This MCP server provides tools to query and manage IBM QRadar SIEM operational data and configurations via its REST API.
Verify QRadar console connectivity, authentication, and API health.
List, retrieve, update, and annotate offenses; list closing reasons.
Execute AQL searches, check search status, fetch paginated results, and list Ariel databases.
List, retrieve, add to, and delete from reference sets; manage reference maps; list reference tables.
List, inspect, and update detection rules; list building blocks.
Search and retrieve asset details.
List and inspect log sources.
List managed servers/appliances in the QRadar deployment.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type @ followed by the MCP server name and your instructions, e.g., "@IBM QRadar SIEM MCP Server Show me all open offenses from the last 24 hours sorted by severity"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP Server for IBM QRadar SIEM built on PyRadar with native TOON (Token-Oriented Object Notation) serialization.
Tối ưu hóa đặc biệt cho SIEM Engineer & SecOps Automation, giảm 50% – 60% token tiêu thụ cho LLM Agent khi làm việc với dữ liệu bảng (Log Sources, Network Hierarchy, AQL events, Reference Sets).
pip install -r requirements.txtBiến môi trường | Mặc định | Mô tả |
| (Bắt buộc) | IP hoặc Hostname của QRadar Console (vd: |
|
| SEC Token của QRadar API (hoặc dùng |
|
|
|
|
| Phiên bản REST API của QRadar (mặc định 26.0). |
|
| Định dạng dữ liệu trả về: |
|
| Phân quyền ghi theo domain: |
|
| Khóa an toàn cho các thao tác xóa hủy dữ liệu (DELETE). Cần bật |
Related MCP server: rapid7-mcp
audit_log_source_targets(targets, aql_lookback_hours=24): Rà soát danh sách IP/Host theo 7 trạng thái chuẩn: OK, Warning, Error, Not Available, Disabled, Undefined (đang rơi vào SIM Generic), Unknown (không có log source và không có traffic).
discover_sim_generic_ips(hours=24, min_events=5, sample_payloads=2): Tìm các IP đang đổ log vào SIM Generic (devicetype=105) kèm mẫu payload để xác định loại DSM.
batch_create_log_sources(specs, dry_run=True): Tạo hàng loạt Log Source tuân thủ chuẩn đặt tên <Đơn vị>-<Tên hệ thống>-<Hostname> @ <IP>. Hỗ trợ chế độ xem trước (Dry-Run).
get_log_sources_for_standardization(filter_expr="", only_non_compliant=False): Rà soát các Log Source chưa đạt chuẩn đặt tên hoặc chưa gán đúng nhóm.
preview_and_apply_standardization(updates, dry_run=True): Xem trước bảng TOON Diff (old_name $\to$ new_name, old_groups $\to$ new_groups) và áp dụng thay đổi hàng loạt.
list_network_hierarchy(staged=False, domain_id=None): Liệt kê danh sách Network Hierarchy (hỗ trợ xem cấu hình nháp staged=True và lọc theo domain_id).
evaluate_network_hierarchy_coverage(candidate_networks, sample_traffic_hours=24):
Phân vùng kiểm tra theo domain_id (cho phép trùng CIDR giữa các Domain khác nhau).
Phát hiện EXACT_DUPLICATE, SUPERNET_SUBNET_OVERLAP, và CONTIGUOUS_MERGEABLE trong cùng Domain.
Chạy AQL đo thực tế % Traffic Coverage của các IP nội bộ phát sinh sự kiện.
stage_network_hierarchy(networks, mode="merge", dry_run=True): Đẩy cấu hình an toàn vào staged_networks với chế độ xem trước diff.
list_reference_sets(filter_expr=""): Liệt kê các Reference Set kèm số lượng phần tử và TTL.
get_reference_set_values(name, range_header="0-499"): Bảng TOON chứa các giá trị với mốc thời gian xem lần cuối dạng tương đối (0.5h, 2.1d).
create_reference_set(name, element_type="ALNIC", time_to_live=None, timeout_type="LAST_SEEN"): Tạo Reference Set mới.
