Integrate with IBM QRadar

IBM QRadar is a network security management platform that provides situational awareness and compliance support. It combines flow-based network knowledge, security event correlation, and asset-based vulnerability assessment to deliver comprehensive security insights. By integrating QRadar with CloudDefense.ai, you can monitor and analyze vulnerabilities across your applications seamlessly.

Setting Up IBM QRadar Integration

Obtain the API Key from CloudDefense.ai:

• Log in to CloudDefense.ai and navigate to Profile Management.

• Copy your API key from the Profile Management page.

Open Dashboard Designer in QRadar:

• In your IBM QRadar platform, open the Dashboard Designer.

Add a Connector Source:

• In the navigation pane, go to Connector & Sources > Connector Sources.

• Click the Add Source button to open the Add Connector Source window.

Configure the QRadar Connector:

• From the Connector Type list, select QRadar Connector.

• In the Connector Source Name field, enter a name for the QRadar source. The source name can contain alphanumeric characters and underscores.

Enter the Endpoint URL:

• In the Endpoint URL field, enter the URL for the QRadar web service in the following format: https://console.clouddefenseai.com/api-v2/integrations/application/{application-id} 

• Replace {application-id} with the specific application ID to obtain a list of all vulnerabilities for that application.

Add API Key Header:

• Add a header with the key API key and paste the API key obtained from your CloudDefense.ai profile.

Finalize the Integration:

• Complete the configuration by clicking Save.

• Now, configure your parser/schema within IBM QRadar to access the key-value pairs from the JSON response.

Example JSON Schema

Below is an example schema that you can use to parse vulnerabilities data

For more detailed information, refer to IBM's official documentation. < https://www.ibm.com/docs/en/cabi/1.1.2?topic=products-configuring-qradar-connector-sources >

Benefits

• Comprehensive Monitoring: Monitor vulnerabilities across your applications directly within IBM QRadar.

• Enhanced Situational Awareness: Use flow-based network knowledge and security event correlation to gain a holistic view of your security posture.

• Customizable Alerts: Create custom alerts based on severity levels, status, and other key attributes.

By following these steps, you can integrate IBM QRadar with CloudDefense.ai to effectively monitor and respond to security vulnerabilities across your applications.