How do I use this MCP with Claude?

You connect to the Vinkius-hosted MCP once, and it becomes available in your Claude desktop app or web interface immediately.

Do I need to host the MCP myself?

No. Vinkius hosts and manages the MCP for you, so you don't have to worry about infrastructure or uptime.

Can my AI agent run complex AQL queries?

Yes. The MCP includes capabilities to execute AQL searches, check their status, and retrieve the final results.

Is my QRadar data secure?

Vinkius manages the connection and credentials securely, allowing your AI client to interact with QRadar through a controlled interface.

Can I modify offenses through the AI?

Yes. The update_offense capability allows your agent to change offense information directly in QRadar.

An astronaut overseeing a futuristic data hub

Download PDF Markdown Version

Connect IBM QRadar to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Let your AI agent investigate threats and query logs directly.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 10 capabilities

We ship only the actions that matter.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through IBM QRadar.

01
Get log sources
This capability lists all log sources currently configured in QRadar.
02
Get network hierarchy
Use this to retrieve the network hierarchy defined in your QRadar environment.
03
Get offense details
This capability pulls specific, granular details for a single QRadar offense.
04
Get reference sets
This capability provides a list of all QRadar reference sets.

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through IBM QRadar.

05
Execute aql
This capability starts an Ariel Query Language (AQL) search and returns a search ID for later retrieval.
06
Update offense
Use this to modify the properties or status of an existing QRadar offense.
07
Get aql status
This capability checks whether an AQL search is still running or has finished.

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through IBM QRadar.

08
Get aql results
This capability retrieves the final data from a completed AQL search.
09
Get offenses
This capability pulls a list of current offenses from QRadar.
10
Get rules
This capability retrieves the correlation rules configured in your environment.

Real work

What teams actually run

Rapid Offense Triage

An analyst asks the agent to summarize the most recent offenses to identify high-priority threats.

Automated Log Analysis

The agent runs an AQL search to find specific IP addresses across large datasets.

Network Context Gathering

During an investigation, the agent pulls the network hierarchy to see which segments are affected.

Rule Auditing

A security engineer asks the agent to list all correlation rules to verify recent changes.

Automate a task

Put IBM QRadar to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

IBM QRadar works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

Building your own app? The connector is yours to use.

You don't need a client to put IBM QRadar to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

942ms average. Fast in production.

IBM QRadar is checked daily against the live service.

Daily averagePeak 1117ms

Oct 3Today

Fastest day: 797ms
Slowest day: 1117ms
14-day trend: Slowing+22%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of IBM QRadar, so you can see the experience inside your AI.

It does not authenticate your account with IBM QRadar. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

IBM QRadar Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp

Claude Desktop

Follow the steps below to connect in seconds.

1In Claude Desktop, open Settings → Connectors.
2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
3Click Add and start a new chat — IBM QRadar capabilities are ready to use.

Configuration · claude_desktop_config.jsonCopy

{
  "mcpServers": {
    "ibm-qradar-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp"
    }
  }
}

Claude
ChatGPT
Cursor
VS Code
Windsurf
Claude Code
JetBrains
Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up IBM QRadar in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work IBM QRadar owners hand off.

This MCP is built for security professionals who want to use AI to speed up their investigation cycles.

01
SOC Analysts
They hand off the repetitive task of querying logs and checking offense details to their AI agent.
02
Security Engineers
They use the capability to audit correlation rules and manage reference sets via natural language.
03
Incident Responders
They use the AI to quickly pull network hierarchy and log source data during active threats.

FAQ

Questions IBM QRadar owners ask.

01
How do I use this MCP with Claude?
You connect to the Vinkius-hosted MCP once, and it becomes available in your Claude desktop app or web interface immediately.
02
Do I need to host the MCP myself?
No. Vinkius hosts and manages the MCP for you, so you don't have to worry about infrastructure or uptime.
03
Can my AI agent run complex AQL queries?
Yes. The MCP includes capabilities to execute AQL searches, check their status, and retrieve the final results.
04
Is my QRadar data secure?
Vinkius manages the connection and credentials securely, allowing your AI client to interact with QRadar through a controlled interface.
05
Can I modify offenses through the AI?
Yes. The update_offense capability allows your agent to change offense information directly in QRadar.

Explore

More in Industry Titans

Connect IBM QRadar to Claude, Cursor, ChatGPT & more

Your AI does the work. We keep it safe and sound.

Each Connector runs inside its own sealed environment.

One switch stops every agent. Instantly.

Spending limits that pause instead of surprise.

We ship only the actions that matter.

01-04

Get log sources

Get network hierarchy

Get offense details

Get reference sets

05-07

Execute aql

Update offense

Get aql status

08-10

Get aql results

Get offenses

Get rules

What teams actually run

Rapid Offense Triage

Automated Log Analysis

Network Context Gathering

Rule Auditing

Building your own app? The connector is yours to use.

IBM QRadar Connector

Claude Desktop

SOC Analysts

Security Engineers

Incident Responders

How do I use this MCP with Claude?

Do I need to host the MCP myself?

Can my AI agent run complex AQL queries?

Is my QRadar data secure?

Can I modify offenses through the AI?

IBM Quantum AI Connector

IBM watsonx AI Connector

watsonx Discovery AI Connector

NS1 (IBM NS1 Premium DNS API) AI Connector

Suggestions

X Ads (Twitter) AI Connector

Box AI Connector

Gmail AI Connector

Google Maps AI Connector