IBM partners, customers, and service providers can augment QRadar functionality in several ways. You can develop a Device Support Module (DSM), security content, or an app.

Once you’ve developed a new capability, you can deliver it by creating an extension. IBM partners can make the extension available in the IBM Security App Exchange for download. Customers and service providers can deploy the extension in their internal QRadar environment.

Let’s get started!

1. Develop

You can develop a Device Support Module (DSM), security content, or an app.

DSM

A device support module (DSM) is a code module that parses events from a log source and converts them to a format that can be used and displayed by QRadar. DSMs exist for many log sources but you might need to develop one for your own needs.

Security content

Security content refers to content such as rules, reports, searches, reference sets, and custom properties. This content is delivered as content package (also called a content extension). Security content can be a stand-alone capability or associated with an app.

App

An app adds new functionality to the QRadar GUI such as dashboard items, menu buttons, pages, and more.

2. Deliver

Once you’ve developed a new capability, such as an app or DSM, you can deliver it by creating an extension. Details differ for IBM partners vs. customers and service providers.

IBM partners

IBM partners make their extension available in the IBM Security App Exchange for download.

Customers and service providers

Customers and service providers can deploy the extension in their internal QRadar environment.

Resources

Resources are available for developers and for technology partners.