IBM QRadar Connector for AI agents.
10 live capabilities
Query security logs and manage offenses using natural language commands.
Waiting for input…
Why people use IBM QRadar
IBM QRadar for Faster Security Incident Response
This Connector lets you stay in one chat window. You tell your agent what happened, it runs the searches and pulls the offense details for you, and gives you a summary of the threat in seconds.
What Vinkius changes
You get to stop writing manual queries and start asking questions about your security data.
Use it from Claude, ChatGPT, Cursor or another AI client you already have.
One account · 5,900+ Connectors
- Real-world use case 01
Rapid threat triage during a traffic spike
A SOC analyst sees a spike in traffic and asks the agent to run an AQL search for the last hour of logs from a specific source.
- Real-world use case 02
Summarizing active alerts for shift handovers
A threat hunter needs to see all active alerts and uses `get_offenses` to get a summary of everything currently firing.
- Real-world use case 03
Auditing correlation rules for compliance
An engineer needs to check if a rule is active and asks the agent to list correlation rules to find the one for 'Brute Force'.
Complete set · 10capabilities
The complete IBM QRadar capability set.
These are the exact actions your AI can choose when you ask it to work with IBM QRadar.
01—04
4 capabilities in this set.
Part of 10 available through IBM QRadar.
- 01 Capability
Get log sources
List all the different log sources currently active in your QRadar instance. Use this to see your full security coverage.
- 02 Capability
Get network hierarchy
View your QRadar network hierarchy to see how assets are organized. This provides a quick overview of your network structure.
- 03 Capability
Get offense details
Pull specific information and context for a single QRadar offense. It gives you a summary of a threat without clicking through the UI.
- 04 Capability
Get reference sets
See the different reference sets you have configured in QRadar. This helps you understand what data is being used for filtering.
05—07
3 capabilities in this set.
Part of 10 available through IBM QRadar.
- 05 Capability
Get rules
List your correlation rules to see what's currently monitoring your network. Use this to audit your active security logic.
- 06 Capability
Execute aql
Run an Ariel Query Language search and get a search ID for the results. This lets you start a deep dive into your logs using natural language.
- 07 Capability
Get offenses
List all current offenses to see what's currently triggering alerts. This is perfect for a quick overview of your current threat landscape.
08—10
3 capabilities in this set.
Part of 10 available through IBM QRadar.
- 08 Capability
Update offense
Change the status or details of an existing QRadar offense. This allows you to manage incidents directly from your chat window.
- 09 Capability
Get aql results
Fetch the data from a completed AQL search using its unique ID. Use this to see the final output of a long-running query.
- 10 Capability
Get aql status
Check if a long-running AQL query is finished or still processing. This helps you keep track of large data requests.
Set up in minutes
One URL. Then ask IBM QRadar to work.
Claude and ChatGPT only need the Connector URL. Copy it once, add it in settings, and use IBM QRadar from the conversation.
Choose your client
Live previewAdvanced clients IDE · CLI
Claude · Web + desktop
Connector URL · ready to paste
Streamable HTTPhttps://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp - Step 01
Open Connectors
In Claude Web or Claude Desktop, open Settings and choose Connectors.
- Step 02
Add the URL
Choose Add custom connector, name it IBM QRadar, and paste the URL above.
- Step 03
Turn it on in chat
Select +, open Connectors, and enable IBM QRadar for the conversation.
ChatGPT · Web + desktop
Connector URL · ready to paste
Streamable HTTPhttps://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp - Step 01
Open MCP settings
On desktop, open Settings and MCP servers. On web, open your workspace app or connector settings.
- Step 02
Add the URL
Choose Add server with Streamable HTTP, or create a custom MCP app, then paste the IBM QRadar URL.
- Step 03
Save and start
Save the connection and enable IBM QRadar in your conversation. Desktop may ask you to restart once.
