Installing QRadar Suite Software by using the Red Hat OpenShift CLI

After you take the prerequisite steps, install IBM Security QRadar Suite Software in an environment with internet connectivity by using the Red Hat OpenShift CLI.

1. Log in to your Red Hat OpenShift Container Platform cluster as a cluster administrator by typing one of the following commands, where <openshift_url> is the URL for your Red Hat OpenShift Container Platform environment.
   • Using a username and password.

     oc login <openshift_url> -u <cluster_admin_user> -p <cluster_admin_password>

   • Using a token.

     oc login --token=<token> --server=<openshift_url>

2. Set the $CP4S_NAMESPACE environment variable by typing the following command, where <cp4s_namespace> is the namespace where you are installing QRadar Suite Software.
   Important: If you install QRadar Suite Software in the all namespace mode, set the <cp4s_namespace> value as openshift-operators.

   export CP4S_NAMESPACE=<cp4s_namespace>

3. Create the namespace for QRadar Suite Software by typing the following command.

   oc new-project $CP4S_NAMESPACE

   The namespace must meet the following criteria:

   • Contain only lowercase alphanumeric characters or -
   • Start and end with an alphanumeric character
   • Be a dedicated namespace for QRadar Suite Software
   • Not be default, kube-*, or openshift-*
4. Create a secret for the Podman registry by typing the following commands, where <password> is your IBM Entitlement Registry secret.

   oc create secret podman-registry "ibm-entitlement-key" -n $CP4S_NAMESPACE \
        "--podman-server=cp.icr.io" \
        "--podman-username=cp" \
        "--podman-password=<password>"

5. If you are using your own domain and certificates, create a TLS secret.
   • If you are using a certificate from a trusted CA for your domain, create the TLS secret by typing the following command, where <path_to_certificate> is the path to the TLS certificate associated with your domain, and <path_to_key> is the path to the TLS key associated with your domain.

     oc create secret tls -n $CP4S_NAMESPACE isc-ingress-default-secret \
           --cert <path_to_certificate> \
           --key <path_to_key>

   • If you are using custom or self-signed certificates for your domain, create the TLS secret by typing the following command, where <path_to_CA> is the path to the custom TLS certificate associated with your domain, <path_to_certificate> is the path to the TLS certificate associated with your domain, and <path_to_key> is the path to the TLS key associated with your domain.

     oc create secret generic -n $CP4S_NAMESPACE isc-ingress-default-secret \
           --type=kubernetes.io/tls \
           --from-file=ca.crt=<path_to_CA> \
           --from-file=tls.crt=<path_to_certificate> \
           --from-file=tls.key=<path_to_key>

6. Install the IBM Operator Catalog Source.
   1. Create a file called ibmCatalogSource.yaml.
   2. Paste the following text into the file.

      apiVersion: operators.coreos.com/v1alpha1
      kind: CatalogSource
      metadata:
          name: ibm-operator-catalog
          namespace: openshift-marketplace
      spec:
          displayName: ibm-operator-catalog
          publisher: IBM Content
          sourceType: grpc
          image: icr.io/cpopen/ibm-operator-catalog
          updateStrategy:
              registryPoll:
                  interval: 45m

   3. Create the IBM Operator catalog source by typing the following command.

      oc apply -f ibmCatalogSource.yaml

   4. Verify that the pod is running in the openshift-marketplace namespace by typing the following command.

      oc get pod -lolm.catalogSource=ibm-operator-catalog -n openshift-marketplace

7. Install the QRadar Suite Software Operator.
   1. Create a file called operatorGroup.yaml.
   2. Paste the following text into the file.

      apiVersion: operators.coreos.com/v1
      kind: OperatorGroup
      metadata:
           name: cp4s-operator-group
           namespace: <cp4s_namespace>
      spec:
           targetNamespaces:
                - <cp4s_namespace>

   3. Create the QRadar Suite Software operator group by typing the following command.

      oc apply -f operatorGroup.yaml

   4. Verify that the QRadar Suite Software operator group is created by typing the following command.

      oc get og cp4s-operator-group -n $CP4S_NAMESPACE

   5. Create a file called subscription.yaml.
   6. Paste the following text into the file. Replace <operators_namespace> with either your QRadar Suite Software namespace for an isolated mode installation, or with openshift-operators for an installation where the QRadar Suite Software operators are available to all namespaces in the cluster.

      apiVersion: operators.coreos.com/v1alpha1
      kind: Subscription
      metadata:
           name: ibm-cp-security-operator
           namespace: <operators_namespace>
      spec:
           channel: v1.11
           installPlanApproval: Automatic
           name: ibm-cp-security-operator
           source: ibm-operator-catalog
           sourceNamespace: openshift-marketplace

