RST AI Copilot for QRadar
An on-premises AI gateway for an existing IBM QRadar 7.5: natural-language Ariel searches, offense summaries and triage, Rule Wizard rule designs.
Overview
RST AI Copilot for QRadar is an AI gateway delivered as Docker containers. It runs inside your network and connects to your existing QRadar Console. It does not include QRadar; it reads events, flows, offenses, rules and log sources through one authorized-service token. Analysts ask questions in plain language, and the gateway writes the AQL, runs the Ariel search and summarizes the result.
The gateway is read-only on QRadar, apart from three offense actions an analyst triggers by hand: add a note, close and assign. It never writes rules, reference data or configuration.
Features
| Feature | Description | License |
|---|---|---|
| Ask AI | Natural language to read-only AQL, preflight repair, follow-up questions, Console deep link | Free |
| Offenses | Offense feed with an AI summary per offense, live updates, close, note and assign written back to QRadar | Free |
| Posture, audit log | Operational data, summarized and archived | Free |
| Log-source whitelist, field masking | The whitelist applies before every Ariel search; masking applies before content reaches the model | Free |
| Users and roles, notifications | Admin, analyst and read-only roles; notifications to Feishu, DingTalk, WeCom, Teams, Slack and email. Community is limited to 1 user | Free |
| Offense batch triage | Clusters by rule and source, model severity and false-positive verdicts | Paid |
| Offense investigation | Multi-round evidence over INOFFENSE() events, timeline, MITRE ATT&CK, recommended actions | Paid |
| Rule copilot | Rule Wizard tests, rule response and backtest AQL from a description, duplicate check against live rules | Paid |
| Platform-ops copilot | QRadar deployment check-up and AI reading | Paid |
| Reports | Operations data summarized per period, with scheduled reports | Paid |
Every edition uses the same archive. Without an activated license the gateway runs as Community and the free features work. The paid features need a Professional or Enterprise license; Professional is licensed per user. A trial license opens every Enterprise feature for 14 days on one host. Enterprise adds audit forwarding to an external SIEM, LLM failover, OIDC single sign-on and offline activation. Upgrading only means importing a license; no reinstall is needed. See Editions for the comparison and License for activation.
The Community Edition is free and includes every free feature. The archive is on GitHub: Reallysec/RST-AI-Copilot-for-QRadar.