Installing the Lookout Mobile Threat Defense Extension in your QRadar environment enables Lookout mobile threat and device events to flow into your SIEM instance. This enables the integration of mobile security threat, device, and audit events into your company’s security incident and event programs, as well as policies for action.

The Lookout Mobile Threat Defense Extension polls the Lookout RESTful Mobile Risk API every 30 seconds and requests new threat, device, and audit events that have occurred since the last successful poll. The app then writes the events to QRadar’s SysLog. The Lookout Mobile Threat Defense Extension is available for download from IBM’s QRadar app exchange.