Overview

QRadar SIEM integration - Sync security events, findings, and assets from IBM QRadar.

Configuration

This command reads the following keys from init.yaml. Any of them can also be supplied as an environment variable of the same name. See CLI Configuration File for the full reference.

• qradar
• timeout

Commands

regscale qradar assess_compliance

Assess QRadar SIEM compliance and update control statuses in RegScale.

This command: 1. Fetches security events from QRadar within the specified time window 2. Analyzes event data to assess compliance against NIST 800-53 R5 controls 3. Updates control implementation statuses in RegScale based on assessment 4. Creates evidence files documenting the compliance assessment 5. Links evidence to relevant compliance controls

The assessment evaluates QRadar's monitoring capabilities across multiple control families: - AU (Audit and Accountability): Event logging, content, retention - SI (System and Information Integrity): Monitoring, intrusion detection - IR (Incident Response): Incident detection and reporting - AC (Access Control): Account management, authentication tracking - IA (Identification and Authentication): Authentication monitoring - SC (System and Communications Protection): Boundary protection - RA (Risk Assessment): Vulnerability monitoring

Args: regscale_ssp_id: RegScale Security Plan ID base_url: QRadar instance URL api_key: QRadar API key (SEC token) time_window: Hours of events to analyze (default: 24) framework: Compliance framework (default: NIST800-53R5) update_controls: Whether to update control statuses create_evidence: Whether to create evidence files verify_ssl: Whether to verify SSL certificates

Examples: # Assess compliance and update controls using last 8 hours of events regscale qradar assess-compliance --id 123

Assess compliance using last 7 days of events regscale qradar assess-compliance --id 123 --time-window 168

Assess compliance without updating controls (read-only) regscale qradar assess-compliance --id 123 --no-update-controls

Assess compliance without creating evidence files regscale qradar assess-compliance --id 123 --no-create-evidence

regscale qradar assess_compliance [OPTIONS]

regscale qradar query_events

Assess logging coverage in QRadar SIEM for any identifier.

This command runs a targeted AQL query to determine if a specified identifier (AWS Account ID, username, IP address, etc.) has events logged in the SIEM. Based on the results:

• If identifier found with events: Creates evidence documenting event count - If identifier NOT found: Creates POAM/Issue for missing logs

The assessment evaluates: - AU-02 (Audit Events): Events are being generated - AU-03 (Content of Audit Records): Audit records contain adequate information - AU-06 (Audit Review, Analysis, and Reporting): Logs available for review - AU-12 (Audit Generation): System capability to generate audit records

Performance: Uses targeted query for specific identifier (completes in seconds vs 5-10 minutes for saved search on production QRadar).

Args: regscale_ssp_id: RegScale Security Plan ID base_url: QRadar instance URL api_key: QRadar API key (SEC token) api_version: QRadar API version (e.g., 19.0, 26.0) account_id: AWS Account ID to assess (deprecated - use query_field + query_value) query_field: QRadar field to query (e.g., 'AWS Account ID', 'username', 'sourceip') query_value: Value to search for in the specified field time_window_hours: How many hours back to query (default: 8) mapped_controls: Control IDs to map to assessment results verify_ssl: Whether to verify SSL certificates

Examples: # Assess AWS account logging (backward compatible) regscale qradar query-events --id 123 --account-id 123456789012

Query by username regscale qradar query-events --id 123 --query-field username --query-value jdoe

Query by source IP with custom time window regscale qradar query-events --id 123 --query-field sourceip --query-value 10.0.1.5 --time-window-hours 4

Query with custom control mapping regscale qradar query-events --id 123 --query-field username --query-value jdoe \ --mapped-controls AU-02 --mapped-controls AU-06

regscale qradar query_events [OPTIONS]

regscale qradar sync_events

Sync security events from QRadar into RegScale as findings.

This command: 1. Connects to QRadar instance 2. Fetches security events within the specified time window (filtered by severity) 3. Creates ONE issue per filtered event (deduplicated by event signature) 4. Optionally generates and syncs discovered assets (--generate-assets flag) 5. Optionally uploads evidence file to security plan (--generate-evidence flag)

Severity Filtering: Events are filtered at the QRadar API level using the severity_threshold parameter. Only events with severity >= threshold are retrieved and processed.

Asset Generation: When --generate-assets is used, assets are automatically discovered from event source/destination IPs and created in RegScale before creating issues.

Evidence Generation: When --generate-evidence is used, a single JSONL.GZ evidence file containing all filtered events is uploaded to the security plan.

Query Mode: When --query is provided, the command searches for the specified term across all event fields (case-insensitive). If found, matching events are collected as evidence. If not found, an issue/POAM is created.

Args: regscale_ssp_id: RegScale Security Plan ID base_url: QRadar instance URL api_key: QRadar API key (SEC token) time_window: Hours of events to retrieve (default: 24) severity_threshold: Minimum severity to process (0-10, default: 5) verify_ssl: Whether to verify SSL certificates generate_assets: Whether to create assets from filtered events generate_evidence: Whether to upload evidence file query: Search term for query mode (e.g., AWS account ID)

Examples: # Sync last 8 hours of events (issues only) regscale qradar sync-events --id 123

Sync events with assets and evidence regscale qradar sync-events --id 123 --generate-assets --generate-evidence

Sync last 7 days of critical events with assets regscale qradar sync-events --id 123 --time-window 168 --severity-threshold 8 --generate-assets

Search for AWS account ID in logs regscale qradar sync-events --id 123 --query "123456789012"

regscale qradar sync_events [OPTIONS]

regscale qradar test_connection

Test connection to QRadar instance.

Verifies that: - QRadar API is accessible - API credentials are valid - SSL certificates are valid (if verification enabled)

Args: base_url: QRadar instance URL api_key: QRadar API key (SEC token) verify_ssl: Whether to verify SSL certificates

Examples: # Test connection with config from init.yaml regscale qradar test-connection

Test connection without SSL verification (development) regscale qradar test-connection --no-verify-ssl

regscale qradar test_connection [OPTIONS]