1 Reply · Latest reply on Oct 24, 2017 2:36 AM by Dravvy Ramlochun

    QRadar Integration

      Hi All,

      I need to connet QRadar SIEM to ServiceNow using the Mid-Server.

      Which ports I need to open between QRadar and Mid-Server ?




        • Re: QRadar Integration
          Dravvy Ramlochun

          Hello vingenzo


          The MidServer communicates securely on port 443 to the instance and requires no inbound connections. In some cases, it might be necessary to allow this communication through the firewall if the MID Server fails to register on the instance. To determine if the application or a network security restriction is to blame for connection failure, attempt to telnet to the instance on port 443 from the server that is hosting the MID Server application. If this connection fails, then the problem could be a web proxy (since 443 is a https connecton) or a Firewall rule preventing external TCP connections from that host. Contact network security personnel for the proxy information to add to the config.xml file, or request that the Firewall be configured to allow access using one of the following syntaxes:

          • <source IP> to <any>
          • <source IP> to <ServiceNow> any established
          • <source IP> to <instance_name.service-now.com> 443

          Additionally, ensure the MID server can connect to install.service-now.com to download and install updates.


          as the mid server is configured in your network and the QRadar is also in your network, so you can communicate on any port you wish, even 443 is ok

          Please Hit ✅Correct, ⭐️Helpful, or ❣️Like depending on the impact of the response