QRadar AI Copilot
A Docker gateway on an existing IBM QRadar 7.5: plain-language Ariel queries, a live Offense feed with batch triage, Offense investigation, Rule Wizard rule designs.
What it is
QRadar AI Copilot is an AI gateway that runs inside the network and does not ship QRadar: it connects to an existing Console with one authorized-service SEC token, reads events, flows, offenses, rules and log sources from there, turns an analyst's natural language into AQL and the results into conclusions.
QRadar is read-only to the gateway. The only exceptions are three actions an analyst triggers by hand: add a note to an offense, close it, assign it or flag it for follow-up. Rules, reference data and configuration are never written. The gateway's own state (sessions, offense copies, audit, notification config) lives in one SQLite file on a Docker volume.
It is the sibling of Elastic AI Copilot: same shell, same pages, same licensing and delivery. Only the domain layer differs: ES DSL becomes AQL, Kibana alerts become Offenses, detection rules become Rule Wizard designs.
What it does
| Capability | What | Paid? |
|---|---|---|
| Ask AI | Natural language → AQL, SELECT only, preflight repair, follow-up turns, Console deep link | Free |
| Offenses | Polls /api/siem/offenses, one-line AI summary per offense, live SSE feed, dispositions, close / note / assign written back to QRadar | Free |
| Posture, reports, audit log, platform health | Operational data summarised and archived; audit forwarded to syslog / webhook | Free |
| Log-source whitelist, field masking | Whitelist enforced before every Ariel search; masking applied before content reaches the model | Free |
| Offense batch triage | Cluster by rule + source, model severity and false-positive verdicts | Paid |
| Offense investigation | Multi-round evidence over INOFFENSE() events, timeline, MITRE ATT&CK, recommended action | Paid |
| Rule copilot | Natural language → Rule Wizard test conditions, rule response, backtest AQL, ATT&CK mapping, duplicate check against live rules | Paid |
| Platform-ops copilot | AI reading of the 7 deployment checks | Paid |
Unactivated, the free capabilities keep working under a daily quota; the paid engines need an activated licence. A trial licence is the Standard tier for 14 days.
Where to start
Quick start
From the delivery archive to a working login, about ten minutes.
Installation
Requirements, deploy.sh, configuration, QRadar token permissions, SSO, upgrade and backup.
User guide
What each page does and where its limits are: Ask AI, Offenses, triage, investigation, rules, posture, settings.
Troubleshooting
Causes by symptom; error-code lookup.