Subscription

RST QRadar AI Copilot

Security-operations copilot for an existing IBM QRadar deployment: natural-language AQL, offense triage and investigation, rule and platform-ops copilots.

A 14-day trial licence, issued as soon as you sign in.

Start a trialContact sales

Editions

Community

Free

Includes

Natural-language query with follow-ups
Query results and log explained
Offense sync, AI summaries and write-back
Security posture overview
Log source allowlist
Field masking (cloud, private, offline)
Notification channels and local audit log

Download Community

Professional

Recommended

Limited-time offer

$99/user/yr

$9.9/user/mo

Includes

Batch alert triage with recommended action
Investigation context assembled automatically
Detection-rule drafting with ATT&CK mapping
Platform ops copilot
Reports and scheduled reports

Buy now

Start a 14-day trial

Enterprise

Pricing on request

Unlimited servers · 12-month term

Contact sales

What each edition includes

Capability
Capability	CommunityNo licence · Free for good	ProfessionalRecommended1 server · 12-month term	EnterpriseUnlimited servers · 12-month term
Price	Free	$99/user/yr	Pricing on request
Batch alert triage with recommended action	Not included	Included	Included
Investigation context assembled automatically	Not included	Included	Included
Detection-rule drafting with ATT&CK mapping	Not included	Included	Included
Platform ops copilot	Not included	Included	Included
Reports and scheduled reports	Not included	Included	Included
Audit forwarding to an external SIEM	Not included	Not included	Included
Multi-provider LLM failover / high availability	Not included	Not included	Included
OIDC single sign-on / enterprise identity	Not included	Not included	Included
Offline / air-gapped licence issuance	Not included	Not included	Included

Included in every edition

Professional and Enterprise both include the following. None of it is gated by edition.

Smart query: natural language to read-only AQL, SELECT-only validated and run through the Ariel search lifecycle, with a flat result table and deep links back to the QRadar Console; multi-turn follow-ups with saved conversations
Field masking, all three modes: cloud, private model, fully air-gapped — you decide which fields may leave
Offense feed: poll the offenses tail, per-offense AI summary, live stream, and dispositions — close / note / assign written back to QRadar
Analysis history: investigation and triage results archived and reopenable
Security posture overview
Log-source whitelist: bounds what the model may filter on, above the token's own security profile
Operations reports (daily / weekly / monthly), scheduled reports, team dashboards
Call audit: every login, query, model call and settings change, kept in a local audit trail
Outbound channels: Feishu / DingTalk / WeCom / Teams / Slack / mail
AI configuration: per-task reasoning levels
Users and roles (admin / analyst / read-only), sign-in

Need Enterprise, or a deployment shape not in the table? Contact sales