Users	Starts async deletion of a user.
getAccessUserDeleteTasks	Get Access User Delete Tasks	Retrieves a user delete task status.

Backup Schedules

Operation	Name	Description
listBackupAndRestoreScheduledBackupConfigurations	List Backup And Restore Scheduled Backup Configurations	Retrieves scheduled backup configurations.
getBackupAndRestoreScheduledBackupConfigurations	Get Backup And Restore Scheduled Backup Configurations	Retrieves a scheduled backup configuration by ID.
updateBackupAndRestoreScheduledBackupConfigurations	Update Backup And Restore Scheduled Backup Configurations	Updates a scheduled backup configuration.

Certificates

Operation	Name	Description
listCertificatesCertificateSigningRequest	List Certificates Certificate Signing Request	Retrieves a list of certificate signing requests (CSRs).
createCertificatesCertificateSigningRequest	Create Certificates Certificate Signing Request	Creates a new CSR.
getCertificatesCertificateSigningRequest	Get Certificates Certificate Signing Request	Retrieves a CSR by ID.
deleteCertificatesCertificateSigningRequest	Delete Certificates Certificate Signing Request	Deletes a CSR.
listCertificatesEndCertificates	List Certificates End Certificates	Retrieves a list of end-entity certificates.
createCertificatesEndCertificates	Create Certificates End Certificates	Imports a new end-entity certificate.
getCertificatesEndCertificates	Get Certificates End Certificates	Retrieves an end-entity certificate by ID.
updateCertificatesEndCertificates	Update Certificates End Certificates	Updates an end-entity certificate.
deleteCertificatesEndCertificates	Delete Certificates End Certificates	Deletes an end-entity certificate.
listCertificatesRootCertificates	List Certificates Root Certificates	Retrieves a list of root CA certificates.
createCertificatesRootCertificates	Create Certificates Root Certificates	Imports a root CA certificate.
getCertificatesRootCertificates	Get Certificates Root Certificates	Retrieves a root CA certificate by ID.
deleteCertificatesRootCertificates	Delete Certificates Root Certificates	Deletes a root CA certificate.

Deployment

Operation	Name	Description
listDeployStatus	List Deploy Status	Retrieves the current deployment status.
createDeployStatus	Create Deploy Status	Initiates a deployment.
listDeploymentHosts	List Deployment Hosts	Retrieves a list of deployment hosts.
getDeploymentHosts	Get Deployment Hosts	Retrieves a deployment host by ID.
listDeploymentHostsTunnels	List Deployment Hosts Tunnels	Retrieves tunnel configurations for a deployment host.
updateDeploymentHostsTunnels	Update Deployment Hosts Tunnels	Updates tunnel configurations for a deployment host.

Flow Applications

Operation	Name	Description
listFlowApplicationsActiveApplications	List Flow Applications Active Applications	Retrieves a list of active flow applications.
createFlowApplicationsActiveApplications	Create Flow Applications Active Applications	Activates a flow application.
getFlowApplicationsActiveApplications	Get Flow Applications Active Applications	Retrieves an active flow application by ID.
updateFlowApplicationsActiveApplications	Update Flow Applications Active Applications	Updates an active flow application.
deleteFlowApplicationsActiveApplications	Delete Flow Applications Active Applications	Deactivates a flow application.

Remote Networks and Services

Operation	Name	Description
listRemoteNetworks	List Remote Networks	Retrieves a list of remote networks.
createRemoteNetworks	Create Remote Networks	Creates a new remote network.
getRemoteNetworks	Get Remote Networks	Retrieves a remote network by ID.
updateRemoteNetworks	Update Remote Networks	Updates a remote network.
deleteRemoteNetworks	Delete Remote Networks	Deletes a remote network.
listRemoteServices	List Remote Services	Retrieves a list of remote services.
createRemoteServices	Create Remote Services	Creates a new remote service.
getRemoteServices	Get Remote Services	Retrieves a remote service by ID.
updateRemoteServices	Update Remote Services	Updates a remote service.
deleteRemoteServices	Delete Remote Services	Deletes a remote service.

