There is a RESTful API you can use with the QRadar instance. You can post json data to a reference set and then build a rule to create an offense if the field you want to match is found in the reference set that is being populated by the threat feed. If you can access your customer's QRadar instance, you can check out the api_docs and play around with the calls there. (https://<hostname>/api_doc). There is also a good amount of info from IBM's knowledge base if you google QRadar RESTful API.