IBM Security QRadar SOAR

 View Only
  • 1.  Need help with packaging the QRadar app

    Posted Tue February 13, 2024 10:30 AM

    I need help asap.
    I have created an app to integrate with QRadar using QRadar App SDK. I am fetching events from an API via the app, to QRadar. The app is currently in my system in a directory as I was writing the code in my code editor. Here is what I need help with:
    1. How do I package this app so it can be installed in a QRadar instance. I tried the command: `qapp package -p <>` but it only creates a zip file for the entire app and when I try to install it on QRadar instance, it says "Unable to successfully validate supplied extension file".
    The instructions to package the app in documentation are not clear and doesn't seem to work. What am I missing?

    2. The app has `qenv.ini` file with QRADAR_CONSOLE_FQDN, QRADAR_CONSOLE_IP, QRADAR_REST_PROXY, SEC_ADMIN_TOKEN. DO I need supply these fields in my code or does QRadar fills them automatically. If I need to supply it, what value do I need to put?

    3. Currently I am trying to send events to QRadar by this the following code and syslog. Is it correct and will work or not. If not, how can I configure the app to send events to QRadar?


    key, value in event_data.items():
    if value is None:
    message += u"{0}={1} ".format(key, value)

    qpylib.log("WAFGSFDV : Messages RECEIVED")

    syslog(hostaddress, message, event_name)
    def syslog(hostname, content, event_name):
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((hostname, 514))
    message = process_event_message(content, event_name) + '\n'

    Please help me with the above queries.

    Thanks in Advance.

    Cyble Dev

  • 2.  RE: Need help with packaging the QRadar app

    Posted Mon February 19, 2024 11:34 PM

    Please help.

    @Juan Paulo @Mark Scherfling @Manuel Schwennen @John Quirke @Priya Sapra @Nick Mumaw @Andy Su @Khaled Nasr

    Cyble Dev

  • 3.  RE: Need help with packaging the QRadar app

    User Group Leader
    Posted Tue February 20, 2024 03:18 AM


     You will get better help in the QRadar SIEM forum, the folks here will be able to help with SOAR only. If you are creating an app to connect QRadar to a REST API then you should take a look at the built in Universal Cloud REST API connector (uREST). Apps like you describe are known as 'protocol apps' and will only work on QRadar Classic, but uREST is supported on all variants of QRadar SIEM (Cloud Native, QRoC, QRadar Classic). We are strongly encouraging developers port their existing protocol apps to uREST and discouraging anyone building new ones. 

    If you are looking to build an integration to QRadar and publish it to the IBM Security App Exchange then my team can provide you with free technical assistance, please reach out to me directly if that applies to this situation.


    Dan -

    IBM Security Technology Alliances

    QRadar App SDK Download and docs: 

    QRadar REST API

    Getting data into QRadar - a.k.a Develop a DSM (Device Support Module)

    QRadar Built-in Protocols

    QRadar Universal Cloud REST API

    QRadar Partner license request form

    Getting an extension signed for QRadar

    Ways to prepare for a smooth validation process

    QRadar Pre-Validation App

    How to get your extension .zip file ready for validation

    Dan Schofield

  • 4.  RE: Need help with packaging the QRadar app

    Posted Tue February 20, 2024 01:58 PM

    Hello @Dan Schofield,
    Thank you so much for the detailed reply.

    As you mentioned above, I wish to create an integration app and publish it to IBM Security App Exchange.

    Please let me know when and how we can connect at your earliest convenience, as I have some immediate queries regarding the development process of the app.

    Thanks once again.

    Cyble Dev

  • 5.  RE: Need help with packaging the QRadar app

    Posted Wed February 21, 2024 12:45 PM

    Hey Cyble,

    Didn't see this when it originally came in so sorry for the delay! When building your integration I would point you to 2 different places where I have documented a lot of this. First would be my YouTube series on app development. That can be found here:

    That being said the video series is over a year old and new features have been added to this process. In these videos I am following a document that I have made available on my GitHub. The link to that is found here: I keep this up to date as much as I can so even if the video doesn't have the new feature, check out the document and you will have the latest and greats knowledge that I currently have! If you think I am missing something feel free to leave a comment or hit me up in this post!

    Nick Mumaw, GPEN, GPYC
    Cyber Security Specialist - SOAR
    IBM - Security