YARA Rules

Operation	Name	Description
uploadYaraRules	Upload Yara Rules	Uploads YARA rule files.
deleteYaraRules	Delete Yara Rules	Deletes YARA rules.

---

System

Retrieve system information and manage authorization settings, email servers, EULAs, server configuration, timezones, and locales.

System Information

Operation	Name	Description
getAbout	Get About	Retrieves QRadar version and build information.

Authorization

Operation	Name	Description
listAuthorizationPasswordPolicies	List Authorization Password Policies	Retrieves a list of password policies.
getAuthorizationPasswordPolicies	Get Authorization Password Policies	Retrieves a password policy by ID.
updateAuthorizationPasswordPolicies	Update Authorization Password Policies	Updates a password policy.
createAuthorizationPasswordValidators	Create Authorization Password Validators	Validates a password against a policy.
getAuthorizationSettings	Get Authorization Settings	Retrieves authorization settings.
createAuthorizationSettings	Create Authorization Settings	Updates authorization settings.

Email Servers

Operation	Name	Description
listEmailServers	List Email Servers	Retrieves a list of email server configurations.
createEmailServers	Create Email Servers	Creates a new email server configuration.
getEmailServers	Get Email Servers	Retrieves an email server configuration by ID.
updateEmailServers	Update Email Servers	Updates an email server configuration.
deleteEmailServers	Delete Email Servers	Deletes an email server configuration.

EULAs

Operation	Name	Description
listEulas	List Eulas	Retrieves a list of available EULAs.
listEulaAcceptances	List Eula Acceptances	Retrieves a list of EULA acceptances.
getEulaAcceptances	Get Eula Acceptances	Retrieves a EULA acceptance by ID.
updateEulaAcceptances	Update Eula Acceptances	Records acceptance of a EULA.

Servers

Operation	Name	Description
listServers	List Servers	Retrieves a list of QRadar servers.
getServers	Get Servers	Retrieves a server by ID.
updateServers	Update Servers	Updates a server.
createServerConnectionValidator	Create Server Connection Validator	Validates a server connection.
listServersFirewallRules	List Servers Firewall Rules	Retrieves firewall rules for a server.
updateServersFirewallRules	Update Servers Firewall Rules	Updates firewall rules for a server.
listServersNetworkInterfacesBonded	List Servers Network Interfaces Bonded	Retrieves bonded network interfaces for a server.
createServersNetworkInterfacesBonded	Create Servers Network Interfaces Bonded	Creates a bonded network interface.
updateServersNetworkInterfacesBonded	Update Servers Network Interfaces Bonded	Updates a bonded network interface.
deleteServersNetworkInterfacesBonded	Delete Servers Network Interfaces Bonded	Deletes a bonded network interface.
listServersNetworkInterfacesEthernet	List Servers Network Interfaces Ethernet	Retrieves ethernet network interfaces for a server.
updateServersNetworkInterfacesEthernet	Update Servers Network Interfaces Ethernet	Updates an ethernet network interface.
getServersSystemTimeSettings	Get Servers System Time Settings	Retrieves system time settings for a server.
createServersSystemTimeSettings	Create Servers System Time Settings	Updates system time settings for a server.
listServersTimezones	List Servers Timezones	Retrieves available timezones for a server.

Locales and Encodings

Operation	Name	Description
listInformationLocales	List Information Locales	Retrieves a list of available locales.
listInformationEncodings	List Information Encodings	Retrieves a list of available character encodings.

---

Parameter Merging and Templating

The IBM QRadar SIEM integration takes full advantage of NINA's parameter merging and templating capabilities:

Parameter Sources (in order of precedence)

1. Node Parameters: Parameters configured directly in the QRadar Integration Node
2. Extracted Parameters: Parameters automatically extracted from the input data
3. Input Data: The complete input data from upstream nodes

When a QRadar Integration Node executes:

• It combines parameters from all sources
• Node parameters take precedence over extracted parameters
• Template variables within parameters are processed using {{variable_name}} syntax
• The combined parameters are used to execute the QRadar operation

Template Variables

Use {{variable_name}} syntax to reference values from upstream nodes. For example, if an upstream node outputs {"offense_id": 42, "analyst": "jane.doe"}, you can reference these values in your node configuration:

{
  "parameters": {
    "offense_id": "{{offense_id}}",
    "assigned_to": "{{analyst}}"
  }
}

Nested values are accessed with dot notation: {{alert.severity}}.

