Enabling your app to run on QROC (QRadar on Cloud)

QRoC users are not admin users of QRadar. Any configuration is done by the IBM ops team. To ensure that QRoC users are able to use your app make sure that you only restrict configuration pages to admin in your app manifest (other components of your app should not have a Required_Capabilities field). This way you restrict on-prem QRadar configuration to admin users (which is the preferred workflow) but also allow QRoC users to use the rest of your app. For QRoC users when they want to install your app, they can have the IBM ops team do the one time configuration of your app.

If you want your app to query QRadar’s APIs in the background you must use an Authorized Service Token and not user credentials for authentication. This is the preferred method for both on-prem QRadar users and QRoC.

If your app requires QRadar command line access on a continual basis to run (i.e. you need to ingest a content export from the content management tool) then your app will not be QRoC ready. QRoC customers do not have access to the command line of their environment and we cannot add the extra workload on the IBM ops team.