IBM QRadar Security Information and Event Management (SIEM) integration reference

• Configuration
  If you are integrating BMC Helix Multi-Cloud Broker with an on-premises instance of ITSM, enter the following values:

  Field	Value
  Site	Select the site that you created for Remedy.
  AR server	Enter the name of your on-premises AR System server.
  AR server port	Enter the port number for your on-premises AR System server.

• Account
  Add a ITSM user account that has permissions to view business service requests and permissions to update incidents, change, or problem requests.

• Configuration
  While activating BMC Helix Multi-Cloud Broker, BMC configures the Multi-Cloud connector. Do not modify the default Multi-Cloud connector configuration.

• Account
  BMC sets up the account for the Multi-Cloud connector.
  Click to re-authenticate after you have changed the password for your tenant administrator user account in BMC Helix Innovation Studio.
  For information about changing the user password, see Creating or modifying Person data .

• Configuration

  Field	Value
  Name	Enter a name for the connector configuration.
  Description	Enter a description for the configuration.
  Site	Select Cloud.
  Number of instances	Keep the default value.
  QRadar Server URL	Enter the URL of QRadar SIEM server.

• Account
  • Add the account of a QRadar SIEM user who can view and update offenses

• Configuration
  To send email notifications for errors, specify values for the following fields:

  Field	Value
  Name	Enter a name for the connector configuration.
  Site	Select the appropriate site for your email server.
  Connection type	Select the type of connection for your email server.

• Account
  Add an email account to be used for sending error notifications.

• Trigger

  Do not specify any trigger conditions.

• Field Mapping

  BMC Helix Multi-Cloud Service Management fields	QRadar SIEM fields
  Summary	Description
  Priority	Severity
  Description	Description Magnitude
  Status Note: The value of this field is set to New.	NA
  Urgency	Severity
  Impact	Severity
  Incident Type Note: The value of this field is set to Infrastructure Event.	NA
  Vendor Note: The value of this field is set to QRadar.	NA
  Vendor Ticket Id	Offense Id

• Trigger

  Ensure that status is set to open.

• Field Mapping

  BMC Helix Multi-Cloud Service Management fields	QRadar SIEM fields
  Summary	Description
  Priority	Severity
  Description	Description
  Status Note: The value of this field is set to New.	NA
  Urgency	Severity
  Impact	Severity
  Incident Type Note: The value of this field is set to Security Incident.	NA
  Reported Source Note: The value of this field is set to Other.	NA
  Vendor Note: The value of this field is set to QRadar.	NA
  Vendor Ticket Id	Offense Id
  Webhook Condition Parameter Note: The value of this field is set to Remedy.	NA

• Trigger

  Do not change the out-of-the-box webhook trigger condition.

• Field Mapping

  QRadar SIEM fields	BMC Helix Multi-Cloud Service Management fields
  Offense Id	associatedGUID
  Note Text	CommentText Note: To change the Note text, you can add conditional mapping in the flow.

• Trigger

  Do not specify any trigger conditions.

• Field Mapping

  BMC Helix Multi-Cloud Service Management fields	QRadar SIEM fields
  Status	Status
  Vendor Note: The value of this field is set to QRadar.	NA
  Vendor Ticket Id	Offense Id
  Vendor Ticket Properties Note: Retain the out-of-the-box mappings	NA

• Trigger

  Field	Value
  Condition is Note: In this field, retain the webhook condition.	NA
  Include All Fields is	True
  Source ID contains	QRadar

• Field Mapping

  BMC Helix Multi-Cloud Broker fields	QRadar SIEM fields
  Vendor Ticket Id	Offense ID
  Not applicable	The status is set to Closed.

• Trigger

  Field	Value
  Shared with Vendor	True

• Field Mapping

  Do not change the following out-of-the-box field mappings.

  Field	Value
  post_type	comment#vendor
  ticketNumber	Incident Number
  Attachment Object 1.name	Attachment 1 filename
  Attachment Object 1.content	Attachment 1
  Attachment Object 2.name	Attachment 2 filename
  Attachment Object 2.content	Attachment 2
  Attachment Object 3.name	Attachment 3 filename
  Attachment Object 3.content	Attachment 3

  Note

  You can change the out-of-the-box field mapping for the text field. Default value is set to Notes.

  However, BMC recommends that you retain the existing mapping.

• Trigger

  Field	Value
  Shared with Vendor	True

• Field Mapping

  Do not change the following out-of-the-box field mappings.

  Field	Value
  post_type	comment#vendor
  ticketNumber	Incident Number
  Author	Full name
  Attachment Object 1.name	Attachment 1 filename
  Attachment Object 1.content	Attachment 1
  Attachment Object 2.name	Attachment 2 filename
  Attachment Object 2.content	Attachment 2
  Attachment Object 3.name	Attachment 3 filename
  Attachment Object 3.content	Attachment 3

  Note

  You can change the out-of-the-box field mapping for the text field. Default value is set to Notes.

  However, BMC recommends that you retain the existing mapping.

By default, the Create Incident Activity Note flow is used. Instead of the default flow, if you want to use the Create Incident Activity Note with Author flow, you must make changes to the flow.

For more information about using the flow, see Updating flows.

• Trigger

  Field	Value
  Flow Target	Multi-Cloud

• Field Mapping

  Field	Value
  To	Enter the email account that will receive the error notification.
  Subject	Flow Title
  From Note: The value of this field is set to Integration Service.	NA

  Note

  You can change the following out-of-the-box field mappings:

  • Subject
  • From

  However, BMC recommends that you retain the existing mappings.
  

For the MCSM ITSM connector target, define the connection configuration and profile required by the connector process.