Pagination

Most QRadar list operations support range-based pagination via the Range HTTP header. The integration translates range_start and range_end parameters into the appropriate Range: items=start-end header automatically.

Parameter	Description	Default
range_start	First item index (0-based)	0
range_end	Last item index (inclusive)	49

For example, to retrieve items 50–99, set range_start=50 and range_end=99. To increase the default page size, set range_end=199 for 200 items per page.

Operations marked NoPaging do not accept range parameters — they return the full result set in a single response. Examples include listAdeRulesDependents, listLookups, listFunctions, and listGeolocations. Be prepared to handle larger payloads from these operations.

---

Example: Offense Management

Listing Open Offenses

{
  "integration_service": "ibm-qradar-siem",
  "resource": "siem",
  "operation": "listOffenses",
  "parameters": {
    "filter": "status='OPEN'",
    "range_start": 0,
    "range_end": 49
  }
}

Getting a Specific Offense with a Template Variable

Input Data from Previous Node:

{
  "offense_id": 1042,
  "analyst": "jane.doe"
}

Node Configuration:

{
  "integration_service": "ibm-qradar-siem",
  "resource": "siem",
  "operation": "getOffenses",
  "parameters": {
    "offense_id": "{{offense_id}}"
  }
}

Closing an Offense with a Reason

{
  "integration_service": "ibm-qradar-siem",
  "resource": "siem",
  "operation": "updateOffenses",
  "parameters": {
    "offense_id": "{{offense_id}}",
    "status": "CLOSED",
    "closing_reason_id": "{{closing_reason_id}}",
    "assigned_to": "{{analyst}}"
  }
}

Note: Use listOffenseClosingReasons to retrieve the valid closing_reason_id values configured in your QRadar deployment before closing offenses.

Adding a Note to an Offense

{
  "integration_service": "ibm-qradar-siem",
  "resource": "siem",
  "operation": "createOffensesNotes",
  "parameters": {
    "offense_id": "{{offense_id}}",
    "note_text": "Investigated by {{analyst}}: confirmed malicious activity, initiating containment workflow."
  }
}

---

Example: Ariel Searches

Submitting an AQL Search

{
  "integration_service": "ibm-qradar-siem",
  "resource": "ariel",
  "operation": "createSearches",
  "parameters": {
    "query_expression": "SELECT sourceip, destinationip, eventcount FROM events WHERE category=5018 LAST 24 HOURS"
  }
}

Polling Search Status

After submitting a search, poll until the status is COMPLETED:

{
  "integration_service": "ibm-qradar-siem",
  "resource": "ariel",
  "operation": "getSearches",
  "parameters": {
    "search_id": "{{search_id}}"
  }
}

Retrieving Search Results

Once the search status is COMPLETED, retrieve the results:

{
  "integration_service": "ibm-qradar-siem",
  "resource": "ariel",
  "operation": "listSearchesResults",
  "parameters": {
    "search_id": "{{search_id}}",
    "range_start": 0,
    "range_end": 199
  }
}

---

Example: Reference Data

Adding an Entry to a Reference Map

{
  "integration_service": "ibm-qradar-siem",
  "resource": "reference_data",
  "operation": "updateMaps",
  "parameters": {
    "name": "known-bad-ips",
    "key": "{{suspicious_ip}}",
    "value": "confirmed-c2"
  }
}

Bulk-Loading Entries into a Reference Set

{
  "integration_service": "ibm-qradar-siem",
  "resource": "reference_data_collections",
  "operation": "patchSetEntries",
  "parameters": {
    "name": "malicious-domains",
    "entries": [
      {"value": "evil-c2.example.com"},
      {"value": "phishing-site.example.net"},
      {"value": "malware-drop.example.org"}
    ]
  }
}

