---
title: IBM QRadar Actions
description: "## Actions for IBM QRadar - ***Send Data to IBM QRadar***. Sends a custom set of Lucidum data to IBM QRadar. ## Use Cases Below are the possible use cases for these actions: - If you want to run Lucidum…"
url: "https://lucidum.io/docs/ibm-qradar-actions/"
updated: "2025-09-22"
category: Actions / List of Actions / I
---

# IBM QRadar Actions

## Actions for IBM QRadar

- ***Send Data to IBM QRadar***. Sends a custom set of Lucidum data to IBM QRadar.

## Use Cases

Below are the possible use cases for these actions:

- If you want to run Lucidum “headless”, you can send relevant data to IBM QRadar on a regular schedule.
- You can send normalized, enriched Lucidum data to IBM QRadar to be indexed, searched, and analyzed.

## Prerequisites

To execute IBM QRadar actions, you must:

- Configure a IBM QRadar API connection beforehand. For details, see [https://lucidum.io/docs/ibm-security-qradar/](https://lucidum.io/docs/ibm-security-qradar/).

**NOTE**: The specified account should have **read and write**permissions.

## Workflows

- [Creating a new Configuration and a new Action](https://lucidum.io/docs/overview-of-actions#workflow_for_creating_configurations_and_actions_in_lucidum)
- [Cloning an Existing Action](https://lucidum.io/docs/overview-of-actions#workflow_using_clone_to_create_a_new_action)
- [Creating a new Action from the Location Results page](https://lucidum.io/docs/overview-of-actions#alternative_workflow_for_creating_an_action)
- [Editing a Configuration](https://lucidum.io/docs/overview-of-actions#workflow_for_editing_a_configuration)
- [Editing an Action](https://lucidum.io/docs/overview-of-actions#workflow_for_editing_an_action)
- [Viewing Information about an Action](https://lucidum.io/docs/overview-of-actions#viewing_information_about_an_existing_action_and_executing_an_action_on_demand)

## IBM QRadar Configuration

To create a configuration for IBM QRadar actions:

![ibm_qradar_configuration.png](https://lucidum.cloud/docs/ibm_qradar_configuration.png)

- ***Configuration Name***. Identifier for the Configuration. This name will appear in the Lucidum Action Center.
- ***URL***. The URL for the IBM QRadar Console. For example, http://ip_address/api.
- ***Username***. User name for an IBM QRadar account with read and write access to the IBM QRadar API. For details, see [https://www.ibm.com/docs/en/qradar-common?topic=api-endpoint-documentation-supported-versions#c_rest_api_getting_started.dita__title__5](https://www.ibm.com/docs/en/qradar-common?topic=api-endpoint-documentation-supported-versions#c_rest_api_getting_started.dita__title__5).
- ***Password***. The password for the IBM QRadar account with read and write access to the IBM QRadar API. For details, see [https://www.ibm.com/docs/en/qradar-common?topic=api-endpoint-documentation-supported-versions#c_rest_api_getting_started.dita__title__5](https://www.ibm.com/docs/en/qradar-common?topic=api-endpoint-documentation-supported-versions#c_rest_api_getting_started.dita__title__5).
- ***Max # of Records per Payload***. The maximum number of records to send to IBM QRadar in each action. The default value is “50”.

## Create a New Action

To create an action for IBM QRadar, contact Lucidum customer care.