Configuring a QRadar Suite data source in Grafana

Edit online

Configure an external data source for IBM® Security QRadar® Suite in your Grafana instance to communicate with QRadar Suite.

Before you begin

Verify that the IBM Security QRadar Suite KQL Plugin is installed.
  1. In your Grafana instance, from the navigation menu, click Administration > Plugins.
  2. In the Search field, enter IBM Security QRadar Suite. The status of your IBM Security QRadar Suite KQL Plugin is displayed.
  3. For more information about the IBM Security QRadar Suite KQL Plugin, click the IBM Security QRadar Suite tile.

To configure a QRadar Suite data source in Grafana, you must complete the following tasks:

  • Obtain your QRadar Suite cluster URL from your QRadar Suite instance.
  • Collaborate with a QRadar Suite administrator to obtain a QRadar Suite Grafana user API Key and user API Secret.

  • Collaborate with a QRadar Suite administrator to obtain a QRadar Suite account ID.

Procedure

  1. In your Grafana instance, from the navigation menu, click Administration > Data Sources.
  2. On the Data sources page, click Add new data source.
  3. In the Filter by name or type field, enter IBM Security QRadar Suite, and then select the IBM Security QRadar Suite tile.
  4. In the Host field, enter your QRadar Suite cluster URL.
  5. In the API Key field, enter your QRadar Suite Grafana user API Key.
  6. In the API Secret field, enter your QRadar Suite Grafana user API Secret.
  7. In the Account ID field, enter your QRadar Suite account ID.
  8. In the Plugin Timeout field, enter a response timeout limit for all queries that are sent by this data source. Timeout value format is xxhxxmxxs (default is 5m).
  9. Click Save & Test.
    If your configuration is successful, a Data source is working message is displayed.