update_reference_set_values(name, action="add|remove|purge", values=[]): Thêm/xóa hàng loạt hoặc dọn sạch (purge) Reference Set.
run_aql_template(template_id, params={}): Chạy các câu AQL chuẩn hóa: sim_generic_sources, unparsed_event_samples, check_ips_last_event, eps_by_log_source, uncovered_hierarchy_ips.
lookup_aql_fields_and_ceps(keyword=""): Tra cứu các trường CEP có trên QRadar để viết AQL chính xác.
test_cep_regex_on_payloads(regex_str, capture_group=1, payloads=[]): Dùng Python re kiểm thử biểu thức Regex trực tiếp trên mẫu raw log trước khi cấu hình lên SIEM.
analyze_events_for_cep_recommendations(log_source_id, log_source_type_id): Lấy mẫu payload unparsed và đối chiếu với các CEPs hiện có của DSM để đề xuất trường mới.
upsert_custom_event_property(name, regex_str, ...): Tự động tạo/tái sử dụng property_expression và tạo binding regex_properties trên QRadar.
Resource: qradar://aql/reference: Cẩm nang tra cứu cú pháp và hàm AQL.
run_aql(query): Chạy AQL tùy ý, trả về bảng TOON.
list_offenses, get_offense: Tra cứu cảnh báo vi phạm.
list_endpoints, call_endpoint: Gọi trực tiếp toàn bộ 729 endpoints của qradar-sdk.
Thêm vào file cấu hình MCP client:
{
"mcpServers": {
"qradar": {
"command": "python",
"args": ["server.py"],
"env": {
"QRADAR_HOST": "qradar.example.com",
"QRADAR_TOKEN": "your-authorized-service-token",
"QRADAR_VERIFY_SSL": "false",
"QRADAR_OUTPUT_FORMAT": "toon",
"QRADAR_WRITE_SCOPES": "log_sources,network_hierarchy,reference_sets,ceps",
"QRADAR_ALLOW_DELETE": "false"
}
}
}
}Add an analyst note or investigation comments to an offense.
Args: offense_id: The ID of the offense. note_text: The content of the note.
Returns: JSON string confirming creation of the note.
Inputs: note_text (required), offense_id (required). Returns: result
Add an IoC or indicator (IP address, Domain, Hash, URL) into a Reference Set.
Args: name: The name of the target Reference Set. value: The value to insert (must conform to the set's element_type). source: Source label for audit trail (default: 'AI Agent Automation').
Returns: JSON string confirming addition of the element.
Inputs: name (required), value (required), source. Returns: result
Remove a specific value from a Reference Set.
Args: name: The name of the Reference Set. value: The value to remove.
Returns: JSON string confirming deletion.
Inputs: name (required), value (required). Returns: result
Execute an AQL (Ariel Query Language) search on QRadar logs or flows.
Args: query: The AQL query expression (e.g. "SELECT sourceip, destinationip, UTF8(payload) FROM events LAST 5 MINUTES LIMIT 50"). wait_for_completion: If True, polls the search until COMPLETED or timeout. If False, immediately returns the search_id. timeout_seconds: Maximum time to wait in seconds (defaults to settings.default_aql_wait_timeout). max_results: Number of records to return once completed (default: 50).
Returns: JSON string containing the search results or the search job status.
Inputs: query (required), max_results, timeout_seconds, wait_for_completion. Returns: result
Retrieve full details of a single asset by its Asset ID.
Args: asset_id: Unique integer ID of the asset.
Returns: JSON string containing comprehensive asset details (interfaces, IPs, MACs, OS products, users, vulnerability count).
Inputs: asset_id (required). Returns: result
Get full configuration details of a specific log source by ID.
Args: log_source_id: The ID of the log source.
Returns: JSON string containing log source properties (type, target collector, protocol, enabled status).
Inputs: log_source_id (required). Returns: result
Retrieve detailed information about a specific offense by its ID.
Args: offense_id: The ID of the offense to retrieve.
Returns: JSON string containing the offense details.
