Integration between QRADAR with ServiceNow

[Neha52]

Hi all,

How we can do integration between QRadar with Servicenow. If anybody has been done please share the document as well. I got something from  servicenow doc, but i am unable to understand properly. Please help..

Thanks for the advance.

Regards,

Neha

[shubham jagtap · Accepted solution]

Hi,

QRadar integration setup

Before you can use the QRadar integration, you must activate the plugin and configure the integration. If necessary, you can also update your X509 SSL certification

Activate and configure the IBM QRadar SIEM integration

The Integration Configuration feature allows you to quickly activate and set up third-party security integrations, including Security Operations QRadar Integration.

Before you begin

Role required: admin

Note: This procedure can be used to activate the plugin and configure the integration. You can also activate the plugin using the traditional method.

Procedure

1. Navigate to Security Operations > Integration Configuration.
   The available security integrations appear as a series of cards.
2. In the QRadar card, click Install Plugin.
3. In the Install IBM QRadar - Enrichment integration dialog box, review the plugin details and click Activate.
4. When the activation is complete, click Close & Reload Form.
   The Security Integration screen reloads and the Configure button for the integration is available.
5. Click Configure.
6. Fill in the fields on the form, as appropriate.
7. Click Submit

you can refer below link:

https://docs.servicenow.com/bundle/istanbul-security-management/page/product/qradar-integration/concept/set-up-qradar.html

https://www-01.ibm.com/support/docview.wss?uid=swg21997981

https://www-01.ibm.com/support/docview.wss?uid=swg21969815

https://www.youtube.com/watch?v=7wAE4TnyERI

https://www.youtube.com/watch?v=WR1AsL8ia7U

https://docs.servicenow.com/bundle/istanbul-security-management/page/product/qradar-integration/task/set-up-qradar.html

https://docs.servicenow.com/bundle/istanbul-security-management/page/product/qradar-integration/concept/ibm-qradar-siem-integration.html

https://docs.servicenow.com/bundle/istanbul-security-management/page/product/qradar-integration/reference/qradar-landing-page.html

https://exchange.xforce.ibmcloud.com/hub/extension/ServiceNow:ServiceNow%20Security%20Operations%20for%20IBM%20QRadar

After going throw this mark it as correct/helpfull .

Thank You.

[cashmere]

Hi, thanks for sharing this guide.

[Daniel Billing]

Please note that activating this plugin requires a Security Operations license.

[Neha52]

Yes Daniel. My customer has purchased SecOps Pro which contains Security Incident Response, Vulnerability Response, Threat Intelligence, Trusted Security Circles, Events Manager runtime subscription for Security Operation and Performance Analytics plugin for Security Operations.

Thanks,

Neha