Installing QRadar Threat Intelligence

Use the IBM® QRadar® Extensions Management tool to install IBM QRadar Threat Intelligence on your QRadar Console.

Before you begin

QRadar Threat Intelligence is supported on QRadar V 7.4.0 or later.

Attention:

Before you install QRadar Threat Intelligence, ensure that it meets the minimum memory (RAM) requirements. QRadar Threat Intelligence requires 800 MB of free memory from the application pool of memory. If QRadar Threat Intelligence fails to install, then your application pool does not have enough free memory to run the app. Consider adding an App Host to your QRadar deployment. For more information, see Apps and Resource Limitation (https://ibm.com/support/pages/qradar-apps-and-resource-limitation).

QRadar V7.4.0 or later use an App Host, which is a managed host, that is dedicated to running apps. App Hosts provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar Console. For more information, see https://www.ibm.com/support/knowledgecenter/SS42VS_latest/com.ibm.qradar.doc/c_qradar_deployment_apphost.html.

About this task

You must have QRadar administrator privileges to access and use QRadar Threat Intelligence.

Procedure

  1. Choose one of the following methods to download your app:
    • If the IBM QRadar Assistant app is configured on QRadar, use the following instructions to install QRadar Threat Intelligence: QRadar Assistant app (https://www.ibm.com/support/knowledgecenter/SS42VS_latest/com.ibm.apps.doc/c_qradar_adm_assist_app.html).
    • If the QRadar Assistant app is not configured, download the QRadar Threat Intelligence app archive from the IBM Security App Exchange (https://apps.xforce.ibmcloud.com/) onto your local computer. You must have an IBM ID to access the App Exchange.
  2. If you downloaded the app from the App Exchange, complete the following steps:
    1. On the QRadar Console, click Admin > Extensions Management.
    2. In the Extension Management window, click Add and select the app archive that you want to upload to the console.
    3. Select the Install immediately checkbox.
      Important: You might have to wait several minutes before your app becomes active.
    4. To preview the contents of an app after it is added and before it is installed, select it from the list of extensions, and click More Details. Expand the folders to view the individual content items in each group.
  3. When the installation is complete, clear your browser cache and refresh the browser window to see the Threat Intelligence tab.

Results

If the app installed successfully, you see it listed as 'Installed' on the Extensions Management page of the Admin tab. If the app didn't install correctly, see QRadar apps troubleshooting.

What to do next

Creating an authorized service token