Cursor · IDE configuration
Advanced setup
{
"mcpServers": {
"ibm-qradar": {
"url": "https://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp"
}
}
}- Step 01
Open MCP Settings
Press Cmd+Shift+P (macOS) or Ctrl+Shift+P (Windows/Linux) → search "MCP Settings"
- Step 02
Add the server config
Paste the JSON configuration above into the mcp.json file that opens
- Step 03
Save the file
Cursor will automatically detect the new Connector
- Step 04
Start using IBM QRadar
Open Agent mode in chat and ask: "Using IBM QRadar, help me...". 10 tools available
VS Code Copilot · IDE configuration
Advanced setup
{
"mcpServers": {
"ibm-qradar": {
"url": "https://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp"
}
}
}- Step 01
Create MCP config
Create a .vscode/mcp.json file in your project root
- Step 02
Add the server config
Paste the JSON configuration above
- Step 03
Enable Agent mode
Open GitHub Copilot Chat and switch to Agent mode using the dropdown
- Step 04
Start using IBM QRadar
Ask Copilot: "Using IBM QRadar, help me...". 10 tools available
Windsurf · IDE configuration
Advanced setup
{
"mcpServers": {
"ibm-qradar": {
"url": "https://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp"
}
}
}- Step 01
Open MCP Settings
Go to Settings → MCP Configuration or press Cmd+Shift+P and search "MCP"
- Step 02
Add the server
Paste the JSON configuration above into mcp_config.json
- Step 03
Save and reload
Windsurf will detect the new server automatically
- Step 04
Start using IBM QRadar
Open Cascade and ask: "Using IBM QRadar, help me...". 10 tools available
Cline · IDE configuration
Advanced setup
{
"mcpServers": {
"ibm-qradar": {
"url": "https://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp"
}
}
}- Step 01
Open Cline MCP Settings
Click the Connectors icon in the Cline sidebar panel
- Step 02
Add remote server
Click "Add Connector" and paste the configuration above
- Step 03
Enable the server
Toggle the server switch to ON
- Step 04
Start using IBM QRadar
Ask Cline: "Using IBM QRadar, help me...". 10 tools available
Claude Code · Terminal command
Advanced setup
claude mcp add ibm-qradar --transport http "https://edge.vinkius.com/vk_preview_atz0Ftxt3OHi9Ij7lqqAMHhee2myQRkC9JFYTdVt/mcp"- Step 01
Install Claude Code
Run npm install -g @anthropic-ai/claude-code if not already installed
- Step 02
Add the Connector
Run the command above in your terminal
- Step 03
Verify the connection
Run claude mcp to list connected servers, or type /mcp inside a session
- Step 04
Start using IBM QRadar
Ask Claude: "Using IBM QRadar, show me...". 10 tools are ready
Where the request belongs
Work IBM QRadar can move forward.
Who wakes up in the morning needing this? The SOC analyst who's tired of clicking through dashboards at 2am to find a single log entry. It's for security engineers who need to audit rules quickly and threat hunters who want to run complex searches without syntax errors.
SOC Analyst
Uses the Connector to quickly triage alerts and summarize offense details during high-pressure incidents.
Security Engineer
Audits correlation rules and verifies network hierarchy mappings without manually navigating deep menus.
Threat Hunter
Runs complex AQL searches to find hidden patterns in logs using natural language descriptions.
Build the capability set
Add more capabilities.
Each Connector adds new actions and data without changing how you work.
Browse ConnectorsSumo Logic
Connect your AI to Sumo Logic. Orchestrate log searches, monitor active collectors, and analyze system events efficiently.
Senar.io
Detect and respond to security threats with AI-powered SIEM that correlates events across your infrastructure in real time.
IBM watsonx
Connect IBM watsonx to any AI agent via MCP.
Five9 QM
Manage agent evaluations, review recorded interactions, and track quality metrics via AI agents with Five9 QM.
Honeycomb
Automate observability via Honeycomb. manage datasets, queries, and markers directly from any AI agent.
Axiom
Manage logs and observability data via Axiom. ingest data, run APL queries, and manage datasets or monitors directly from any AI agent.
Bring your own AI
Change the model, client or framework. Keep IBM QRadar connected.
-
Claude -
ChatGPT -
Gemini -
Cursor -
VS Code -
Windsurf -
ZCode -
Cline -
Zed -
Continue -
Kiro -
Roo Code -
Zencoder -
Goose -
Void -
Augment Code -
Amp -
Qodo -
Tabnine -
Pieces -
Sourcegraph Cody -
JetBrains -
Warp -
Amazon Q -
Antigravity -
BoltAI -
Raycast -
Jan -
LM Studio -
AnythingLLM -
Open WebUI -
Msty -
Cherry Studio -
LibreChat -
TypingMind -
Chorus -
5ire -
n8n -
LangChain -
LlamaIndex -
CrewAI -
Vercel AI SDK
Before you connect
Questions about IBM QRadar.
The practical details behind the request, access and result.
Can the IBM QRadar MCP run my custom AQL queries?
Yes, it translates your natural language into AQL queries. You can describe what you're looking for, and the agent handles the syntax.
How does this help with faster incident response?
It pulls offense details instantly. Instead of clicking through the console, your agent can summarize the most important information for you.
Can I update an offense status through the AI?
Yes, you can tell your agent to update an offense, and it will modify the status or details directly in QRadar.
Does this Connector support all my QRadar log sources?
It lists all the log sources currently active in your instance, so you can query any of them via your AI client.
Is my security data safe with this Connector?
Your agent uses your existing credentials to interact with the data. It doesn't store your logs; it just fetches them as you ask.
Can I check my correlation rules?
Yes, you can ask your agent to list your correlation rules to see what's currently monitoring your network.
One connection away
Give your agent a direct line to IBM QRadar.
Connect IBM QRadar once. Keep it beside 5,900+ managed Connectors when the next task needs more.
Explore every Connector No credit card required · Free tier available