   7. Create the QRadar Suite Software operator by typing the following command.

      oc apply -f subscription.yaml

      After a few seconds, the QRadar Suite Software is installed.
   8. Verify that the ClusterServiceVersion (CSV) for the operator is installed by typing the following command. Replace <operators_namespace> with either your QRadar Suite Software namespace or openshift-operators, according to your namespace choice used to apply the Operator Subscription in the previous step.

      oc get csv -n <operators_namespace> | grep ibm-cp-security-operator

      Wait until the output of this command shows Succeeded before you proceed to the next step.
   9. Verify that the operator is running by typing the following command.

      oc get pod -A -lname=ibm-cp-security-operator

8. Install QRadar Suite Software Threat Management.
   1. Create a file called cp4sThreatManagement.yaml.
   2. Paste the following text into the file. Replace <username> with the username of the initial admin user and <cp4s_namespace> with your QRadar Suite Software namespace.

      apiVersion: isc.ibm.com/v2
      kind: CP4SThreatManagement
      metadata:
          name: threatmgmt
          namespace: <cp4s_namespace>
      spec:
          license:
              accept: true
          basicDeploymentConfiguration:
              adminUser: <username>
              domain: ""
              storageClass: ""
          extendedDeploymentConfiguration:
              airgapInstall: false
              clusterProxy: false
              backupStorageClass: ""
              backupStorageSize: ""
              imagePullPolicy: IfNotPresent
              repository: cp.icr.io/cp/cp4s
              repositoryType: entitled
          threatManagementCapabilities:
              deployDRC: true
              deployThreatInvestigator: true

   3. Use the information in the following table to set the parameters in cp4sThreatManagement.yaml.

      Table 2. QRadar Suite Software installation parameters

      Parameter	Description	Do you need to update this parameter?
      adminUser	The user that is to be given administrator privileges in the QRadar Suite Software System Administration account after installation. Specify a username or an email address that exists in your identity provider.	Yes
      airgapInstall	Set to false.	No
      clusterProxy	Set to true if you are installing in a cluster that is using a cluster-wide proxy. Set to false if you are not installing in a cluster that is using a cluster-wide proxy. Cluster-wide proxy is not supported in a disconnected environment.	No, unless you are installing in a cluster that is using a cluster-wide proxy.
      domain	The fully qualified domain name (FQDN) created for QRadar Suite Software. If you don't specify an FQDN, it is generated as cp4s.<cluster_ingress_subdomain>.	No, unless you want or specify your own FQDN.
      storageClass	The provisioned block or file storage class for all the PVCs required by QRadar Suite Software. When it is not specified, the default storage class is used. For more information, see Storage requirements.	No, unless you are using a storage class other than the default storage class for the cluster.
      backupStorageClass	Storage class for the backup and restore pod. If this value is not set, QRadar Suite Software takes the value from the storageClass parameter.	No, unless you are using a different storage class for the backup and restore pod than you set for the storageClass parameter.
      backupStorageSize	The storage size for the backup and restore PVC. Must be 500Gi or higher.	No, unless you need the storage size for the backup and restore pod to be greater than 500 Gi.
      imagePullPolicy	The pull policy for the images. When Red Hat OpenShift creates containers, it uses the imagePullPolicy to determine whether to pull the container image from the registry before starting the container. Options are Always, IfNotPresent, or Never.	No
      repository	The IBM Entitled Registry from which the images are pulled. Must be set to cp.icr.io/cp/cp4s.	No
      deployDRC	Set to false to skip deployment of Detection and Response Center.	No, unless you don't want to deploy Detection and Response Center.
      deployThreatInvestigator	Set to false to skip deployment of Threat Investigator.	No, unless you don't want to deploy Threat Investigator.

   4. Create the QRadar Suite Software Threat Management by typing the following command.

      oc apply -f cp4sThreatManagement.yaml

   Important: Installation takes approximately 1.5 hours. When installation is complete, the latest version of IBM Cloud Pak foundational services, and QRadar Suite Software 1.11.1 are installed.
9. Verify QRadar Suite Software installation by typing the following command.

   oc get CP4SThreatManagement threatmgmt -n $CP4S_NAMESPACE -o jsonpath='{.status.conditions}'

[{"lastTransitionTime":"<timestamp>","message":"Cloudpak for Security Deployment is successful","reason":"Deployment is complete","status":"True","type":"Success"}]% 

[{"lastTransitionTime":"<timestamp>","message":"SOAR automation functionality will be limited","reason":"Knative not Deployed","status":"True","type":"Degraded"}]%