Installing the QRadar Advisor with Watson app
Use the IBM® QRadar® Extensions Management tool to install the QRadar Advisor with Watson™ app on your QRadar Console.
Before you begin
If QRadar Advisor with Watson fails to install, then your application pool does not have enough free memory to run. Consider adding an app node or an app host to your QRadar deployment.
QRadar 7.3.3 and later uses an App Host, which is a managed host, that is dedicated to running apps. App Hosts provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar Console. For more information, see App Host.
About this task
- Install the QRadar Advisor with Watson
- If the IBM QRadar Assistant app is configured on QRadar, use the following instructions to install the QRadar Advisor with Watson app: Downloading apps with the QRadar Assistant app.
- If the IBM QRadar Assistant app is not configured, download the QRadar Advisor with Watson app archive from the IBM Security App Exchange onto your local computer. You must have an IBM ID to access the IBM Security App Exchange.
- On the navigation menu ( ), click Admin.
- Click System Configuration and then click Extensions Management.
- In the Extensions Management window, click Add and select the app archive that you downloaded from Step 1.
Select the Install immediately checkbox.
Important: You might have to wait several minutes before your app becomes active.
- To preview the contents of an app after it is added and before it is installed, select it from the list of extensions, and click More Details. Expand the folders to view the individual content items in each group.
On the Admin tab, click .
Note: Depending on which version of QRadar you have the QRadar Advisor with Watson app installed on, the following content packages are also installed:
- QRadar Advisor with Watson Log Source Contents
- Cyber Adversary Framework Mapping App Because of the dynamic nature of the mapping extension generation, an alert message indicating that the extension is installed and not signed displays. This is expected behavior.