Use the IBM®
QRadar®
Extensions Management tool or the IBM
QRadar Assistant app to install
the IBM
QRadar Use Case Manager app on your QRadar
Console.
Before you begin
Before you install the QRadar Use Case
Manager app, ensure that it
meets the minimum memory (RAM) requirements. QRadar Use Case
Manager requires 500 MB of free
memory from the application pool of memory. If QRadar Use Case
Manager fails to install, then
your application pool does not have enough free memory to run the app. Consider adding an App Host
to your QRadar deployment.
For more information about calculating the required memory, see Apps and Resource Limitation
(https://ibm.com/support/pages/qradar-apps-and-resource-limitation).
QRadar 7.4.0 or later
uses an App Host, which is a managed host, that is dedicated to running apps. App Hosts provide
extra storage, memory, and CPU resources for your apps without impacting the processing capacity of
your QRadar Console. For
more information, see https://www.ibm.com/support/knowledgecenter/SS42VS_latest/com.ibm.qradar.doc/c_qradar_deployment_apphost.html.
Procedure
- Choose one of the following methods to download your app:
- If the IBM
QRadar
Assistant app is configured on QRadar, use the following
instructions to install the QRadar Use Case
Manager app: QRadar Assistant app
(https://www.ibm.com/support/knowledgecenter/SS42VS_SHR/com.ibm.apps.doc/t_qradar_adm_assistant_download.html).
- If the QRadar
Assistant app is not configured, download the QRadar Use Case
Manager app archive from the IBM Security App
Exchange (https://apps.xforce.ibmcloud.com/) onto your local computer. You must have an IBM ID to access the App
Exchange.
-
If you downloaded the app from the App Exchange, complete the following steps:
- On the QRadar
Console, click .
- In the Extension Management window, click
Add and select the app archive that you want to upload to the console.
- Select the Install immediately checkbox.
Important: You might have to wait several minutes before your app becomes active.
- To preview the contents of an app after it is added and before it is installed, select
it from the list of extensions, and click More Details. Expand the folders to
view the individual content items in each group.
- If IBM
QRadar Advisor with Watson is
installed in your environment, it includes the Cyber Adversary Framework Mapping
app. This MITRE-mapping app is no
longer needed when you install QRadar Use Case
Manager 2.3.0 or later. To remove
the Cyber Adversary Framework Mapping
app, follow steps 5 and 6 in
Upgrading QRadar Use Case Manager.
Results
If the app installed successfully, you see it listed as 'Installed' on the
Extensions Management page of the Admin tab. If the app
didn't install correctly, see QRadar apps troubleshooting.