Install: TruSTAR for IBM QRadar

Updated 1 year ago by TruSTAR

This document explains how to install and configure the TruSTAR Workflow App for IBM QRadar. 

QRadar Terms

  • Event: The log of some particular action on a network device at a point in time. Examples of such actions can include an SSH login on a UNIX server, or a Firewall Deny logged by a perimeter firewall. 
  • Offense: A collection of related events. For example, an SSH login repeated on the same UNIX server over a short period of time can be defined as an offense. 
  • Reference Set: Data stored in a simple list format. In the TruSTAR integration, reference sets contain Indicators from TruSTAR. You can use this data in searches, filters, rule test conditions, and rule responses.


QRadar version: 7.2.8 --> 7.3.2.

QRadar user accounts:

  • at least 1x account with "Admin" permissions to install / configure the TruSTAR add-on.
    • must have these QRadar privileges:
      • TruSTAR Application
      • IP Right Click Menu Extension Capabilities
  • Non-Admin accounts for add-on users.
    • Can:
      • manually submit events / offenses.
      • manually hunt.
    • Cannot:
      • alter TruSTAR add-on settings.

Installation Options

2 options:

Installing the App

To install the TruSTAR Workflow App for QRadar, follow these instructions.

  1. Navigate to the QRadar Admin tab.
  2. Click Extension Management.
  3. Click Add and select the TruSTAR App bundle.
  4. Click Install Immediately, then click OK to begin the installation. 

You now see the TruSTAR Workflow App settings on the QRadar Admin page and GUI buttons for TruSTAR actions you can take.  

Configuring the App

Before you begin using the TruSTAR App, you must first configure it using a QRadar Admin account. 





QRadar Authorized Service Token


To retrieve this token:

  1. Navigate to Admin-> Authorized Services.
  2. Click Add Authorized Service.
  3. Enter the service name.
  4. Select Admin as User Role and Admin as Security Profile, then check No Expiry.
  5. Click Create Service.
  6. Click Deploy Change on the Admin Page toolbar.

TruSTAR Server URL


The TruSTAR URL from which data is collected by executing API calls. Set this parameter to 

TruSTAR Access Key


Used to make API calls. Finding your API Key

TruSTAR Secret Key


Used when making API calls. Finding your API Secret

Enclave IDs for Pull (Hunt)


The TruSTAR Enclave ID(s) where you want to search for Indicator enrichment. If left blank, it will search all TruSTAR Enclaves you have access to.To specify multiple Enclaves, separate each Enclave ID with a comma and no spaces:

Best Practice:

  • Avoid importing from more Enclaves than you need to as each one takes time to process.

Enclave IDs for Submit


The TruSTAR Enclave IDs to submit events and offenses to.To submit data to multiple Enclaves, separate each Enclave ID with a comma and no spaces:

Retrieving your Enclave IDs

Max Events per Offense


The number of events to process for a single offense. The maximum is 200 Events.

Offense Exclusion Filter


The Offense sources to filter out when submitting Offenses to TruSTAR. To enter multiple values, separate each value with a comma; for example:,User Logout

Event Exclusion Filter


The event types to filter out when submitting events to TruSTAR. To enter multiple values, separate each value with a comma; for example: eventA,eventB

An event is anything triggered by a rule, for example, an SSH login from a UNIX server or a firewall rule being triggered. You can learn more about QRadar filters here.

Enable Auto Submission


Automatically sends Offenses to TruSTAR. You can set these options:

  • Interval between submissions (Poll Interval). The default value is 5 minutes.
  • Maximum number of Offenses to process for each interval. The maximum is 200 Offenses. 

IOC Feed


Automatically collects TruSTAR Indicators into QRadar reference sets. You can choose the interval between checks by setting the Poll Interval value. 

You can learn more about QRadar reference sets here

Enable/Disable Proxy


If you use a proxy, you must specify the following information: 

  • IP/Hostname (do not include http/https)
  • Port

Require Authentication for Proxy


If you have a proxy enabled and it requires authentication, then select this checkbox. You must provide a username and password for the proxy server. 

Best Practices

  • Create an email account specifically for your QRadar integration (ex:
  • Create a user account in the TruSTAR Web App tied to that QRadar integration email address. You will need access to that email account so you can open the account verification email TruSTAR Station will send to it.  Your Qradar instance will use this account’s API credentials
  • Check that the TruSTAR URL is not blocked in your firewall or proxy rules.
  • Check your TruSTAR API limits.

How Did We Do?