How to Use the IBM QRadar MCP in LlamaIndex

Q: How does LlamaIndex index IBM QRadar offenses for semantic search?

The framework uses getoffenses and getoffensedetails to fetch the raw JSON payloads of active security alerts. LlamaIndex then splits and embeds this text, storing it in your vector database so you can query past QRadar events using natural language.

Q: Can I use LlamaIndex to query IBM QRadar reference sets?

Yes, the agent calls getreferencesets to pull down your active watchlists and IP blocks. This data is indexed directly into your RAG pipeline, ensuring your agent always knows which IPs are marked as malicious.

Q: How does LlamaIndex handle large Ariel log results from IBM QRadar?

The agent executes the query using executeaql and monitors it with getaqlstatus. Once getaqlresults returns the logs, LlamaIndex chunks the data dynamically to prevent token overflow before indexing it.

Q: Where is my IBM QRadar network hierarchy data stored?

Network configurations retrieved via getnetworkhierarchy are processed in memory and sent directly to your configured vector store. Vinkius operates a zero-trust sandbox, meaning your network topology is never cached or stored on our infrastructure.

Index IBM QRadar security logs and offenses into your LlamaIndex vector store for semantic, hallucination-free search.

See Vinkius in Action

Works with every AI agent you already use

…and any MCP-compatible client

MCP Servers - Free for Subscribers

Connect IBM QRadar MCP to LlamaIndex

Create your Vinkius account to connect IBM QRadar to LlamaIndex and route execution through our secure gateway. The platform manages server hosting, runtime updates, and security layers. Configuration requires no manual server provisioning.

GDPR Free for Subscribers

Setup IBM QRadar with LlamaIndex

Ask AI about this MCP

ChatGPT

Claude

Perplexity

Build a searchable knowledge base of QRadar offenses

This LlamaIndex integration uses the MCP Server to index live security data directly into your vector store. Your agent uses `get_offenses` and `get_offense_details` to pull raw security events, which LlamaIndex then parses and embeds. You can query past incidents semantically instead of writing complex search queries. By feeding this data into your RAG pipeline, your agent gets access to actual, historical security events. When a new threat emerges, the agent compares it against indexed QRadar data to see if you have faced a similar attack vector before.

Semantic search over Ariel log query results via MCP Server

Raw logs are hard to parse, but this MCP Server makes it simple. Your LlamaIndex agent runs `execute_aql` to pull logs, waits for the status via `get_aql_status`, and gets the raw results with `get_aql_results`. Once the logs are in, LlamaIndex indexes the payload. Your agent can then perform semantic searches over the raw log text, helping you find anomalous behavior without manually filtering thousands of syslogs.

Ground security decisions in live network context

Avoid agent hallucinations by grounding your system in actual network data via MCP. The agent pulls live network configurations using `get_network_hierarchy` and correlates them with correlation rules from `get_rules`. This structured context is indexed alongside your active offenses. When you ask your LlamaIndex agent why a specific offense was flagged, it answers using real-time rule definitions and network boundaries, not trained guesses.

Setup guide

Set up IBM QRadar MCP in LlamaIndex

Prerequisites

Python 3.10+ installed
llama-index-tools-mcp package
Active Vinkius subscription with a valid endpoint token

1

Install dependencies
Run pip install llama-index-tools-mcp llama-index-llms-openai. The MCP tools package provides BasicMCPClient and McpToolSpec.
2

Connect with BasicMCPClient
Point BasicMCPClient to your Vinkius endpoint URL. Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. Supports SSE and Streamable HTTP transports.
3

Convert to LlamaIndex tools
Call mcp_tool_spec.to_tool_list_async() to convert all IBM QRadar MCP tools into native FunctionTool objects that any LlamaIndex agent can use.
4

Run with any LLM
Create a FunctionAgent with the tools and your preferred LLM. Swap OpenAI for Anthropic, Gemini, or any LlamaIndex-supported provider.

agent.py

from llama_index.tools.mcp import BasicMCPClient, McpToolSpec
from llama_index.core.agent.workflow import FunctionAgent
from llama_index.llms.openai import OpenAI

# Connect to the MCP
mcp_client = BasicMCPClient(
    "https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp"
)
mcp_tool_spec = McpToolSpec(client=mcp_client)

# Convert MCP tools to LlamaIndex tools
tools = await mcp_tool_spec.to_tool_list_async()

# Create and run the agent
agent = FunctionAgent(
    tools=tools,
    llm=OpenAI(model="gpt-4o"),
    system_prompt="You have access to IBM QRadar tools.",
)
response = await agent.run("List recent IBM QRadar data")

Get your connection token →

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by IBM QRadar. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

Why Choose Vinkius

Vinkius connects your tools to AI with real-time monitoring and automatic cost savings — all from one dashboard.

Connect IBM QRadar now

Real-time monitoring

Live

visibility into every interaction

Connect your favorite tools to your AI and see exactly what's happening — every request, every response, in real time.

Built-in savings

60%

lower AI costs

Vinkius compresses data between your apps and your AI automatically. Lower bills every month — no configuration required.

Single dashboard

One

place for every integration

Every tool your AI connects to, managed from a single screen. One account, complete control.

Common questions about IBM QRadar MCP in LlamaIndex

The framework uses `get_offenses` and `get_offense_details` to fetch the raw JSON payloads of active security alerts. LlamaIndex then splits and embeds this text, storing it in your vector database so you can query past QRadar events using natural language.

Yes, the agent calls `get_reference_sets` to pull down your active watchlists and IP blocks. This data is indexed directly into your RAG pipeline, ensuring your agent always knows which IPs are marked as malicious.

The agent executes the query using `execute_aql` and monitors it with `get_aql_status`. Once `get_aql_results` returns the logs, LlamaIndex chunks the data dynamically to prevent token overflow before indexing it.

No, you simply initialize the basic MCP client and register the tools with `McpToolSpec`. This instantly exposes all 10 QRadar tools to your LlamaIndex function agent with zero manual mapping.

Network configurations retrieved via `get_network_hierarchy` are processed in memory and sent directly to your configured vector store. Vinkius operates a zero-trust sandbox, meaning your network topology is never cached or stored on our infrastructure.

Use it with your favorite AI tools

Connect this server to Cursor, Claude, VS Code, and more.

OpenAI Agents SDK sdk-python

Google ADK sdk-python

Pydantic AI sdk-python

Vercel AI SDK sdk-typescript