IBM QRadar SIEM MCP Server
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| QRADAR_HOST | Yes | The hostname or IP address of the QRadar Console. | |
| QRADAR_PORT | No | The port of the QRadar Console (default 443). | 443 |
| QRADAR_SEC_TOKEN | Yes | Your authorized service token for QRadar API authentication. | |
| DEFAULT_PAGE_SIZE | No | Default page size for list results. | 50 |
| QRADAR_VERIFY_SSL | No | Whether to verify SSL certificate (true/false). Set to false for self-signed internal SSL. | false |
| QRADAR_API_VERSION | No | The QRadar API version. | 26.0 |
| DEFAULT_AQL_WAIT_TIMEOUT | No | Default timeout in seconds for AQL search polling. | 60 |
| DEFAULT_AQL_POLL_INTERVAL | No | Default poll interval in seconds for AQL search status checks. | 2 |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
| experimental | {} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| qradar_health_checkA | Verify connectivity to QRadar console, authentication validity, and API reachability. Returns: JSON string containing connection status, configured host, and API test result. |
| qradar_list_offensesA | List offenses from QRadar SIEM with optional filter, sorting, and pagination. Args: filter_expr: Filter expression, e.g., 'status = "OPEN"' or 'magnitude >= 5'. sort_by: Sort field, prefix with '-' for descending, e.g., '-start_time', '+id'. limit: Number of offenses to retrieve (default: 20). offset: Offset start index for pagination (default: 0). Returns: JSON string containing the list of offenses or error details. |
| qradar_get_offenseB | Retrieve detailed information about a specific offense by its ID. Args: offense_id: The ID of the offense to retrieve. Returns: JSON string containing the offense details. |
| qradar_add_offense_noteA | Add an analyst note or investigation comments to an offense. Args: offense_id: The ID of the offense. note_text: The content of the note. Returns: JSON string confirming creation of the note. |
| qradar_update_offenseA | Update an offense status (e.g. CLOSED, OPEN, HIDDEN), closing reason, assignment or flags. Args: offense_id: The ID of the offense to update. status: Target status: 'OPEN', 'CLOSED', or 'HIDDEN'. closing_reason_id: Required if closing the offense (see qradar_list_closing_reasons). assigned_to: Username of the analyst to assign this offense to. follow_up: Set flag for follow-up investigation (true/false). protected: Prevent the offense from being purged automatically (true/false). Returns: JSON string containing updated offense details. |
| qradar_list_closing_reasonsA | List all available offense closing reasons (e.g., False Positive, Resolved, Policy Violation). Returns: JSON string of available closing reasons and their IDs. |
| qradar_execute_aql_searchA | Execute an AQL (Ariel Query Language) search on QRadar logs or flows. Args: query: The AQL query expression (e.g. "SELECT sourceip, destinationip, UTF8(payload) FROM events LAST 5 MINUTES LIMIT 50"). wait_for_completion: If True, polls the search until COMPLETED or timeout. If False, immediately returns the search_id. timeout_seconds: Maximum time to wait in seconds (defaults to settings.default_aql_wait_timeout). max_results: Number of records to return once completed (default: 50). Returns: JSON string containing the search results or the search job status. |
| qradar_get_search_statusA | Check current execution status and progress of an Ariel search job. Args: search_id: The UUID of the search job. Returns: JSON string containing progress percentage, status (WAIT, EXECUTE, COMPLETED), and record count. |
| qradar_get_search_resultsA | Fetch records from a completed Ariel search job with pagination. Args: search_id: The UUID of the search job. limit: Number of records to return (default: 50). offset: Offset start index for pagination (default: 0). Returns: JSON string containing search result events or flows. |
| qradar_list_ariel_databasesA | List all available Ariel databases in QRadar (e.g. events, flows, simarc). Returns: JSON string containing list of Ariel database names. |
| qradar_list_reference_setsA | List reference sets available in QRadar SIEM. Args: filter_expr: Optional filter expression (e.g. 'element_type = "IP"'). limit: Maximum number of sets to return (default: 50). offset: Offset for pagination (default: 0). Returns: JSON string containing list of reference sets with element type and TTL metadata. |
| qradar_get_reference_setA | Retrieve metadata and entries of a specified Reference Set. Args: name: The exact name of the Reference Set. limit: Maximum number of elements to retrieve (default: 100). offset: Starting index for pagination (default: 0). Returns: JSON string containing reference set details and element data. |
| qradar_add_to_reference_setA | Add an IoC or indicator (IP address, Domain, Hash, URL) into a Reference Set. Args: name: The name of the target Reference Set. value: The value to insert (must conform to the set's element_type). source: Source label for audit trail (default: 'AI Agent Automation'). Returns: JSON string confirming addition of the element. |
| qradar_delete_from_reference_setA | Remove a specific value from a Reference Set. Args: name: The name of the Reference Set. value: The value to remove. Returns: JSON string confirming deletion. |
