IBM QRadar Integration - Reyhford Threat Intelligence

Configure IBM QRadar to poll Reyhford STIX indicators via TAXII 2.1.

Prerequisites

QRadar 7.4+ with TAXII support
API key from reyhford.com/portal
Network egress to reyhford.com (API path /api)

TAXII feed configuration

Navigate to Admin → Threat Intelligence → TAXII Feeds.
Click Add TAXII Feed.
Configure:

Parameter	Value
Name	`Reyhford ICS/OT Feed`
Server Address	`reyhford.com` (path prefix `/api`)
Server Port	`443`
Use SSL	Yes
Discovery Path	`/taxii2/`
Collections	`ics-feed` or `global-feed`
Authentication Type	HTTP Header
Header	`Authorization: Bearer <api-key>`
Poll Interval	3600 seconds

Save and click Poll Now to test.

Indicator usage

QRadar maps STIX indicators to Reference Data and Offense rules. Recommended rules:

Match source IP against Reyhford-ICS-Indicators reference set
Elevate severity when confidence is 100 (multi-sensor) or protocol is Modbus/S7/BACnet

Validate connectivity

curl -s https://reyhford.com/api/taxii2/collections/ \
  -H "Authorization: Bearer $REYHFORD_API_KEY" \
  -H "Accept: application/taxii+json;version=2.1"

​Prerequisites

​TAXII feed configuration

​Indicator usage

​Validate connectivity

​Related

Prerequisites

TAXII feed configuration

Indicator usage

Validate connectivity

Related