> ## Documentation Index
> Fetch the complete documentation index at: https://docs.reyhford.com/llms.txt
> Use this file to discover all available pages before exploring further.

# IBM QRadar Integration

> Connect QRadar to the Reyhford TAXII 2.1 threat intelligence feed.

Configure IBM QRadar to poll Reyhford STIX indicators via TAXII 2.1.

## Prerequisites

* QRadar 7.4+ with TAXII support
* Reyhford API key
* Network egress to `api.reyhford.com`

## TAXII feed configuration

1. Navigate to **Admin → Threat Intelligence → TAXII Feeds**.
2. Click **Add TAXII Feed**.
3. Configure:

| Parameter           | Value                             |
| ------------------- | --------------------------------- |
| Name                | `Reyhford ICS/OT Feed`            |
| Server Address      | `api.reyhford.com`                |
| Server Port         | `443`                             |
| Use SSL             | Yes                               |
| Discovery Path      | `/taxii2/`                        |
| Collections         | `reyhford-global-feed`            |
| Authentication Type | HTTP Header                       |
| Header              | `Authorization: Bearer <api-key>` |
| Poll Interval       | 3600 seconds                      |

4. Save and click **Poll Now** to test.

## Indicator usage

QRadar maps STIX indicators to **Reference Data** and **Offense rules**. Recommended rules:

* Match source IP against `Reyhford-ICS-Indicators` reference set
* Elevate severity when confidence ≥ 70 and protocol is Modbus/S7/BACnet

## Validate connectivity

```bash theme={null}
curl -s https://api.reyhford.com/taxii2/collections/ \
  -H "Authorization: Bearer $REYHFORD_API_KEY" \
  -H "Accept: application/taxii+json;version=2.1"
```

## Related

* [List Collections](/api-reference/taxii/collections)
* [Authentication](/authentication)