IBM QRadar SOAR
Connect IBM QRadar SOAR to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect IBM QRadar SOAR to collect security automation evidence with automated compliance tests, switched on per workspace.
| Category | Security Automation |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| IBM QRadar SOAR's guide | ibm.com |
Connect with an API token
-
In IBM QRadar SOAR:
- In QRadar SOAR, go to Administrator Settings › Users and click the API Keys tab.
- Click Create API Key.
- Enter the display name for the API key account (unique in the organization) and optionally a description.
- In the Permissions section, assign only read permission on incidents.
- Click Create. Copy the API key ID and secret that are displayed, then click OK.
Where to find the other values:
- API key ID: Shown with the secret on the credentials screen right after you click Create.
- Base URL: The address of your QRadar SOAR server (the URL you sign in to).
IBM QRadar SOAR shows the secret only once, so copy it before you leave the page.
IBM QRadar SOAR's public documentation does not cover every step.
IBM says you cannot retrieve the credentials after clicking OK. The exact incident-read permission label and where the UI shows the Organization ID were not on the fetched page.
Source: ibm.com, checked 2026-10-07.
The permissions Safeguard needs:
read on incidents. -
On Compliance › Connectors, open IBM QRadar SOAR, click Connect, choose API token and fill in:
Field What to enter Base URL Required. Your own server: an https address reachable from the internet. Organization ID Required. API key ID Required. API key secret Required. Stored encrypted and never shown again. -
Click Connect with token.
Frameworks
Safeguard's automated tests read IBM QRadar SOAR and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC7.3, CC7.4 | 2 |
| ISO/IEC 27001 | Automated tests | A.5.26 | 2 |
| HIPAA Security Rule | Automated tests | 164.308(a)(6) | 2 |
| PCI DSS | Automated tests | 12.10.1 | 2 |
| NIST CSF 2.0 | Automated tests | RS.MA-03, RS.MI-02 | 2 |
These tests are switched on per workspace by the Safeguard team.
Related
- Security Automation connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks