Skip to main content

Hello,

Can I forward all alerts from Chronicle to my on-premises SIEM QRadar?

Thank you

Using Google Chronicle SOAR:

  • QRadar Integration: Chronicle SOAR offers a built-in integration with QRadar. This allows you to configure connectors that fetch offenses from QRadar and create corresponding alerts in Chronicle SOAR.  
  • Forwarding from SOAR: Once alerts are in Chronicle SOAR, you can use its automation playbooks to forward them to your on-premises QRadar. SOAR provides flexibility in how you format and transmit the alerts.  

2. Using a Custom Integration (more advanced):

  • Chronicle API: You can leverage the Chronicle API to programmatically retrieve alerts.  
  • QRadar API: Similarly, QRadar has an API that allows you to send events and offenses to it.  
  • Custom Script/Application: You would need to develop a script or application that uses both APIs to fetch alerts from Chronicle and forward them to QRadar. This gives you more control but requires development effort.