Supported environments for QRadar Data Synchronization

For the app to work correctly, you must use a supported IBM® QRadar® version, a supported web browser, and meet the destination site requirements.

Supported versions of QRadar

The IBM QRadar Data Synchronization app is installed separately on the main site and the destination site.

The following table describes which version of QRadar Data Synchronization to use with QRadar.
Table 1. Supported versions of QRadar
Data Synchronization version QRadar version
3.2.0 or later QRadar 7.5.0 Update Package 9 and later

A deployment with domains requires QRadar 7.4.2 or later and QRadar Data Synchronization 2.0.0 or later.

QRadar Data Synchronization 3.0.0 supports QRadar Network Insights appliances that use QRadar 7.5.0 Update Package 1 or later. For more information, see Pairing managed hosts.

Important:
  • QRadar Data Synchronization is not supported on QRadar on Cloud

High-availability support (Normal QRadar Data Synchronization app)

QRadar Data Synchronization 3.1.0 supports high-availability (HA) for the normal (1:1) pairing scenario. The following list provides guidelines for HA.

  • The Data Synchronization app must be fully upgraded to version 3.1.0 before you add HA hosts to the deployment.
  • All Data Synchronization functionality (pairing, activation, fail back, reactivation, Ariel copy, backup transfer and restore) works when HA hosts are added to the deployment.
  • Pairing between non-HA hosts on the main site and HA hosts on the destination site is blocked and is not supported. However, you can pair HA hosts on the main site with non-HA hosts on the destination site.
  • The restore process (on demand and auto restore) can not complete, if the main site is non-HA and HA was added to the destination site after the hosts were paired.
Important: Console-only QRadar Data Synchronization does not integrate with High Availability (HA) configurations for the following reasons:
  • HA is not supported in the Console-only failover: Users must remove HA from destination site and main site before the failover operation. Users can add the HA only when the failover process is complete.
  • Integrated HA Failback Process is not supported: Users must remove HA from destination site and main site before the failback operation. Users can add the HA only when the failback process is complete.

Destination site deployment requirements

The destination site deployment must be a fully duplicated deployment (1:1 host ratio) for hosts that contain or collect Ariel (event and flow) data as well as QRadar Network Insights hosts. For more information QRadar Network Insights mapping, see Pairing managed hosts.

Table 2. Mapping requirements for QRadar components
Component Requires 1:1 mapping
Event processor Yes
Flow processor Yes
Combo Event/Flow processor Yes
Event collectors Yes
Flow collectors Yes
QRadar Console Yes
Data nodes Yes
QRadar Network Insights Yes
QRadar Risk Manager No
QRadar Vulnerability Manager No
QRadar Incident Forensics No
App Host No

A destination site host requires equal or greater storage to their paired main site host.

Supported Browsers

QRadar Data Synchronization is supported on Google Chrome and Mozilla Firefox.

Port usage

QRadar Data Synchronization uses the following ports to communicate between the main and destination sites.

Table 3. Ports used by QRadar Data Synchronization
Port Protocol Direction Requirements
22 TCP

Bidirectional traffic between the main console and the destination console.

Bidirectional traffic between the main managed host and the paired destination-managed host.

Configuration and data synchronization for communication between the main console and the destination console.

Data synchronization between the main managed host and the paired destination-managed host.

443 TCP Bidirectional traffic between the main console and the destination console. Access to the QRadar API