Grafana + IBM QRadar

Grafana
1

Hi there,

I am trying to integrate Grafana with IBM QRadar. QRadar has an API which I am trying to leverage from Grafana.

The plugin which I am attempting to configure for this integration is the simpleJson one since QRadar’s API supports JSON. I have configured the data source and tested ok, while being able to monitor the API calls from QRadar being completed successfully: API request successful.

Now for the difficult part, at least for me, is, how do I get the data from the resulting call and number of API calls:

Here is the QRadar API flow:

  1. Method POST: /ariel/searches: Via this endpoint a parameter can be set to specify the specific AQL(Ariel Query Language - Similar to SQL), which returns some JSON information on if the query has been submitted successfuly.

  2. GET - /ariel/searches/{search_id} with the search id returned on the previous step will return the current status of the query.

  3. GET - /ariel/searches/{search_id}/results will return the actual results.

All this works well when tested directly from the API documentation and testing resource on QRadar itself.

My question than is, how do I go about setting all this up on Grafana itself so that all those steps are performed in sequence and I can fetch the results back into my dashboard?
I have tried adding queries while creating a new dashboard, but it is not quite clear what goes where at this point, and my dashboard is still empty.

Any tips are welcome!

Thanks!

2

Continuing the discussion from Grafana + IBM QRadar:

Hello @dudenstein ,

Hope you are doing good.

Were you successful in this? -creating dashboards on Grafana by ingesting events from QRadar?

–
Thanks and Regards,
ST