Supported environments for QRadar Data Synchronization
For the app to work correctly, you must use a supported IBM® QRadar® version, a supported web browser, and meet the destination site requirements.
Supported versions of QRadar
The IBM QRadar Data Synchronization app is installed separately on the main site and the destination site.
The following table describes which version of QRadar Data Synchronization to use with QRadar.| QRadar version | Data Synchronization version |
|---|---|
| 7.4.3 and later | 3.1.1 |
| 7.4.1 fix pack 2 to 7.4.2 fix pack 3 | 3.0.0 |
| 7.4.0 fix pack 3 to 7.4.1 fix pack 2. | 2.1.0 |
A deployment with domains requires QRadar 7.4.2 or later and QRadar Data Synchronization 2.0.0 or later.
QRadar Data Synchronization 3.0.0 supports QRadar Network Insights appliances that use QRadar 7.5.0 Update Package 1 or later. For more information, see Pairing managed hosts.
- QRadar Data Synchronization is not supported on QRadar on Cloud
High-availability support
QRadar Data Synchronization 3.1.0 supports high-availability (HA). The following list provides guidelines for HA.
- The Data Synchronization app must be fully upgraded to version 3.1.0 before you add HA hosts to the deployment.
- All Data Synchronization functionality (pairing, activation, fail back, reactivation, Ariel copy, backup transfer and restore) works when HA hosts are added to the deployment.
- Pairing between non-HA hosts on the main site and HA hosts on the destination site is blocked and is not supported.
- The restore process (on demand and auto restore) can not complete, if the main site is non-HA and HA was added to the destination site after the hosts were paired.
Destination site deployment requirements
The destination site deployment must be a fully duplicated deployment (1:1 host ratio) for hosts that contain or collect Ariel (event and flow) data as well as QRadar Network Insights hosts. For more information QRadar Network Insights mapping, see Pairing managed hosts.
| Component | Requires 1:1 mapping |
|---|---|
| Event processor | Yes |
| Flow processor | Yes |
| Combo Event/Flow processor | Yes |
| Event collectors | Yes |
| Flow collectors | Yes |
| QRadar Console | Yes |
| Data nodes | Yes |
| QRadar Network Insights | Yes |
| QRadar Risk Manager | No |
| QRadar Vulnerability Manager | No |
| QRadar Incident Forensics | No |
| App Host | No |
A destination site host requires equal or greater storage to their paired main site host.
Supported Browsers
QRadar Data Synchronization is supported on Google Chrome and Mozilla Firefox.
Port usage
QRadar Data Synchronization uses the following ports to communicate between the main and destination sites.
| Port | Protocol | Direction | Requirements |
|---|---|---|---|
| 22 | TCP |
Bidirectional traffic between the main console and the destination console. Bidirectional traffic between the main managed host and the paired destination-managed host. |
Configuration and data synchronization for communication between the main console and the
destination console. Data synchronization between the main managed host and the paired destination-managed host. |
| 443 | TCP | Bidirectional traffic between the main console and the destination console. | Access to the QRadar API |