Installing the app

If you configured the IBM® QRadar Assistant app, you can use it to download and install the IBM QRadar SOAR Plug-in app. Alternatively, you can download the app from the IBM Security App Exchange and use the Extension Management tool to install it.

Before you begin

  • Before you install the QRadar SOAR Plug-in app, ensure that both the IBM QRadar and SOAR deployments meet the minimum system requirements.
  • If you are reinstalling the app, create a backup by downloading the configuration files in the /store/docker/volumes/<plugin_app_id> folder.

  • Install the IBM QRadar SOAR Plug-in 5.x content pack from the IBM Security App Exchange.

  • Copy SOAR CA certificates to the QRadar Console and restart ecs-ep service on the console to allow access to the SOAR inbound destinations. For more information, see Configuring access to the inbound destinations

  • For SOAR for Managed Security Service Providers setup, ensure the API key used for QRadar SOAR Plug-in configuration is part of all the MSSP organizations.

Procedure

  1. Choose one of the following methods to download your app:
    • If the IBM QRadar Assistant app is configured in QRadar, you can use it to install the QRadar SOAR Plug-in 5.x app.

      For more information, see Downloading apps with the IBM QRadar Assistant app (www.ibm.com/docs/en/SS42VS_SHR/com.ibm.apps.doc/t_qradar_adm_assistant_download.html).

    • If the QRadar Assistant app is not configured, or if you are installing QRadar SOAR Plug-in 4.x, download the .zip file from IBM Security App Exchange (https://apps.xforce.ibmcloud.com/) onto your local computer.

      You must have an IBMid to access the IBM Security App Exchange.

  2. If you downloaded the app from the App Exchange, complete the following steps to install the app:
    1. On the QRadar Console, click Admin > Extensions Management.
    2. In the Extension Management window, click Add and select the app archive that you want to upload to the console.
    3. Select the Install immediately checkbox.

      You might have to wait several minutes before your app becomes active.

    4. To create multiple tenants of the app, complete the following steps:
      1. Uncheck Start a default instance of each app in the installation wizard.
      2. Select Yes when prompted to manage the app with the IBM QRadar Assistant.
      Tip: You can create multiple instances of the app by using the IBM QRadar Assistant.
    5. To preview the contents of an app after it is added and before it is installed, select it from the list of extensions, and click More Details. Expand the folders to view the individual content items in each group.

What to do next

  • When the installation is complete, clear your browser cache, and refresh the browser window before you use the app.
  • Configure the QRadar SOAR Plug-in by following the instructions in Configuration.