KQL query visualization in Grafana dashboards

Use the IBM Security QRadar® Suite KQL Plugin to run Kusto Query Language (KQL) queries against your IBM Security QRadar Suite KQL instance.
A Grafana dashboard panel displays your query results.
The Grafana plugin distribution also includes sample dashboard JSON.

For more information about the plugin, see IBM Security QRadar Suite KQL Plugin User Documentation.
For more information about KQL queries, see Kusto Query Language (KQL) overview.

Configuring an IBM Security QRadar Suite data source in Grafana

Configure an external data source for IBM Security QRadar Suite in your Grafana instance to communicate with IBM Security QRadar Suite.

Before you begin

Verify that the IBM Security QRadar Suite KQL Plugin is installed.

1. In your Grafana instance, from the navigation menu, click Administration > Plugins.
2. In the Search field, enter IBM Security QRadar Suite. The status of your IBM Security QRadar Suite KQL Plugin is displayed.
3. For more information about the IBM Security QRadar Suite KQL Plugin, click the IBM Security QRadar Suite tile.
4. To configure an IBM Security QRadar Suite data source in Grafana, you must complete the following tasks:
   • Obtain your IBM Security QRadar Suite KQL cluster URL from your IBM Security QRadar Suite instance.
   • Collaborate with an IBM Security QRadar Suite administrator to obtain an IBM Security QRadar Suite Grafana user API Key and user API Secret.
   • Collaborate with an IBM Security QRadar Suite administrator to obtain an IBM Security QRadar Suite account ID.

Procedure

1. In your Grafana instance, from the navigation menu, click Administration > Data Sources.
2. On the Data sources page, click Add new data source.
3. In the Filter by name or type field, enter IBM Security QRadar Suite, and then select the IBM Security QRadar Suite tile.
4. In the Host field, enter your IBM Security QRadar Suite KQL cluster URL.
5. In the API Key field, enter your IBM Security QRadar Suite Grafana user API Key.
6. In the API Secret field, enter your IBM Security QRadar Suite Grafana user API Secret.
7. In the Account ID field, enter your IBM Security QRadar Suite account ID.
8. Click Save & test. If your configuration is successful, a Data source is working message is displayed.

Importing sample dashboards

JSON files of pre-constructed dashboards are available on the IBM Security QRadar Suite KQL data source configuration page.
Use the sample dashboards as a reference for creating your own dashboards.

About this task

If you change a sample dashboard, you are prompted to save or overwrite your changes.
If you want to save your changes to a new dashboard, click Save as. Otherwise, your changes are lost.

Important

If you save a copy of a sample dashboard, the unique identifier (UID) value in the dashboard's data link URL changes.
You must update both the UID value and name in the data link URL of any dashboards that reference the dashboard that you saved.
For more information, see Configure data links.

Procedure

1. In your Grafana instance, from the navigation menu, click Administration > Data Sources.
2. On the Data sources page, select the IBM Security QRadar Suite data source from the table.
3. On the IBM Security QRadar Suite page, click the Dashboards tab.
4. Find the row of the sample dashboard that you would like to import and click Import.
5. From the navigation menu, click the Dashboards icon.
6. On the Dashboards page, click the sample dashboard that you imported. The sample dashboard is displayed.