# IBM QRadar MCP for AI Agents AI Agent Connect > IBM QRadar MCP connects your security operations to your AI agent. It lets you query logs, manage offenses, and inspect network hierarchies using natural language. Instead of manually writing complex queries, you can ask your agent to find specific threats or summarize active security events directly from your QRadar instance. It handles the heavy lifting so you don't have to remember the exact syntax every time you need to hunt for a needle in a haystack. ## Overview - **Category:** industry-titans - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/ai-agent-connect ## Description IBM QRadar lets you treat your security operations like a searchable knowledge base for your AI agent. You can ask it to pull specific log sources, check the status of a long-running query, or get the full story on a high-priority offense. It handles the heavy lifting of complex query syntax, so you don't have to remember the exact rules every time you need to hunt for a needle in a haystack. Whether you're looking for specific correlation rules or need to update an offense status on the fly, your agent does the digging. It's one of the many tools available in the Vinkius catalog that turns a massive security database into a conversational interface for your security team. You get answers in plain English instead of staring at raw log streams all day. Instead of manual log hunting, you can just describe the threat you're looking for. The Connector takes that request and translates it into the correct query for your environment. It pulls the data and presents it back to you in a summarized format, highlighting the most relevant details like source IPs, timestamps, and severity levels. This means you spend less time wrestling with the console and more time actually responding to threats. You can even use it to audit your current setup, checking your network hierarchy or listing all your active log sources to ensure everything is mapped correctly. It's a significant shift from manual data entry to conversational intelligence. By connecting your QRadar instance through Vinkius, you're giving your security team a way to query massive datasets without the usual friction of complex syntax or multiple tab switching. ## Tools ### get_log_sources List all the different log sources currently active in your QRadar instance. Use this to see your full security coverage. ### get_network_hierarchy View your QRadar network hierarchy to see how assets are organized. This provides a quick overview of your network structure. ### get_offense_details Pull specific information and context for a single QRadar offense. It gives you a summary of a threat without clicking through the UI. ### get_reference_sets See the different reference sets you have configured in QRadar. This helps you understand what data is being used for filtering. ### get_rules List your correlation rules to see what's currently monitoring your network. Use this to audit your active security logic. ### execute_aql Run an Ariel Query Language search and get a search ID for the results. This lets you start a deep dive into your logs using natural language. ### get_offenses List all current offenses to see what's currently triggering alerts. This is perfect for a quick overview of your current threat landscape. ### update_offense Change the status or details of an existing QRadar offense. This allows you to manage incidents directly from your chat window. ### get_aql_results Fetch the data from a completed AQL search using its unique ID. Use this to see the final output of a long-running query. ### get_aql_status Check if a long-running AQL query is finished or still processing. This helps you keep track of large data requests. ## Prompt Examples **Prompt:** ``` Show me all active offenses from the last 2 hours. ``` **Response:** ``` I've pulled the current offenses for the last 120 minutes. Here is a summary: | Offense ID | Severity | Status | Description | | :--- | :--- | :--- | :--- | | 8821 | High | Open | Brute force attempt on HR portal | | 9042 | Medium | Open | Suspicious login from known VPN | | 9115 | Low | Closed | Port scan detected | Let me know if you want more details on any of these. ``` **Prompt:** ``` What's the status of the search I just ran for brute force? ``` **Response:** ``` The search is currently 85% complete. It's processing a large volume of logs from the 'Auth_Logs' source. I'll let you know as soon as it's ready for review. ``` **Prompt:** ``` List our log sources and tell me if we have any from the HR subnet. ``` **Response:** ``` Here are your current log sources: * Firewall_Logs * VPN_Logs * HR_Subnet_Logs * Guest_WiFi_Logs * Endpoint_Telemetry Yes, I see 'HR_Subnet_Logs' active in your hierarchy. ``` ## Capabilities ### Run complex AQL queries via natural language Ask your agent to find specific security events using plain English instead of manual query writing. ### Track the progress of long-running search jobs Check if a large data request is still processing or ready for review. ### Pull details on specific security offenses Get a summarized view of high-priority alerts without navigating the full console. ### List and filter your active log sources See all your active log streams in one place to verify your security coverage. ### Update offense statuses without opening the console Change the status or add notes to security events directly through your AI chat. ### Browse your network hierarchy and rules Audit your correlation rules and network organization using conversational commands. ## Use Cases ### Rapid threat triage during a traffic spike A SOC analyst sees a spike in traffic and asks the agent to run an AQL search for the last hour of logs from a specific source. The agent pulls the data and summarizes the source IPs and timestamps for a quick look. ### Summarizing active alerts for shift handovers A threat hunter needs to see all active alerts and uses `get_offenses` to get a summary of everything currently firing. This helps them prioritize which threats need immediate attention first. ### Auditing correlation rules for compliance An engineer needs to check if a rule is active and asks the agent to list correlation rules to find the one for 'Brute Force'. The agent provides the rule status and details instantly. ### Updating incident status during an active response An incident responder needs to close an alert and tells the agent to use `update_offense` to mark a specific event as resolved. This saves them from having to open the full console to click a button. ## Benefits - Skip the AQL syntax: Use `execute_aql` to run searches without memorizing complex query language rules. You can just describe what you're looking for in plain English and let the agent handle the formatting for you. - Faster triage: Get immediate details on threats with `get_offense_details` instead of clicking through the UI. This lets you see the most important information for an incident in a single summary. - Real-time updates: Modify security events instantly using `update_offense` while chatting with your agent. You can change statuses or add notes without ever leaving your conversation window. - Better visibility: Browse your `get_network_hierarchy` and `get_log_sources` to map out your security posture. It helps you see exactly what is being monitored and how your assets are organized. - Rule auditing: Quickly check your `get_rules` to see what is currently monitoring your network. This makes it much easier to verify that your correlation logic is still accurate and effective. ## How It Works The bottom line is you get to stop writing manual queries and start asking questions about your security data. 1. Connect your QRadar instance credentials to the Connector via Vinkius. 2. Tell your AI client to find a specific security event or list log sources. 3. The agent executes the query and presents the results in a readable summary. ## Frequently Asked Questions **Can the IBM QRadar MCP run my custom AQL queries?** Yes, it translates your natural language into AQL queries. You can describe what you're looking for, and the agent handles the syntax. **How does this help with faster incident response?** It pulls offense details instantly. Instead of clicking through the console, your agent can summarize the most important information for you. **Can I update an offense status through the AI?** Yes, you can tell your agent to update an offense, and it will modify the status or details directly in QRadar. **Does this Connector support all my QRadar log sources?** It lists all the log sources currently active in your instance, so you can query any of them via your AI client. **Is my security data safe with this Connector?** Your agent uses your existing credentials to interact with the data. It doesn't store your logs; it just fetches them as you ask. **Can I check my correlation rules?** Yes, you can ask your agent to list your correlation rules to see what's currently monitoring your network.