IBM QRadar EDR Response Integration via API

Purpose

This guide explains how to configure the IBM QRadar EDR Response integration in Logsign USO, which lets Logsign take automated or analyst-triggered actions on the IBM Security QRadar EDR (formerly ReaQta / ReaQta-Hive) management console, such as isolating an infected endpoint, killing a malicious process, or closing an alert, directly from an incident or a correlation rule.

This is a different integration from the existing "IBM QRadar EDR Integration via API" article. That article covers the data collection (poller) side of the same product: it only reads alert and event data out of the Hive Server into Logsign, and it explicitly does not perform any response action. This document covers the opposite direction, actions Logsign sends into the Hive Server, configured separately under Settings > Integrations > Responses rather than under Data Collection. The two integrations use the same underlying Hive API and the same credential model, but they are independent configuration entries in Logsign; setting up one does not configure the other.

This is also not the same as the "IBM QRadar" response integration. IBM QRadar SIEM has its own, separate Logsign response integration for actions against the SIEM itself (such as reference set management). IBM Security QRadar EDR is a distinct endpoint detection and response product built around the Hive Server console and lightweight endpoint agents; its API, authentication, and available actions have nothing in common with QRadar SIEM's.

Prerequisites

The account you use to create API credentials must have administrator access to the QRadar EDR / Hive Server management console, specifically to the Administration section.

You need the address of your own Hive Server, either a self-hosted On-Premises server or your dedicated QRadar EDR SaaS tenant. This is not a shared IBM URL; it is specific to your deployment, the same way it is for the data collection integration.

Endpoint isolation and de-isolation are supported for Windows endpoints. Based on IBM's own published client behavior for this API, isolating a non-Windows endpoint does not return a normal success or failure response; the request times out and the Hive Server returns HTTP 504. This has not been independently re-tested by Logsign against a live Hive Server, so treat it as a vendor-documented limitation rather than a Logsign-verified one, but plan your automation and playbooks around Windows endpoints only until you confirm otherwise in your own environment.

Step 1: Generate API Credentials (least privilege)

QRadar EDR / Hive Server does not expose a separate read-only versus read-write permission toggle for API Applications; the only scoping control available at credential creation time is the Restrictions (target group) setting, which limits which endpoint groups the credential can see and act on. Because this integration can isolate endpoints, kill processes, and close alerts (all higher-impact actions than the read-only poller), least privilege here means limiting scope by endpoint group, not by action type.

1. Sign in to your QRadar EDR / Hive Server management console with an administrator account.
2. Go to Administration > API Applications.
3. Click Create Application.
4. Give it a name and description that identifies it as the Logsign response/action credential, for example "Logsign USO Responses", so it is not confused with a separate credential you may already use for the data collection poller. Logsign recommends creating a dedicated Application for this integration rather than reusing the poller's App ID and Secret Key, so that a leak or misuse of one credential does not also grant the other credential's capabilities.
5. Under Restrictions, scope the Application to only the endpoint groups you actually want Logsign to be able to isolate, investigate, or close alerts for. Do not grant access to all groups unless your incident response process genuinely needs it.
6. Click Create, then open the Application to copy its App ID and Secret Key. Store both securely; if the Secret Key is regenerated later, this Logsign configuration must be updated with the new value or every action call will start failing authentication.

If your Hive Server console offers any additional per-action or read/write scoping options beyond target group restrictions (IBM may have added this in newer releases), Logsign has not independently verified their presence or behavior; check your own console version and apply the most restrictive setting available.

Step 2: Configure the Integration in Logsign

Go to Settings > Integrations > Responses, search for or select IBM QRadar EDR, click Configure, then +Device. The configuration fields, taken directly from the integration's manifest, are:

Click Create to save. Logsign exchanges the App ID and Secret Key for a short-lived Bearer token on the first call to this integration (POST /rqt-api/1/authenticate with the Id and Secret in the request body) and re-authenticates automatically on subsequent uses. Per IBM's published client behavior for this API, these tokens are typically valid for around 15 minutes; you do not need to generate or refresh anything manually.

A field labeled Proxy Url exists in the integration's backend configuration but is not exposed as a field in the current manifest schema, so it is not configurable from the Logsign UI at this time. This is a codebase observation, not a documented customer-facing option; do not rely on it.

Available Methods

Once the device is configured, these actions become available to correlation rules, playbooks, and manual actions from an incident. Several methods depend on each other: get_endpoints populates the endpoint picker used by the other methods, and get_processes (which itself needs an endpoint) populates the process picker used by process_kill. You will not normally need to call the "get" methods directly; Logsign calls them automatically to populate the dropdowns when you build an action.

get_endpoints

Returns the list of endpoints Logsign can act on, used to populate the endpoint picker for the other methods. Internally this calls GET /endpoints?connected=true, so only endpoints currently connected to the Hive Server are listed, and results are paginated automatically if there are many endpoints.

get_processes

Lists running processes on a specific endpoint, used to populate the process picker for process_kill. Calls GET /endpoint/{endpoint_id}/processes.

endpoint_isolate

Isolates the selected endpoint from the network, blocking all incoming and outgoing connections except the endpoint's own connection back to the Hive Server. Calls POST /endpoint/{endpoint_id}/isolate. Confirmed by IBM's own documentation to be Windows-only; see Prerequisites above.

endpoint_deisolate

Removes an endpoint from isolation and restores its normal network connectivity. Calls POST /endpoint/{endpoint_id}/deisolate.

process_kill

Terminates a specific running process on the selected endpoint. Calls POST /endpoint/{endpoint_id}/processes/kill with the process's PID and start time as the request body; both values are captured automatically when you select the process from the picker, you do not need to enter them yourself.

If the Hive Server reports the kill attempt failed, Logsign surfaces the vendor's own error message from the API response rather than a generic Logsign error, so the failure reason (for example, the process already exited) should be visible in the action result.

close_incident

Closes an alert on the Hive Server, the same alert data the "IBM QRadar EDR Integration via API" poller ingests into Logsign as incidents. Calls POST /alert/{alert_id}/close with a malicious query parameter.

hunting_query

Runs a query against the Hive Server's event/hunting search and returns the raw result. Calls POST /events/hunt with the query text as the request body.

In the Logsign action library this method is categorized under the same response-action group as close_incident, even though it is a search/read action rather than a containment action. This is a labeling detail from the integration's manifest, not something that changes what the action actually does.

Notes and Limits

• This is a response/action integration only. It does not collect logs, alerts, or events into Logsign; for that, use the separate "IBM QRadar EDR Integration via API" data collection poller. The two share the same Hive API and the same App ID/Secret credential model, but are configured, and should generally be credentialed, independently.
• Every action call re-authenticates against /rqt-api/1/authenticate using the configured Id and Secret if the current token is missing or has expired. There is no persistent session; a revoked or regenerated Secret Key breaks every action on the next call, not just new ones.
• IBM does not publish an explicit numeric rate limit for the Hive API. If you trigger a high volume of actions in a short window (for example, a playbook isolating many endpoints from one correlation rule), space the calls out if you start seeing failures under load; this has not been independently load-tested by Logsign.
• Endpoint and process pickers (get_endpoints, get_processes) only return currently connected assets. If an endpoint you expect to isolate does not appear in the picker, confirm it is online and connected to the Hive Server before assuming the integration is misconfigured.
• Isolation and de-isolation are Windows-only per IBM's published API client documentation; see Prerequisites.

Troubleshooting