Checking if a Reference Set Bulk Update Task Has Completed

After a bulk update, poll the task status using the returned task_id:

{
  "integration_service": "ibm-qradar-siem",
  "resource": "reference_data_collections",
  "operation": "getSetBulkUpdateTasks",
  "parameters": {
    "task_id": "{{task_id}}"
  }
}

---

Example: Network Lookup Services

Submitting a WHOIS Lookup

{
  "integration_service": "ibm-qradar-siem",
  "resource": "services",
  "operation": "createWhoisLookups",
  "parameters": {
    "ip": "{{suspicious_ip}}"
  }
}

Retrieving the WHOIS Result

{
  "integration_service": "ibm-qradar-siem",
  "resource": "services",
  "operation": "getWhoisLookups",
  "parameters": {
    "task_id": "{{task_id}}"
  }
}

Submitting a DNS Lookup

{
  "integration_service": "ibm-qradar-siem",
  "resource": "services",
  "operation": "createDnsLookups",
  "parameters": {
    "ip": "{{suspicious_ip}}"
  }
}

---

Common Workflow Patterns

1. Offense Investigation

1. siem.listOffenses — retrieve new open offenses filtered by severity or category
2. siem.getOffenses — retrieve full offense details including source and destination addresses
3. siem.listOffensesNotes — review any existing analyst notes on the offense
4. ariel.createSearches — submit an AQL query to pull correlated events from the offense time window
5. ariel.getSearches — poll until search status is COMPLETED
6. ariel.listSearchesResults — retrieve the matching events for deeper analysis
7. siem.createOffensesNotes — record investigation findings as a note
8. siem.updateOffenses — assign the offense to an analyst and set status to the appropriate state

2. AQL Threat Hunting

1. ariel.createValidatorsAql — validate the AQL expression before submission
2. ariel.createSearches — submit the threat hunting AQL query (e.g., for lateral movement, rare process executions)
3. ariel.getSearches — poll status until COMPLETED
4. ariel.listSearchesResults — retrieve matching events
5. reference_data.getMaps or reference_data_collections.getSets — cross-reference results against known-bad IOC reference data
6. siem.listOffenses — check whether any open offense correlates with the hunt results

3. IOC Enrichment via Reference Data

1. Receive an indicator (IP, domain, hash) from an upstream node or threat intelligence feed
2. reference_data.updateMaps — add the IOC to the appropriate reference map (e.g., known-bad-ips)
3. reference_data_collections.updateSets — add the IOC to the relevant reference set if rule correlation uses sets
4. reference_data_collections.getSetBulkUpdateTasks — poll bulk update task completion if using patchSetEntries
5. QRadar rules that reference the updated map or set will generate offenses automatically when matching events arrive
6. siem.listOffenses — poll for new offenses triggered by the updated reference data

---

Offense Field Reference

Offense Status Values

Value	Description
OPEN	Offense is active and under investigation or awaiting triage
HIDDEN	Offense is suppressed from the default view but remains in the system
CLOSED	Offense has been resolved; requires a closing_reason_id

Offense Severity Levels

QRadar assigns offenses a severity on a scale of 1–10:

• 1–3: Low severity — informational or low-risk events
• 4–6: Medium severity — notable activity warranting review
• 7–9: High severity — significant threat indicators
• 10: Critical severity — highest-priority offenses requiring immediate attention

Offense Closing Reasons

Closing reasons in QRadar are user-defined and deployment-specific. There is no fixed enum of standard values. Use the following operations to manage them:

• listOffenseClosingReasons — enumerate all available closing reasons configured in your QRadar deployment (pass include_reserved=true to include system-reserved reasons)
• createOffenseClosingReasons — create a new closing reason by providing a reason text string
• getOffenseClosingReasons — retrieve a specific closing reason by its closing_reason_id

Always retrieve the valid closing reason IDs from your QRadar deployment before attempting to close offenses in automated workflows.

