IBM QRadar Integration

Create API Token

Create an authorized service token in QRadar for DB Audit integration.

                # Create API token via QRadar Console:
# 1. Log in to QRadar Console
# 2. Navigate to Admin → Authorized Services
# 3. Click "Add Authorized Service"
# 4. Enter a name (e.g., "DBaudit Integration")
# 5. Select "Admin" role or create custom role with required permissions
# 6. Copy the generated token

# Required API permissions:
# - eventcollector - For event ingestion
# - logsources - For log source management (optional)
              

Test API Connection

Verify the API token works by querying the QRadar system info.

                # Test QRadar API connectivity
curl -X GET "https://qradar.example.com/api/system/about" \
    -H "SEC: YOUR_API_TOKEN" \
    -H "Accept: application/json"

# Expected response:
{
  "build_version": "7.5.0",
  "external_version": "7.5.0",
  ...
}
              

Configure in DB Audit

Add the IBM QRadar integration in the DB Audit dashboard.

1. Navigate to Integrations → SIEM in DB Audit
2. Click Add SIEM Integration
3. Select IBM QRadar as the provider
4. Enter your QRadar console URL and API token
5. Configure log source settings (or let DB Audit auto-create)
6. Select event types to forward
7. Test the connection and save

Create Custom Rules (Optional)

Create offense rules to detect suspicious database activity.

                # Create custom offense rule for suspicious database activity
# Navigate to: Offenses → Rules → Actions → New Event Rule

Rule Name: Suspicious Database Data Exfiltration
Rule Description: Detects queries returning large amounts of data

# Test conditions:
when the event(s) were detected by one or more of DB Audit
and when any of rowsAffected is greater than 10000
and when any of action is one of the following SELECT

# Rule response:
Create an offense indexed on username, sourceip
Set offense name to "Potential Data Exfiltration - %username%"
Set offense severity to High