QRadar token permissions
Create a dedicated authorized service for the gateway. The security profile decides which log sources and offenses are visible; the user role decides which APIs can be called. With the permission for each API, verification and the log-source whitelist.
The gateway reaches QRadar with one authorized-service SEC token. Two layers decide what that token can see. The security profile limits log sources, networks and domains: Ariel searches return only events in scope, and the offense list contains only offenses in scope. The user role limits which APIs the token can call. The gateway never widens either layer.
The gateway is read-only on QRadar, apart from three offense actions an analyst triggers by hand: add a note, close and assign. It never creates rules or changes reference data or configuration.
For log sources outside the security profile, Ariel returns no events and reports no permission error. When a query returns zero rows, check this layer first.
Create the authorized service
Prerequisites
- You are signed in to the Console with a QRadar account that has Admin rights.
Steps
- Under Admin > Security Profiles, create a security profile such as
rst_copilot. Select the log sources or log-source groups the gateway should query, and the matching networks. Do not select everything unless the gateway needs all data. - Under Admin > User Roles, create a user role such as
rst_copilotwith the permissions in the table below. - Under Admin > Authorized Services, add an authorized service with that user role and security profile, set an expiry that fits your security policy, and copy the token.
- In Admin, select Deploy Changes.
- Put the token in
QRADAR_SEC_TOKENin.env, or enter it under QRadar Console connection in Settings, select Test connection and save when the test passes.
Do not reuse an administrator's token. When the token expires, readyz returns 503 and a banner at the top of the interface says QRadar is not connected; select Configure to enter the details again.
Verify the permissions
Under QRadar Console connection in Settings, select Test connection. The gateway first calls /api/system/about; if that fails, the whole test fails with the reason. If it succeeds, the gateway reads one item from each of four API families (Ariel, Offenses, rules, log sources) and shows which ones are available. An unavailable family is a permission missing from the user role.
You can also run curl -k https://<hostname>/readyz on the gateway host. qradar set to ok means the token is valid.
APIs the gateway calls
Permission names follow the User Roles page of your Console version.
| API | Used for | Permission |
|---|---|---|
/api/system/about | readyz, connection test, Console version | If the call fails, readyz returns 503 and the connection test fails |
/api/ariel/databases, /api/ariel/searches | Ask AI, investigation evidence, offense events, report statistics | Log Activity (events), Network Activity (flows) |
GET /api/siem/offenses, /api/siem/offense_types, /api/siem/offense_closing_reasons | Offense sync, details, closing reasons | Offenses |
POST /api/siem/offenses/{id}, POST /api/siem/offenses/{id}/notes | Close, assign, add a note | The close, assign and note permissions under Offenses. Without them these three actions fail and everything else works |
/api/analytics/rules, /api/analytics/building_blocks | Rule copilot comparison with live rules, rule names in offense details | View custom rules |
/api/config/event_sources/log_source_management/* | Log-source catalog, whitelist, log-source health | Log source management, read-only |
/api/system/servers, /api/config/deployment/hosts, /api/config/deployment/license_pool_allocations | Host and EPS license checks in Platform health | Admin read-only. Without it, those checks show that they could not run |
Log-source whitelist
The security profile decides what the gateway can read; the log-source whitelist decides what it will read. Set the whitelist under Log source whitelist in Settings or with RST_LOG_SOURCE_WHITELIST in .env; empty means no restriction. With both layers in place, grant only the needed log sources in the security profile and narrow further with the whitelist.
With a whitelist set, the model sees only the whitelisted part of the log-source catalog. Before every Ariel search over events, the gateway checks the AQL against the whitelist:
- A statement that names a log source outside the whitelist is refused with
log_source_not_whitelisted. - Every other statement gets a
LOGSOURCENAME(logsourceid) IN (...)condition appended. - The search is refused if the whitelist expands to more than 50 log sources, the statement has a subquery, or the log-source catalog cannot be read.
Statements over flows (FROM flows) are not limited by the whitelist, only by the security profile.
Configuration reference
Settings in .env in the installation directory: required values, sign-in and accounts, QRadar connection and AQL, model and reasoning, output language, offense sync, scheduled reports, platform check-up thresholds, audit and retention, resources.
SSO
Analysts sign in with corporate accounts. Caddy reaches the customer IdP through oauth2-proxy, roles come from IdP groups, and the audit trail records the person. An Enterprise feature.