Hi Matthew,
I know you posted this question a year ago, but I've been a member for a few days. My answer might still help someone ;)
In Qradar, there's already a watchdog that verifies disk usage. When the first threshold is reached (about 75-80%), there's a first warning notification in the top right corner of the GUI (assuming you have the right user permissions). Finally, when the critical threshold is crossed, there's another notification in the GUI, critical this time, and some services are stopped to prevent the system to crash. At this point, you have an impact on the system, so you must act after receiving the first notification.
Now, if the notification in the gui view is not enough (not pro-active enough), from the rule where the notifications are created, you can select to send an email or a trap to a third party monitoring system. If you choose the trap option, you'll have to integrate the Q1labs (qradar) mibs in the third party system.
The last solution available is to configure the Net-SNMP agent on the Qradar servers and use a third party monitoring system to poll the agent for health metrics, e.g. disk space, cpu usage, ram usage, network bandwidth, etc.
If you need more help on this, just ask, and I'll do my best to help you.
Regards,
------------------------------
Anthony Gayadeen
------------------------------