QRadar MCP Server

Model Context Protocol (MCP) server for IBM QRadar SIEM — Access 728+ QRadar REST API endpoints through just 4 intelligent MCP tools.

---

Table of Contents

• Overview
• What You Can Do
• Architecture
• Getting Started
• MCP Client Configuration
• Security
• Using the MCP Server
• Configuration Reference
• Build from Source
• Resources
• Support
• IBM Public Repository Disclosure

---

Overview

QRadar MCP Server bridges Large Language Models (LLMs) and IBM QRadar SIEM. Instead of exposing 728 API endpoints as separate tools (which would overwhelm any LLM context window), this server consolidates them into 4 intelligent tools — achieving a 96% reduction in token usage.

Works with any MCP-compatible client: Claude Desktop, IBM Bob, or custom AI agents.

Supported QRadar API Categories (728 endpoints)

SIEM (offenses, sources, destinations) · Assets (model, vulnerabilities) · Analytics (rules, building blocks) · Ariel (AQL queries, searches) · Reference Data (sets, maps, collections) · Config (domains, log sources, users) · System (health, licensing, servers)

---

What You Can Do

Ask your AI assistant to interact with QRadar SIEM using natural language — no API calls, no console navigation:

• “Show me the top 10 open offenses”
• “Search for failed login events from external IPs in the last hour”
• “What assets are in my network inventory?”
• “Create an Ariel AQL search for DNS queries to suspicious domains”
• “List all active custom rules”
• “Add 192.168.1.100 to the suspicious IPs reference set”
• “What QRadar API endpoints are available for offense management?”

Authentication happens automatically — the server uses your QRadar API token for every request. No credentials in your prompts, ever.

---

Architecture

How It Works

%%{init: {'theme': 'default'}}%%
flowchart TB
    A(["🤖 AI Assistant"])
    B{{"⚙️ MCP Server"}}
    D[["🌐 QRadar Console"]]
    QR[/"📦 REST API v26.0+"\]

    A -->|"① API Key (Bearer header)"| B
    B -->|② Validate API Key| B
    B -->|③ Attach SEC Token| B
    B -->|④ HTTPS Request| D
    D -->|⑤ Route to Endpoint| QR
    QR -.->|⑥ JSON Data| D
    D -.->|⑦ Forward Response| B
    B -.->|⑧ AI Response| A

    style A fill:#e1f5fe,stroke:#01579b
    style B fill:#fff3e0,stroke:#e65100
    style D fill:#e8f5e9,stroke:#1b5e20
    style QR fill:#f3e5f5,stroke:#4a148c

Tool Workflow