Get Started
IBM partners, customers, and service providers can augment QRadar functionality in several ways. You can develop a Device Support Module (DSM), security content, or an app.
Once you've developed a new capability, you can deliver it by creating an extension. IBM partners can make the extension available in the IBM Security App Exchange for download. Customers and service providers can deploy the extension in their internal QRadar environment.
Let's get started!
1. Develop
You can develop a Device Support Module (DSM), security content, or an app.
DSM
A device support module (DSM) is a code module that parses events from a log source and converts them to a format that can be used and displayed by QRadar. DSMs exist for many log sources but you might need to develop one for your own needs.
Security content
Security content refers to content such as rules, reports, searches, reference sets, and custom properties. This content is delivered as content package (also called a content extension). Security content can be a stand-alone capability or associated with an app.
App
An app adds new functionality to the QRadar GUI such as dashboard items, menu buttons, pages, and more.
2. Deliver
Once you've developed a new capability, such as an app or DSM, you can deliver it by creating an extension. Details differ for IBM partners vs. customers and service providers.
IBM partners
IBM partners make their extension available in the IBM Security App Exchange for download.
Customers and service providers
Customers and service providers can deploy the extension in their internal QRadar environment.
Resources
Resources are available for developers and for technology partners.
- Resources for developers
A list of technical resources including product documentation, blogs and other information
- Getting started for Technology Partners
Information on everything from getting setup with QRadar, to getting your extension into the IBM Security App Exchange, and marketing your extension