Inputs: offense_id (required). Returns: result
Retrieve key-value entries of a specific Reference Map.
Args: name: The exact name of the Reference Map. limit: Maximum number of entries to retrieve (default: 100). offset: Starting index for pagination (default: 0).
Returns: JSON string containing Reference Map metadata and key-value pairs.
Inputs: name (required), limit, offset. Returns: result
Retrieve metadata and entries of a specified Reference Set.
Args: name: The exact name of the Reference Set. limit: Maximum number of elements to retrieve (default: 100). offset: Starting index for pagination (default: 0).
Returns: JSON string containing reference set details and element data.
Inputs: name (required), limit, offset. Returns: result
Retrieve full details of a specific detection rule by its ID.
Args: rule_id: The ID of the rule to retrieve.
Returns: JSON string containing rule details (identifier, name, type, enabled status, owner).
Inputs: rule_id (required). Returns: result
Fetch records from a completed Ariel search job with pagination.
Args: search_id: The UUID of the search job. limit: Number of records to return (default: 50). offset: Offset start index for pagination (default: 0).
Returns: JSON string containing search result events or flows.
Inputs: search_id (required), limit, offset. Returns: result
Check current execution status and progress of an Ariel search job.
Args: search_id: The UUID of the search job.
Returns: JSON string containing progress percentage, status (WAIT, EXECUTE, COMPLETED), and record count.
Inputs: search_id (required). Returns: result
Verify connectivity to QRadar console, authentication validity, and API reachability.
Returns: JSON string containing connection status, configured host, and API test result.
Inputs: no named parameters. Returns: result
List all available Ariel databases in QRadar (e.g. events, flows, simarc).
Returns: JSON string containing list of Ariel database names.
Inputs: no named parameters. Returns: result
Search and list assets discovered by QRadar SIEM (by IP, Hostname, Vulnerability, etc.).
Args: filter_expr: Filter expression (e.g. 'interfaces contains (ip_addresses contains (value = "10.0.0.1"))' or 'risk_score_sum > 10'). sort_by: Sort expression, e.g. '-risk_score_sum' or '+id'. limit: Number of assets to return (default: 20). offset: Offset start index for pagination (default: 0).
Returns: JSON string containing matching assets with IP interfaces, hostnames, OS products, and risk score.
Inputs: limit, offset, sort_by, filter_expr. Returns: result
List Building Blocks (BBs) configured in QRadar SIEM.
Args: filter_expr: Optional filter expression (e.g. 'origin = "USER"'). limit: Maximum number of building blocks to return (default: 50). offset: Offset start index for pagination (default: 0).
Returns: JSON string containing building blocks.
Inputs: limit, offset, filter_expr. Returns: result
List all available offense closing reasons (e.g., False Positive, Resolved, Policy Violation).
Returns: JSON string of available closing reasons and their IDs.
Inputs: no named parameters. Returns: result
List log sources registered in QRadar SIEM with optional filtering and pagination.
Args: filter_expr: Filter expression, e.g. 'enabled = true' or 'name ILIKE "%firewall%"'. limit: Maximum number of log sources to retrieve (default: 50). offset: Starting index for pagination (default: 0).
Returns: JSON string containing list of log sources, protocol types, status, and last event times.
Inputs: limit, offset, filter_expr. Returns: result
List offenses from QRadar SIEM with optional filter, sorting, and pagination.
Args: filter_expr: Filter expression, e.g., 'status = "OPEN"' or 'magnitude >= 5'. sort_by: Sort field, prefix with '-' for descending, e.g., '-start_time', '+id'. limit: Number of offenses to retrieve (default: 20). offset: Offset start index for pagination (default: 0).
Returns: JSON string containing the list of offenses or error details.
Inputs: limit, offset, sort_by, filter_expr. Returns: result
List Reference Maps (key-value lookups) available in QRadar SIEM.
Args: filter_expr: Optional filter expression. limit: Maximum number of maps to return (default: 50). offset: Starting index for pagination (default: 0).
Returns: JSON string containing list of Reference Maps and metadata.
