> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IBM QRadar

> Connect ThreatAware to IBM QRadar for enhanced security monitoring and device visibility

## Overview

The IBM QRadar integration enables ThreatAware to collect and monitor security data from your IBM QRadar environment, providing comprehensive visibility and threat detection capabilities.

<Info>
  **Connection Method**: API
  **Setup Time**: 15 minutes
  **Access Required**: IBM QRadar Administrator account
</Info>

## Setup instructions

<Steps>
  <Step title="Log in to IBM QRadar Console">
    * Access the [IBM QRadar Console](https://your-qradar-instance-url) using an account with administrator privileges.
  </Step>

  <Step title="Create an Authorized Service for API Access">
    * In the QRadar console, go to **Admin** > **Authorized Services**.
    * Click **Add Authorized Service** and create a new service specifically for ThreatAware integration.
    * Set the required permissions, typically **Read-only** for monitoring purposes, unless ThreatAware requires broader access.
    * Save and copy the **Service Token** generated.
  </Step>

  <Step title="Input API Token in ThreatAware">
    * Open ThreatAware, go to **Integrations**, and select **IBM QRadar**.
    * Enter the **Service Token** and **QRadar Console URL** in their respective fields.
  </Step>
</Steps>

## Required credentials

<AccordionGroup>
  <Accordion title="Service Token" icon="lock">
    Token created for API access in IBM QRadar.

    ```text theme={null}
    Field: Service Token
    Name: IBM QRadar Service Token
    Type: Password
    ```
  </Accordion>

  <Accordion title="QRadar Console URL" icon="user">
    URL of your IBM QRadar instance.

    ```text theme={null}
    Field: QRadar Console URL
    Name: QRadar URL
    Type: String
    Placeholder: "https://your-qradar-instance-url"
    ```
  </Accordion>
</AccordionGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Verification" icon="triangle-exclamation">
    In ThreatAware, ensure the **Integration Status** shows as **Active** after setup.
  </Accordion>

  <Accordion title="Troubleshooting" icon="triangle-exclamation">
    * **Invalid Token**: Verify that the Service Token is entered accurately.
    * **Permission Denied**: Ensure the Service Token has the necessary permissions configured for ThreatAware access in IBM QRadar.
  </Accordion>
</AccordionGroup>

## Important notes

* For more information on permissions and configuration, refer to the [IBM QRadar API Documentation](https://www.ibm.com/docs/en/qsip/).
* Keep the Service Token secure, as it allows access to IBM QRadar data.