FAQs about apps

What is an app?

Apps create or add new functionality in QRadar by providing new tabs, API methods, dashboard items, menus, toolbar buttons, configuration pages, and more within the QRadar user interface. You download apps from the IBM Security App Exchange. Apps that are created by using the GUI Application Framework Software Development Kit integrate with the QRadar user interface to deliver new security intelligence capabilities or extend the current functionality.

Every downloaded file from the IBM Security App Exchange is known as an extension. An extension can consist of an app or security product enhancement (content extension) that is packaged as an archive (.zip) file, which you can deploy on QRadar by using the Extensions Management tool on the Admin tab.

Who can create an app?

You can use the GUI Application Framework Software Development Kit to create apps. For more information about the GUI Application Framework Software Development Kit, see the IBM Security QRadar App Framework Guide.

You download (https://exchange.xforce.ibmcloud.com/hub/extension/517ff786d70b6dfa39dde485af6cbc8b) the SDK from IBM developerWorks®.

How do I share my app?

Only certified content is shared in the IBM Security App Exchange, a new platform for collaborating where you can respond quickly and address your security and platform enhancement requirements. In the IBM Security App Exchange, you can find available apps, discover their purpose, and what they look like, and learn what other users say about the apps.

How do I get an app that I downloaded into QRadar?

A QRadar administrator downloads an extension, imports it into QRadar by using the Extensions Management tool that is used to upload the downloaded extension from a local source. You can also use the QRadar Assistant app to select the app you have downloaded. For more information about the Assistant app, see QRadar Assistant app.

Where do I get help for an app?

You can see information about an app in the overview section when you download the app from the IBM Security App Exchange. For apps developed solely by IBM, you can find information in the IBM Knowledge Center.

In the Additional Information section in the IBM Security App Exchange, a link to the documentation for the app provides you with up-to-date help.

How do I contact customer support for an app?

From the X-Force Application Exchange or from the QRadar Assistant app, select the app. On the right side of the page, a Support section contains information about how to contact customer support for apps that are created by IBM or by an IBM Business Partner.

How much memory does an app need?

The combined memory requirements of all the apps that are installed on a QRadar Console cannot exceed 10 per cent of the total available memory. If you install an app that causes the 10 per cent memory limit to be exceeded, the app does not work.

If your app requires a minimum memory allocation, you must provide information about it in your app's documentation.

What is the difference between an app, an extension, and a content extension?

An extension is a term that is used for everything that you download from the IBM Security App Exchange. Extensions that contain content only, such as rules, reports, searches, reference sets, and dashboards, are referred to as content extensions. Some extensions contain apps that enhance the features and functions of QRadar. Extensions that contain apps often include new content that is designed to help you get the maximum benefit from the app features.

How do I install an app?

QRadar applications reside on the QRadar Console appliance. Administrators can install applications with the QRadar Assistant app, which can be accessed from the shield icon on the dashboard. You can configure the QRadar Assistant app to use your X-Force® Exchange account to single-click install or update applications. Install and manage your applications from the QRadar Assistant App, which is included during installation. Administrators can also use the Extensions Management tool on the Admin tab to download and manually upload applications. Each application's home page on the X-Force app Exchange provides QRadar on Cloud compatibility information. To determine whether an application is QRadar on Cloud ready, go to your application's home page and select Additional Information, and check if the value of <QRadar on Cloud Ready> is <Yes> or <No>.

If you experience installation issues with an application or you require more system resources, contact IBM support.

QRadar applications are provided from the IBM X-Force Exchange. To check whether IBM supports an app, log in to the IBM X-Force Exchange and search for IBM applications. Every app includes documentation information and support entitlement in the sidebar description for the app.

For more information, see QRadar IBM application cases and support policies and QRadar third party application and support policies.

How do I upgrade an app?

You are responsible for upgrading the QRadar applications.

To upgrade an application:

1. Log in to QRadar and select QRadar Assistant.
2. Select Applications in the upper right of the page.
3. To update an application, select the application.
4. Click See full description, and then click Update.
5. To update all the applications at once, click Update, and then click Agree.

_{(Back to top)}