Creating or deleting accounts

As a system administrator, you can create Standard or Provider accounts in IBM Security QRadar® Suite Software, or delete existing accounts. You must be working in the System Administration account and have the required permission to manage accounts.

Before you begin

Read the information in Users and accounts and in User access, roles, and permissions.

Before you create an account, at least one identity provider must be configured with the users that you want to add to your account. For more information, see Configuring identity provider authentication.

Procedure

  1. On the home page, from the Quick navigation section, select Account management.
  2. In the action bar, click Create account.
  3. In the create account window, enter the account name, description, type, and select one or more identity providers.
    • Choose a unique name and do not reuse the name of a deleted account. Account names must be at least 4 characters long.
    • Select from the configured identity providers.
    • Select an account type. Standard accounts are stand-alone, while Provider accounts are used to manage other accounts.
  4. Click Create account.

Results

See the successful completion message for a Standard account and find your new account in the account list with a status of 'Active'.

A Provider account takes a little longer to create. Initially, a Provider account has a status of 'Initializing'. You receive a notification in the Provider account when the account is active.

An account creator is automatically a member of the account. But, account membership can be removed by the account Admin.

Deleting accounts

You might need to delete an account that is obsolete or inaccurate. An account that is selected for deletion is immediately unavailable with a status of 'Delete scheduled'. However, the deletion can be canceled and the account can be restored by a cluster administrator within the delay period.

About this task

Important: You cannot delete the System Administration account.
Tip: Before you delete a Provider account, you must delete all its Standard accounts. For more information about Provider accounts, see Creating or deleting accounts.

Procedure

  1. On the home page, from the Quick navigation section, select Account management.
  2. Click the checkbox for the accounts that you want to remove.
  3. Click Delete accounts.
  4. Check the information in the confirmation message, enter DELETE, and click Delete accounts.

Results

The default delay period for pending deletion is 14 days when the account status is 'Delete scheduled'. This delay period can be reset. After the delay period, the account is deleted within a 24-hour deletion period when the account status is 'Delete processing'. The account cannot be recovered during this time. See the following table for examples of how deletion is implemented for different delay settings.

Tip: You can cancel an account deletion while the account status is 'Delete scheduled'. For more information, see Restoring an account that is marked for deletion.
Table 1. Implementing account deletion delay
Parameter value Delay period (variable) Deletion processing period (fixed)
0 None 24 hours
14 14 days 24 hours
30 30 days 24 hours
For more information, see Setting the account deletion delay parameter.

When an account is deleted, it is removed from the list of accounts.