Purpose
This guide explains how to generate API credentials in the IBM Security QRadar EDR (formerly ReaQta / ReaQta-Hive) management console and how to use them in Logsign USO to ingest endpoint alerts, along with the underlying process/file-level events that triggered them, for security analytics and forensic purposes.
This is not the same product as IBM QRadar SIEM. IBM QRadar SIEM already has its own, separate Logsign integration ("IBM - QRadar"). IBM Security QRadar EDR is a distinct endpoint detection and response product (formerly sold and branded as ReaQta / ReaQta-Hive before IBM's acquisition), built around a "Hive Server" management console and lightweight endpoint agents. Its API, authentication scheme, and data model have nothing in common with QRadar SIEM's API. If you are looking to integrate QRadar SIEM offense/log data, use the existing "IBM - QRadar" documentation instead; this guide is only for the EDR product.
IBM Security QRadar EDR exposes alert and event data through a REST API (the "Hive API", reachable under the /rqt-api path on your Hive Server). This API poller is the supported way to bring that data into Logsign USO; there is no syslog-based collection path for this product.
Prerequisites
The account you use to create API credentials must have administrator access to the QRadar EDR / Hive Server management console, specifically to the Administration section.
You need the address of your own Hive Server (the management console your endpoint agents report to), either a self-hosted On-Premises server or your dedicated QRadar EDR SaaS tenant. This is not a shared IBM URL; it is specific to your deployment.
Step 1: Identify Your Hive Server URL
Sign in to your QRadar EDR / Hive Server management console using your administrator credentials. The address in your browser's address bar (for example https://hive.yourcompany.com) is the Base URL you will enter in Logsign in Step 3. Do not include the /rqt-api path suffix; Logsign appends it automatically.
QRadar EDR is available both as an On-Premises deployment and as a SaaS (cloud-hosted) deployment. In both cases the Hive Server address is unique to your organization; there is no shared multi-tenant API host the way there is for some other cloud products.
Step 2: Create an API Application in the Hive Server Console
- In the QRadar EDR / Hive Server console, go to Administration > API Applications.
- Click Create Application.
- Enter an Application Name and Description (for example, "Logsign USO integration") so the credential is identifiable later.
- Choose the appropriate Restrictions (target group) according to your organization's access policy. Make sure the application is allowed to access the endpoint groups whose alerts you want Logsign to ingest.
- Click Create.
- Open the newly created application to view its App ID and Secret Key. Copy both values and store them somewhere safe; if the Secret Key needs to be regenerated later, every integration using it (including this one) must be updated with the new value.
Step 3: Configure the Integration in Logsign USO
After obtaining the Hive Server URL, App ID, and Secret Key, log in to Logsign USO and add a new "IBM QRadar EDR" data source. You will be asked for:
| Field | Value |
|---|---|
| Base URL | Your Hive Server address from Step 1, for example https://hive.yourcompany.com |
| Client ID (App ID) | The App ID from Step 2 |
| Secret | The Secret Key from Step 2 |
| Verify SSL | Enabled by default; disable only if your Hive Server uses a self-signed certificate you cannot add to the trust store |
Logsign exchanges the App ID and Secret Key for a short-lived Bearer JWT automatically on the first poll, and re-exchanges it whenever it expires. You do not need to generate or refresh a token yourself. Logsign then periodically queries the Hive alerts API for new endpoint alerts across all activity states (active, inactive, and idle), using happenedAt as the sync cursor, and for each new alert retrieves the underlying triggering events (process, file, and registry-level detail) via the alert's events sub-endpoint. Alerts are also normalized into Logsign incidents, and incidents that are later archived/closed on the Hive Server are automatically closed in Logsign as well.
Notes and Limits
- The Bearer JWT obtained by the integration is short-lived (on the order of minutes, per IBM's published Hive API client behavior). Logsign requests a new one automatically before it expires or immediately after a 401 response, so no manual action is needed under normal operation.
- If polling stops and the source logs authentication failures, check two things first: whether the API Application was deleted or its Secret Key was regenerated in the Hive Server console, and whether the application's group restrictions still cover the endpoints you expect alerts from. Create a fresh application (or update the restrictions) and update the data source in Logsign USO with the new credentials.
- This poller covers alert data and the events that triggered those alerts (the Hive "alerts" and "alert events" API). It does not cover endpoint response actions such as isolate/de-isolate, or endpoint inventory/management data; those would require a separate connector.
- IBM does not publish an explicit numeric rate limit for the Hive API; avoid configuring an unusually short polling interval against a single Hive Server.
- Make sure the Base URL you enter is your own organization's Hive Server address, not a generic IBM login page. There is no shared API host for this product; every customer's Hive Server has its own address.