{"revision":"c10276e953456835cdbb1f3a60d58ae1980be353","document":{"id":44822,"path":"security-management/security-incident-response/qradar-ibm-setup-sn.md","title":"Set up your ServiceNow AI Platform instance for the IBM QRadar offense ingestion integration","bundle":null,"doc_type":null,"release":"australia","body":"\n# Set up your ServiceNow AI Platform instance for the IBM QRadar offense ingestion integration\n\nThe following section lists the setup tasks that you are required to complete in your ServiceNow AI Platform® instance prior to installing the application from the ServiceNow Store.\n\n## Before you begin\n\nRole required: sn\\_si.admin\n\n## About this task\n\nRefer to the following table and verify that you have completed all the listed tasks before you download and install the application to ensure a smooth installation and configuration.\n\n<table id=\"table_evy_hpv_3fb\"><thead><tr><th>\n\nSetup task\n\n</th><th>\n\nDescription\n\n</th></tr></thead><tbody><tr><td>\n\nVerify that you have assigned the required ServiceNow AI Platform® and Security Incident Response \\(SIR\\) roles.\n\n</td><td>\n\nThe following roles are required for the installation, setup, and use of the integration in your ServiceNow AI Platform® instance.\n\n -   A user with the ServiceNow AI Platform® administrator role \\(admin\\) installs the application from the ServiceNow Store and assigns the security incident administrator \\(sn\\_si.admin\\) role.\n-   A user with the sn\\_si.admin role oversees the following tasks in the ServiceNow AI Platform®:\n    -   Names, creates, and edits offense profiles.\n    -   Selects and maps IBM QRadar offense data fields to the security incident fields.\n    -   Previews security incident details for accuracy prior to finalizing the configuration.\n    -   Schedules on-going offense ingestion.\n    -   Enables offense updates when a SIR incident is created and closed.\n    -   Assigns the security incident analyst \\(sn\\_si.analyst\\) role.\n    -   Users with the sn\\_si.analyst work with security incidents.\n\n For more information about roles and assigning roles to users, see Roles on the [Servicenow Product Documentation website](https://www.servicenow.com/docs).\n\n</td></tr><tr><td>\n\nVerify that you are using the following versions:-   IBM QRadar version 7.3.2 or later.\n-   IBM QRadar API version 10 or later.\n\nEarlier versions are not supported.\n\n</td><td>\n\nIf you have access to the IBM QRadar console, you have access to the API that is required for this integration. There is no other special setup required for the API.\n\n</td></tr><tr><td>\n\nVerify that you have installed and configured a MID Server Application.\n\n</td><td>\n\nConfigured MID Server Application.A MID Server in your ServiceNow AI Platform® instance is required to connect to the IBM QRadar service if the IBM QRadar server is deployed within your corporate network. See the [ServiceNow Product Documentation website](https://www.servicenow.com/docs) for information about MID Servers.\n\n If you are using the IBM QRadar Cloud service, a MID Server is not required.\n\n</td></tr><tr><td>\n\nVerify that the ServiceNow core applications that are required to support the integration are installed and activated before you install the application for the integration.\n\n</td><td>\n\nVerify that the following Security Operations applications are installed and activated from the ServiceNow Store. If not installed, install and activate one application at a time in the following order to ensure a smooth installation.\n\n 1.  Security Incident Response\n2.  Event and Alert Ingestion for Security Operations: This application requires:\n\n    -   com.glide.hub.integration.runtime =&gt; ServiceNow IntegrationHub Runtime\n    -   com.glide.hub.action\\_step.rest =&gt; ServiceNow IntegrationHub Action Step - REST\n**Note:** The Integration Hub components are installed along with the Event and Alert Ingestion plugin. If these are not installed, contact Customer Support for assistance.\n\n\n For more information about installing the Security Operations core applications, see [Get entitlement for a Security Operations product or application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/entitle-secops-product.md) and [Activate a ServiceNow Store application](https://raw.githubusercontent.com/ServiceNow/ServiceNowDocs/australia/markdown/australia/security-management/activate-entitled-store-app.md).\n\n</td></tr></tbody>\n</table>## What to do next\n\nYou have successfully set up your ServiceNow AI Platform® instance for the integration. The next step is to install the IBM QRadar application from the ServiceNow Store for the integration.\n\n"}}