Integration · SIEM

HailBytes + IBM QRadar

Findings that parse correctly the first time, without hand-writing a DSM extension.

What you get

  • Pre-formatted CEF and LEEF. Field mappings ship with the integration, so DSM parsing and correlation rules work without a custom extension per deployment.
  • Syslog RFC 5424 transport. Standard, auditable, and firewall-friendly — no agent to deploy on the QRadar side.
  • Both products. ASM attack-surface findings and SAT campaign events (phish clicks, credential captures, training completions) forward through the same channel.
  • Severity floor per project. Control what reaches QRadar so EPS licensing stays predictable — usually the deciding constraint on what teams are willing to forward.

You operate your own QRadar deployment with your own credentials. Nothing about your IBM licensing changes, and no HailBytes component runs inside your QRadar environment.

SIEM setup guide → API reference → All integrations →