IBM SmartCloud Orchestrator

The IBM® QRadar® DSM for IBM SmartCloud® Orchestrator collects audit logs from the SmartCloud Orchestrator system.

The following table identifies specifications for the IBM SmartCloud Orchestrator DSM.

Table 1. IBM SmartCloud Orchestrator specifications
Specification Value
Manufacturer IBM
DSM name SmartCloud Orchestrator
RPM file name DSM-IBMSmartCloudOrchestrator-Qradar_version_build number.noarch.rpm
Supported versions V2.3 FP1 and later
Protocol type

IBM SmartCloud Orchestrator REST API
QRadar recorded event types

Audit Records
Log source type in the QRadar UI IBM SmartCloud Orchestrator
Automatically discovered? No
Includes identity? Yes
Includes custom properties No
More information http://ibm.com

To integrate IBM SmartCloud Orchestrator with QRadar, complete the following steps:

  1. If automatic updates are not enabled, download and install the most recent version of the following RPMS from the IBM Support Website onto your QRadar Console:
    • IBM SmartCloud Orchestrator RPM
    • IBM SmartCloud Orchestrator RESTAPI protocol RPM
  2. Create an IBM SmartCloud Orchestrator log source on the QRadar Console. Use the following values for the SmartCloud-specific parameters:
    Parameter Description
    Log Source Type IBM SmartCloud Orchestrator.
    Protocol Configuration IBM SmartCloud Orchestrator REST API
    IP or Hostname The IP address or server name of the SmartCloud Orchestrator.

No action is required on the IBM SmartCloud Orchestrator system. After you create the log source, QRadar starts collecting logs from IBM SmartCloud Orchestrator.