Integration

​

What is QRadar Integration

• Centralized logging
• Correlation with other security signals
• Threat detection and investigations
• Compliance and audit visibility

​

What Events Does Snapsec Send

• User management events (create, update, delete)
• Authentication and authorization actions
• Asset changes
• Vulnerability lifecycle events
• Configuration changes
• Integration and automation activities
• Administrative and audit actions

​

Event Schema

{
  "type": "audit",
  "action": "create_user",
  "request": {
    "url": "/v1/users",
    "params": {},
    "query": {},
    "headers": {
      "user-agent": "curl/8.0.1"
    }
  },
  "response": {
    "body": {
      "id": "u_123",
      "status": "created"
    },
    "headers": {
      "content-type": "application/json"
    }
  },
  "metadata": {
    "ip": "203.0.113.10",
    "userId": "admin_1",
    "traceId": "abc-xyz"
  },
  "timestamp": "2026-01-27T10:15:30.000Z"
}

​

Field Overview

• type
  The category of the event.
  Example: audit
• action
  The specific action performed within Snapsec.
  Example: create_user, delete_asset
• request
  Details about the API request that triggered the event, including:
  • URL
  • Parameters
  • Query values
  • Request headers
• response
  The result of the action, including:
  • Response body
  • Response headers
• metadata
  Additional contextual information such as:
  • IP address of the actor
  • User ID who performed the action
  • Trace ID for request correlation
• timestamp
  The exact time when the event occurred, formatted in ISO 8601.

  ​

  How to Connect Snapsec with QRadar

1

Open your Snapsec profile

Log in to Snapsec Suite and click on your profile icon in the top-right corner.

2

Navigate to Integrations

Select Integrations from the settings sidebar.

3

Select QRadar

Locate QRadar from the list of available integrations and click on it.

4

Enter QRadar details

Provide the following information:

• QRadar URL
• Bearer Token

5

Save and verify

Click Save to enable the integration.
Once completed, QRadar will appear under Installed Adapters, confirming the connection.

​

Verification

• Confirm the adapter status is shown as Installed in Snapsec.
• Check QRadar logs to ensure Snapsec events are being received.
• Verify that events are parsed and indexed correctly inside QRadar for search and correlation.

​

Explore Live Demo