| qradar_list_reference_mapsB | List Reference Maps (key-value lookups) available in QRadar SIEM. Args: filter_expr: Optional filter expression. limit: Maximum number of maps to return (default: 50). offset: Starting index for pagination (default: 0). Returns: JSON string containing list of Reference Maps and metadata. |
| qradar_get_reference_mapA | Retrieve key-value entries of a specific Reference Map. Args: name: The exact name of the Reference Map. limit: Maximum number of entries to retrieve (default: 100). offset: Starting index for pagination (default: 0). Returns: JSON string containing Reference Map metadata and key-value pairs. |
| qradar_update_reference_mapA | Set or update a key-value entry in a Reference Map. Args: name: The name of the target Reference Map. key: The lookup key. value: The value to associate with the key. source: Source label for audit trail. Returns: JSON string confirming the update. |
| qradar_list_reference_tablesA | List Reference Tables (multi-column tables) available in QRadar SIEM. Args: filter_expr: Optional filter expression. limit: Maximum number of tables to return (default: 50). offset: Starting index for pagination (default: 0). Returns: JSON string containing list of Reference Tables. |
| qradar_list_rulesA | List correlation/detection rules in QRadar SIEM with optional filter and pagination. Args: filter_expr: Filter expression, e.g. 'origin = "USER"', 'enabled = true', or 'type = "EVENT"'. limit: Maximum number of rules to return (default: 50). offset: Offset start index for pagination (default: 0). Returns: JSON string containing matching rules and count. |
| qradar_get_ruleA | Retrieve full details of a specific detection rule by its ID. Args: rule_id: The ID of the rule to retrieve. Returns: JSON string containing rule details (identifier, name, type, enabled status, owner). |
| qradar_update_ruleA | Update detection rule settings: enable/disable rule or update its owner. Args: rule_id: The ID of the rule. enabled: Set rule state to True (enabled) or False (disabled). owner: New owner username for the rule. Returns: JSON string containing updated rule configuration. |
| qradar_list_building_blocksA | List Building Blocks (BBs) configured in QRadar SIEM. Args: filter_expr: Optional filter expression (e.g. 'origin = "USER"'). limit: Maximum number of building blocks to return (default: 50). offset: Offset start index for pagination (default: 0). Returns: JSON string containing building blocks. |
| qradar_list_assetsA | Search and list assets discovered by QRadar SIEM (by IP, Hostname, Vulnerability, etc.). Args: filter_expr: Filter expression (e.g. 'interfaces contains (ip_addresses contains (value = "10.0.0.1"))' or 'risk_score_sum > 10'). sort_by: Sort expression, e.g. '-risk_score_sum' or '+id'. limit: Number of assets to return (default: 20). offset: Offset start index for pagination (default: 0). Returns: JSON string containing matching assets with IP interfaces, hostnames, OS products, and risk score. |
| qradar_get_assetA | Retrieve full details of a single asset by its Asset ID. Args: asset_id: Unique integer ID of the asset. Returns: JSON string containing comprehensive asset details (interfaces, IPs, MACs, OS products, users, vulnerability count). |
| qradar_list_log_sourcesA | List log sources registered in QRadar SIEM with optional filtering and pagination. Args: filter_expr: Filter expression, e.g. 'enabled = true' or 'name ILIKE "%firewall%"'. limit: Maximum number of log sources to retrieve (default: 50). offset: Starting index for pagination (default: 0). Returns: JSON string containing list of log sources, protocol types, status, and last event times. |
| qradar_get_log_sourceA | Get full configuration details of a specific log source by ID. Args: log_source_id: The ID of the log source. Returns: JSON string containing log source properties (type, target collector, protocol, enabled status). |
| qradar_list_serversA | List all managed hosts / appliances in the QRadar deployment. Returns: JSON string containing servers, hostnames, IP addresses, component types (Console, EP, EC, FP), and status. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 27 tools
Each tool maps to a distinct QRadar resource/action: offenses, Ariel searches, reference sets/maps/tables, rules, assets, log sources, and health. Even the similar reference-data tools are clearly separated by resource type and operation.
The qradar_ prefix and verb_noun style are highly consistent across list/get/update/add/delete operations. Minor deviations like qradar_health_check and qradar_add_to_reference_set break the strict pattern slightly, but they remain readable and predictable.
At 27 tools, the server exceeds the 25-tool threshold for too many. While the QRadar domain is broad, many tools are parallel list/get pairs, making the overall surface heavier than necessary for agent selection.
Core workflows like offense triage, Ariel search, and reference-set enrichment are well covered. However, reference collections lack create/delete lifecycle operations, and rules, log sources, building blocks, and servers are mostly read-only, leaving notable gaps for full SIEM administration.