Send logs to IBM QRadar

Create a stream that sends the logs of your applications to the URL of an IBM QRadar instance, in Azion Console or with the Azion API, and confirm the delivery.

Last updated

View as Markdown Agent setup

You can send the logs of a stream to IBM QRadar from Azion Console or with the Azion API. To send the events of a Web Application Firewall to a SIEM instead of the requests of your applications, refer to Stream WAF events to a SIEM.

Data Stream sends each batch of log lines to a URL of your QRadar instance. The URL is the only setting of this endpoint, with no key or token to enter. The stream form sets the endpoint in the field labeled Connector, where QRadar is the IBM QRadar option. For the field and its bounds, refer to Endpoints.

This guide streams the requests of one workload through the Applications data source.

Select your interface here. The prerequisites and the tasks below follow that choice.

Prerequisites

  • An Azion account with the Edit Data Stream permission. For the permissions, refer to Stream settings.
  • A workload on the account that receives requests.
  • Access to your IBM QRadar instance, to get the URL that receives the log lines.
  • That URL, with its scheme, such as https://qradar.example.com:14440.

Create the stream

The stream takes its logs from one workload, through a workload filter. Sampling would deactivate your other streams; a workload filter does not.

Send a POST request to https://api.azion.com/v4/workspace/stream/streams. In the body, replace <workload-id> with the ID of your workload and the url value with the URL of your QRadar instance. Replace [TOKEN VALUE] with your personal token:

Shell
01curl -X POST 'https://api.azion.com/v4/workspace/stream/streams' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d {
05 "name": "logs-to-qradar",
06 "active": true,
07 "inputs": [
08 { "type": "raw_logs", "attributes": { "data_source": "workloads" } }
09 ],
10 "transform": [
11 { "type": "filter_workloads", "attributes": { "workloads": [<workload-id>] } },
12 { "type": "render_template", "attributes": { "template": 2 } }
13 ],
14 "outputs": [
15 {
16 "type": "qradar",
17 "attributes": {
18 "url": "https://qradar.example.com:14440"
19 }
20 }
21 ]
22 }

The data source workloads is the API name of Applications, and template 2 is Applications Event Collector. The qradar endpoint takes url as its only attribute. The API answers 201 and returns the stored stream:

JSON
01{
02 "state": "executed",
03 "data": {
04 "id": 12355,
05 "name": "logs-to-qradar",
06 "last_editor": "user@example.com",
07 "created": "2026-01-01T12:10:40.000000Z",
08 "last_modified": "2026-01-01T12:10:40.000000Z",
09 "product_version": "1.0",
10 …
11 "outputs": [
12 {
13 "type": "qradar",
14 "attributes": {
15 "url": "https://qradar.example.com:14440"
16 }
17 }
18 ]
19 }
20}

The id identifies the stream in later requests, such as /v4/workspace/stream/streams/12355. For every key of the body, refer to Stream settings.

To create the stream in Azion Console:

Open Data Stream

Access Azion Console > Data Stream.

Select + Stream
Name the stream

In the General section, enter a Name. For example: logs-to-qradar.

Select the data source

In the Input section, select Applications in Data Source.

Turn off Sampling

In the Transform section, turn off Sampling while Option is still All Current and Future Workloads, its starting value. A stream cannot carry sampling and a workload filter together.

Choose the workload

In the Transform section, set Option to Filter Workloads. Select your workload in Available Workload, then use the arrow to move it to Chosen Workload.

Select the template

In the Render Template section, select Applications Event Collector in Template.

Select the QRadar endpoint

In the Output section, select IBM QRadar in Connector.

Enter the QRadar URL

In URL, enter the URL of your QRadar instance. For example: https://qradar.example.com:14440.

Keep the stream active

In the Status section, leave Active on.

Select Save

The Console confirms with Your data stream has been created. In the Data Stream list, the stream shows QRadar in the Connector column and the Active status.

Azion saves the stream without a call to the QRadar URL. A wrong URL shows only when the stream sends. The activation takes effect after one to two minutes.

Confirm the delivery

Real-Time Events keeps a record of each send of a stream, delivered or not, with the status code that the endpoint returned. Send a few requests to the workload and wait about one minute. A stream sends a batch every 60 seconds, or earlier when the batch reaches 2,000 log lines.

To read the sends with the API, query the dataStreamedEvents dataset of the Real-Time Events GraphQL API. Set the dates to a range that includes the activation of the stream:

Shell
01curl -X POST 'https://api.azion.com/v4/events/graphql' \
02 -H 'Content-Type: application/json' \
03 -H 'Authorization: Token [TOKEN VALUE]' \
04 -d '{"query":"query { dataStreamedEvents(limit: 20, filter: {tsRange: {begin: \"2026-01-01T12:00:00\", end: \"2026-01-01T12:45:00\"}}, orderBy: [ts_DESC]) { ts endpointType statusCode streamedLines dataStreamed } }"}'

The API answers 200 with one record per send, the latest first:

JSON
01{
02 "data": {
03 "dataStreamedEvents": [
04 {
05 "ts": "2026-01-01T12:02:04Z",
06 "endpointType": "QRADAR",
07 "statusCode": 200,
08 "streamedLines": 2,
09 "dataStreamed": 2797
10 }
11 ]
12 }
13}

A send to QRadar carries QRADAR in endpointType. A statusCode of 200 means QRadar accepted the batch. The streamedLines and dataStreamed fields give the size of the batch in log lines and in bytes. If dataStreamedEvents is an empty list, the stream did not send in that range. For every field, refer to Real-Time Events GraphQL fields.

To read the sends in Azion Console:

Open Real-Time Events

Access Azion Console > Real-Time Events.

Select the Data Stream data source
Find the QRadar sends

Each row is one send. Look for QRADAR in Endpoint Type, and read the Status Code of those rows.

A 200 in Status Code means QRadar accepted the batch. Streamed Lines shows how many log lines the batch held.

A status other than 200 comes from QRadar, except 503: that status means Data Stream found the endpoint unavailable. For the causes, refer to Troubleshoot Data Stream.

Next steps

EndpointsThe URL field of the IBM QRadar endpoint, with its type and API name.Stream WAF events to a SIEMSend the events of a Web Application Firewall to QRadar or another SIEM.Edit, stop, or delete a streamChange the QRadar URL, pause the stream, or remove it.Troubleshoot Data StreamFind what to change when a send returns a status other than 200.