How to Use the IBM QRadar MCP in Claude

Q: How do I connect IBM QRadar to Claude Desktop?

You add the server details to your claudedesktopconfig.json file. Once you restart the app, the tools appear under the hammer icon in your chat input.

Q: Can I run AQL searches against IBM QRadar from Claude Desktop?

Yes. You trigger executeaql through the chat, and the agent handles the polling via getaqlstatus to fetch your results once the search finishes.

Q: Does Claude Desktop allow me to close IBM QRadar offenses?

You can use the updateoffense tool to modify offense status. It’s best to use this for adding context or ownership updates rather than mass-closing alerts.

Get live security insights inside Claude Desktop by connecting your IBM QRadar instance directly to your chat.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect IBM QRadar MCP to Claude Desktop

Create your Vinkius account to connect IBM QRadar to Claude Desktop and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup IBM QRadar with Claude Desktop

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Query security data in Claude Desktop

Stop switching windows to check logs. Use `execute_aql` to run searches directly from your conversation and pull the results with `get_aql_results`. You get the raw data inside your chat window. It’s faster than jumping into the console for every minor alert.

Manage offenses with Claude Desktop

Keep your incident response moving by calling `get_offenses` to see what’s currently hitting your queue. You can drill down into specific alerts using `get_offense_details`. When you need to act, `update_offense` lets you change status or add notes without leaving your workspace. It keeps your workflow focused on the threat, not the interface.

Map network context in Claude Desktop

Understand your environment by calling `get_network_hierarchy` to see how your segments align. You can also fetch `get_log_sources` to verify your data feeds. This keeps your investigation grounded in reality. You aren't guessing about asset placement while you’re analyzing a potential breach.

Setup guide

Set up IBM QRadar MCP in Claude Web or Desktop

1

Open Claude Settings

Go to claude.ai, click your profile icon, then navigate to Customize → Connectors.
2

Add Custom Connector

Click the "+" button and select Add custom connector. Paste your Vinkius endpoint URL: https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. For OAuth-protected servers, expand Advanced settings to add credentials.
3

Start a conversation

Open a new chat. The IBM QRadar MCP tools are available immediately — no restart needed.

Endpoint URL

https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp

No configuration file needed — paste the URL directly in the Claude web interface.

Available on Free (1 connector), Pro, Max, Team, and Enterprise plans.

Prerequisites

Claude Desktop installed (macOS or Windows)
Active Vinkius subscription with a valid endpoint token

1

Open Claude Desktop Settings

Click the menu icon at the top-left corner, go to Settings → Developer → Edit Config. This opens claude_desktop_config.json in your default text editor.
2

Paste the IBM QRadar MCP configuration

Copy the JSON snippet on the right into the mcpServers object. Replace [YOUR_TOKEN_HERE] with your endpoint token from cloud.vinkius.com.
3

Restart Claude Desktop

Close and reopen the application. Claude needs a full restart to load new MCPs — refreshing a conversation is not enough.
4

Verify the connection

Open a new conversation. Click the 🔌 icon at the bottom of the message input. You should see tools listed under ibm-qradar-mcp.

json

{
  "mcpServers": {
    "ibm-qradar-mcp": {
      "url": "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
    }
  }
}

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by IBM QRadar. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect IBM QRadar now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about IBM QRadar MCP in Claude Desktop

You add the server details to your claude_desktop_config.json file. Once you restart the app, the tools appear under the hammer icon in your chat input.

Yes. You trigger `execute_aql` through the chat, and the agent handles the polling via `get_aql_status` to fetch your results once the search finishes.

You can use the `update_offense` tool to modify offense status. It’s best to use this for adding context or ownership updates rather than mass-closing alerts.

Your API token is passed securely to the server process. Vinkius manages the endpoint, so your credentials stay out of your chat history.

The server only touches the specific offense and log metadata you request. No logs are stored or cached outside of your active session.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python