Administering

To administer the system, you must understand the administration roles, tasks, and tools that are available to you.

How you manage accounts and users depends on whether you are a system administrator, a managed security services provider, or the owner of a standard account. Each application has different roles and permissions. For more information, see Users and accounts and User access, roles, and permissions.

For more information about the concepts related to license and usage, see Licensing and entitlement.

To understand domain and certificates in QRadar® Suite Software, see Domain name and TLS certificates.

To assist the system administrator for QRadar Suite Software, support actions are provided to ease the management of domain and certificates, you must install a utility to use the actions. With the utility, you can also access a range of support actions for troubleshooting. For more information, see the Troubleshooting section. If you are in an air-gapped environment, follow the procedure to apply updates to support actions.

As system administrator, schedule backups so that you can recover from any data loss that might occur. Review the data retention policy so that you can address data storage requirements and performance issues. If you run out of disk space, resize the Persistent Volume Claim that QRadar Suite Software uses for data by following the instructions in the Resizing PVCs topics.

The system administrator can control whether QRadar Suite Software is upgraded automatically or manually by setting an approval strategy. Modify the deployment parameters or specifications by using the configuration custom resource or deployment modification tool instructions.

As an account configuration administrator, you can change the account settings (name, description, or identity provider) for the account, or select a Threat Intelligence Insights plan or organization profile. A user management administrator can add, view, or edit access for users in an account.

A data sources administrator can view, connect, and configure Universal Data Insights data sources for an account. They can also create, update, and remove Connected Assets and Risk data. For more information, see Connecting to data sources. This permission includes Configuring Threat Intelligence Insights external data sources. You must be an Admin for Edge Gateway Management to install, upgrade, or uninstall the IBM Security Edge Gateway.

For developers who need authentication to QRadar Suite Software API endpoints, you can create the API key that is required.