Configuring IBM QRadar Connector Sources

Use QRadar Connector to connect to QRadar® REST-compliant services. QRadar Connector is a built-in connector and uses REST API for data retrieval.

Before you begin

  • Ensure that the web service that you want to connect is up and running.
  • For the sample request, if you need to provide custom headers, then ensure that you have that information available with you. Custom headers are request headers that are needed to retrieve REST API information from a web service. For example, Authorization request headers or Accept-Charset request headers. Authorization request headers contain authorization information that is required by the REST services. Accept-Charset indicates the acceptable data characters that the response must contain.

Procedure

Complete the following steps to add QRadar REST-compliant services by using QRadar Connector:

  1. Open Dashboard Designer.
  2. In the navigation pane, go to Connector & Sources > Connector Sources.
  3. On the All Connector Sources page, click Add Source.

    An Add Connector Source window is displayed.

  4. From the Connector Type list, select QRadar Connector.
  5. In the Connector Source Name field, enter a name for QRadar source.

    Source name can contain alphanumeric characters and underscores.

  6. In the Endpoint URL field, enter URL details for QRadar web service in the following format:

    https://server_IP_or_HOSTNAME/api

    Where, server_IP_or_HOSTNAME is the IP address or hostname of the server where the web service is hosted.

  7. From the Authentication Type list, select None or Basic Authentication based on whether username and password are configured during the installation of the web service.
    If you select Basic Authentication, then you must complete the following steps:
    1. In the User Name field, enter a username that is used during the configuration of the web service.
    2. In the Password field, enter a password that is used during the configuration of the web service.
  8. Click Next.
  9. From the Method list, select GET method, and in the URI field, enter the uniform resource identified (URI) for QRadar source.
    For example, URI

    Where, URI is the resource URI.

    For more information about URI formats, see IBM® QRadar RESTful API overview.

  10. Optional: Under Custom Headers, complete the following steps:
    • In the Name field, enter the request header name that is provided by the REST API web service provider.
    • In the Value field, enter the request header value that is provided by the REST API web service provider.

    To add more custom headers, click Add Another, and repeat the earlier steps.

  11. To make sure that the connection to QRadar data source is successful, click Test Connection.
    If the source details and the sample request are valid and complete, then a message to indicate that the connection is successful is displayed. For connection failure messages, you must fix the errors that are mentioned in the messages and test the connection again.
    Note: Even if the source details are valid, a connection failure message might be displayed due to an invalid response received for the sample request.
  12. Click Save.

Results

The All Connector Sources page displays the following details for each connector source:
  • Connector source name
  • Connector type
  • Date and time when the connector source was first created, and the username of the user who first created the source.
  • Date and time when the connector source was last modified, and the username of the user who last modified the connector source. Only the latest record is displayed.
The QRadar web service is added and can be used to create your custom data definitions.