Inputs: limit, offset, filter_expr. Returns: result
List reference sets available in QRadar SIEM.
Args: filter_expr: Optional filter expression (e.g. 'element_type = "IP"'). limit: Maximum number of sets to return (default: 50). offset: Offset for pagination (default: 0).
Returns: JSON string containing list of reference sets with element type and TTL metadata.
Inputs: limit, offset, filter_expr. Returns: result
List Reference Tables (multi-column tables) available in QRadar SIEM.
Args: filter_expr: Optional filter expression. limit: Maximum number of tables to return (default: 50). offset: Starting index for pagination (default: 0).
Returns: JSON string containing list of Reference Tables.
Inputs: limit, offset, filter_expr. Returns: result
List correlation/detection rules in QRadar SIEM with optional filter and pagination.
Args: filter_expr: Filter expression, e.g. 'origin = "USER"', 'enabled = true', or 'type = "EVENT"'. limit: Maximum number of rules to return (default: 50). offset: Offset start index for pagination (default: 0).
Returns: JSON string containing matching rules and count.
Inputs: limit, offset, filter_expr. Returns: result
List all managed hosts / appliances in the QRadar deployment.
Returns: JSON string containing servers, hostnames, IP addresses, component types (Console, EP, EC, FP), and status.
Inputs: no named parameters. Returns: result
Update an offense status (e.g. CLOSED, OPEN, HIDDEN), closing reason, assignment or flags.
Args: offense_id: The ID of the offense to update. status: Target status: 'OPEN', 'CLOSED', or 'HIDDEN'. closing_reason_id: Required if closing the offense (see qradar_list_closing_reasons). assigned_to: Username of the analyst to assign this offense to. follow_up: Set flag for follow-up investigation (true/false). protected: Prevent the offense from being purged automatically (true/false).
Returns: JSON string containing updated offense details.
Inputs: offense_id (required), status, follow_up, protected, +2 more. Returns: result
Set or update a key-value entry in a Reference Map.
Args: name: The name of the target Reference Map. key: The lookup key. value: The value to associate with the key. source: Source label for audit trail.
Returns: JSON string confirming the update.
Inputs: key (required), name (required), value (required), source. Returns: result
Update detection rule settings: enable/disable rule or update its owner.
Args: rule_id: The ID of the rule. enabled: Set rule state to True (enabled) or False (disabled). owner: New owner username for the rule.
Returns: JSON string containing updated rule configuration.
Inputs: rule_id (required), owner, enabled. Returns: result
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
Scored across 27 tools
Each tool maps to a distinct QRadar resource/action: offenses, Ariel searches, reference sets/maps/tables, rules, assets, log sources, and health. Even the similar reference-data tools are clearly separated by resource type and operation.
The qradar_ prefix and verb_noun style are highly consistent across list/get/update/add/delete operations. Minor deviations like qradar_health_check and qradar_add_to_reference_set break the strict pattern slightly, but they remain readable and predictable.
At 27 tools, the server exceeds the 25-tool threshold for too many. While the QRadar domain is broad, many tools are parallel list/get pairs, making the overall surface heavier than necessary for agent selection.
Core workflows like offense triage, Ariel search, and reference-set enrichment are well covered. However, reference collections lack create/delete lifecycle operations, and rules, log sources, building blocks, and servers are mostly read-only, leaving notable gaps for full SIEM administration.
SOAR security playbooks for AI agents: fetch, full-text search, and count. Metered via Stripe.
Query your team's drift, vulnerability, and upgrade data from any AI assistant. OAuth 2.1, 51 tools.
Deltabridge brings an AI-native cyber threat intelligence platform into your AI agent. Search a knowledge graph of 200,000+ threat actors, malware families, vulnerabilities, indicators and campaigns, mapped to MITRE ATT&CK. Look up and enrich IOCs, trace links between entities and read living briefs built from 300+ open sources. Read-only, scoped to your organisation, with OAuth sign-in or an API key. Included on Researcher, Business and Enterprise plans.
Live threat intel for agents: incidents, actors, CVEs with KEV/EPSS, ransomware leak-site victims.
