Sending Findings to QRadar

IBM QRadar is an enterprise Security Information and Event Management (SIEM) system. It collects log data from an enterprise and its network devices, host assets and operating systems, applications, vulnerabilities, and user activities and behaviors.

Configuring QRadar

  1. From IBM App Exchange, download and install the Dome9 QRadar application on a QRadar console or app host.

  2. In the QRadar admin console, create a new QRadar role that only specifies access to the Dome9 application.

  3. Create a new QRadar-authorized service that uses the role created in the previous step. Copy the Authentication Token for future use.

  4. Below the System Settings, in the Advanced menu, set the Max TCP Syslog Payload Length value to 16,384.

    If necessary, deploy the changes.

  5. Create a new integration through the Dome9 Settings:

    • Copy the Notifications HTTP Endpoint value for future use.

    • (Optional) Provide the CloudGuard API credentials for the integration. With these credentials, you can acknowledge findings or create exclusions directly in QRadar.

Configuring CloudGuard

  1. In CloudGuard, navigate to Settings > Notifications and click Add Notification.

  2. Enter the applicable options as described in Notifications.

  3. In the Immediate Notification section, select Send to HTTP Endpoint. The section of endpoint parameters opens.


  4. Set the endpoint parameters:

    • Below the Endpoint URL, select QRadar and paste the endpoint value you copied in step 5 of the QRadar configuration.

    • Enter the Authentication Token value created in step 3 of the QRadar configuration as the password.

    • Click the Test button to check the integration connectivity. If it is correct, you see the message that the Webhook test succeeded.

  5. Click Save.

Testing the Integration

  1. In QRadar, make sure that Dome9 notifications show in the QRadar events database.

  2. Make sure that custom properties are populated as expected in a sample event.

  3. Browse events in the viewer in the Dome9 QRadar application.