---

Security Considerations

1. Protect SEC tokens: Store credentials exclusively through NINA's credential manager. Treat SEC tokens as passwords — never include them in workflow parameters, logs, comments, or source code. Rotate tokens regularly and set expiry dates on authorized service accounts.

2. Use dedicated authorized service accounts: Create a separate authorized service account for each integration or workflow with only the permissions it needs. This limits the blast radius if a token is compromised and provides a clear audit trail.

3. Restrict authorized service account capabilities: In QRadar, authorized service accounts inherit the permissions of the assigned user role. Create dedicated roles with minimum required capabilities — for example, a read-only role for investigation workflows and a separate role with write permissions only for offense management workflows.

4. Audit changes made through staged_config: Changes deployed via staged_config.createDeployStatus have direct and immediate operational impact on your QRadar environment. Implement workflow-level approval gates and log all deployment actions for audit purposes.

5. Review reference data write operations: Bulk load and delete operations on reference maps and sets (bulkLoadMaps, patchSetEntries, deleteSets, etc.) directly affect rule correlation. A misconfigured or malicious write can suppress legitimate offense generation or generate false positives. Restrict write access to reference data resources to only the workflows that require it.

---

Troubleshooting

Issue	Resolution
SEC token invalid or HTTP 401	Verify the token is correct and the authorized service account has not expired. Regenerate the token in Admin > Authorized Services if needed.
HTTP 403 Forbidden	The authorized service account lacks the required capability. Review the user role assigned to the service and add missing permissions.
HTTP 404 on a valid path	Check the QRadar version — some endpoints were introduced in specific API versions. Confirm your QRadar build supports the endpoint.
Range header error (HTTP 400 code 36)	range_start must be ≤ range_end and both must be non-negative integers.
Empty response on list operation	The page range is beyond the last item. Reduce range_start or check total count with a smaller range.
Async operation still QUEUED or IN_PROGRESS	Poll the corresponding task status operation (e.g., getAdeRulesAdeRuleDeleteTasks) until the status is COMPLETED before proceeding.
SSL/TLS certificate error	If the QRadar console uses a self-signed certificate, set the QRADAR_INSECURE_TLS environment variable to true to disable TLS verification. Use only in non-production environments.
NoPaging operation returns all records	Operations marked NoPaging do not accept range_start/range_end and always return the full result set. Do not pass range parameters to these operations.

---

Best Practices

1. Use dedicated authorized service accounts: Create a separate authorized service account for each integration with only the permissions it needs. This limits exposure if the token is compromised.

2. Rotate SEC tokens regularly: QRadar authorized service tokens can have an expiry date. Set reminders before expiry and update the NINA credential before the token expires to prevent workflow failures.

3. Poll async operations: Deletion and dependency operations are asynchronous. Always poll the corresponding task status endpoint until the status is COMPLETED before assuming the operation has finished.

4. Paginate large result sets: Default pagination returns items 0–49. Increase range_end or iterate pages using sequential range_start/range_end windows for large datasets.

5. Close offenses with a closing reason: Setting an offense status to CLOSED requires a valid closing_reason_id. Use listOffenseClosingReasons to enumerate available reasons before closing.

6. Use AQL saved searches for repeated queries: For frequently run Ariel queries, create saved searches via the ariel resource rather than submitting raw AQL each time. This avoids repeated parsing overhead and allows reuse across workflows.

7. Handle NoPaging results carefully: Endpoints marked NoPaging return the complete result set regardless of size. For endpoints like listLookups or listFunctions, be prepared to handle larger response payloads.

8. Validate AQL before submission: Use createProcessorsAqlMetadata or createValidatorsAql to parse and validate an AQL expression before submitting it as a search. This catches syntax errors without consuming search resources.

9. Stage before deploying: Changes made through the staged_config resource are staged, not immediately applied. Call createDeployStatus to push staged changes into production after all configuration changes are complete.

10. Check getAbout for version compatibility: Use system.getAbout to verify the QRadar API version before calling version-specific endpoints in automated workflows.

Updated: 2026-05-22