QRadar token permissions
Give the gateway a dedicated authorized service: the security profile decides which log sources and offenses it sees, the user role decides which endpoints it may call. With the permission behind each endpoint and how to verify.
QRadar is read-only to the gateway, with three exceptions an analyst triggers by hand: add a note to an offense, close it, assign it or flag it for follow-up. It creates no rules, changes no reference data, touches no configuration and stores nothing on the QRadar side. Create a dedicated authorized service rather than reusing an admin token.
Two fences
| Layer | Where in QRadar | Decides |
|---|---|---|
| Security profile | Admin → Security Profiles | Which log sources / groups, networks and domains the token can see. Ariel returns only events in scope; the offense list holds only offenses in scope |
| User role | Admin → User Roles | Which endpoints the token may call: Ariel search, offense read / write, rules, log-source catalogue, system information |
Create the authorized service under Admin → Authorized Services with both, and copy the SEC token. Expiry is your policy; once expired, readyz reports 401 and the UI asks for a new token.
Endpoints the gateway uses
| Endpoint | Used for | Needs |
|---|---|---|
POST /api/ariel/searches, GET .../results, GET /api/ariel/databases | Ask AI, investigation evidence, offense events, report aggregation | Role: Log Activity (events), Network Activity (flows) |
GET /api/siem/offenses, /offense_closing_reasons, /offense_types | Offense polling, detail, closing-reason dropdown | Role: Offenses |
POST /api/siem/offenses/{id} (status / assigned_to / follow_up), POST .../notes | Close, assign, add note | Role: the close / assign / note rights under Offenses |
GET /api/analytics/rules, /building_blocks | Rule copilot duplicate check, rule names in offense detail | Role: view custom rules |
GET /api/config/event_sources/log_source_management/log_sources, /log_source_groups, /log_source_types | Log-source catalogue, whitelist, log-source health | Role: log-source management (read is enough) |
GET /api/system/about, /api/system/servers, /api/config/deployment/hosts, /license_pool_allocations | readyz version, host / EPS-licence checks in Platform health | Role: read-only admin capabilities. Without them qradar_version is empty and those checks show "unavailable"; nothing else is affected |
Capability names follow your Console version's Admin → User Roles page; the table uses the 7.5 grouping.
A log source outside the security profile simply returns no events from Ariel; the gateway raises no error. When a query "matches 0 rows", check this layer first.
Recommended minimum
Admin → Security Profiles → New, name rst_copilot. Tick the log sources (or one group) the gateway should query and the matching networks. Avoid "all" unless you really want everything queryable.
Admin → User Roles → New, name rst_copilot. Tick Log Activity, Network Activity, Offenses (with close / assign / note), view custom rules, log-source management. Add read-only admin capabilities if Platform health should show hosts and EPS licence.
Admin → Authorized Services → Add, name rst_copilot, pick the role and profile above, set expiry per policy. Copy the token.
Deploy Changes.
Put the token into QRADAR_SEC_TOKEN in .env, or use "Test connection" in Settings and save.
Verify
curl -k https://<hostname>/readyzqradar must be ok. "Test connection" in Settings first calls /api/system/about (a failure there fails the whole test, with the reason), then reads one row from each of the Ariel, Offenses, rules and log-source families and reports each as reachable or not: the unreachable one is what the role lacks.
Log-source whitelist
The security profile decides what the gateway can read; RST_LOG_SOURCE_WHITELIST (or the whitelist in Settings) decides what it will read. Set both: the profile grants only the necessary sources, the whitelist narrows further.
The whitelist does more than trim the catalogue the model sees. Before every Ariel search the gateway checks the AQL against it: a reference to a source outside the whitelist fails with log_source_not_whitelisted; a statement that names no source gets LOGSOURCENAME(logsourceid) IN (...) appended; a whitelist expanding to more than 50 names, a subselect, or an unavailable catalogue rejects the statement. These rejections are visible in the evidence trail of an offense investigation.
The guard recognises LOGSOURCENAME(logsourceid) = / LIKE / IN and logsourceid = / IN by regex; it is not a full AQL parser, so a hand-written ... = 'A' OR 1=1 would pass. The product never generates that shape; whoever edits AQL by hand is the analyst, and the full statement is in the audit log.
Configuration reference
Every setting in .env: required, login and accounts, QRadar connection and AQL budgets, model and reasoning, offense sync, scheduled reports, platform-check thresholds, audit and retention. Values changed in the UI win.
Enterprise SSO
Analysts sign in with their corporate account: Caddy → oauth2-proxy → the IdP (Entra ID / Okta / Keycloak / AD). Roles map from IdP groups; audit traces to a person.