What this integration does
This integration sends AI agent events to IBM QRadar in LEEF over syslog, with a suggested mapping to QRadar categories, and reads AI-related offenses back into your record. Analysts see agent activity in the SIEM they already use, while AI owners can see where offenses touch their systems.
Benefits
Use cases
Reviewing AI access decisions
A bank's SOC runs on QRadar and needs to see what its internal agents try to do. AI access events appear in the console beside other activity, which gives analysts useful context during routine reviews.
Keeping AI events on a public-sector SIEM
A public agency keeps security monitoring on its own QRadar deployment. AI agent events reach that same console, so its analysts can watch agent activity without adding a separate monitoring place to their day.
Connecting offenses to claims agents
An insurer's analysts raise an offense that touches an agent used in claims work. The AI-related offense also appears in the AI record, which helps the agent's owner and the SOC talk from shared facts.
Coverage is confirmed for your environment during onboarding. Product names belong to their owners and are used only to describe a technical connection.