Installing the QRadar Advisor with Watson app

Use the IBM® QRadar® Extensions Management tool to install the QRadar Advisor with Watson™ app on your QRadar Console.

Before you begin

Attention: Before you install the app, ensure that IBM QRadar meets the minimum memory (RAM) requirements. The QRadar Advisor with Watson app requires 1024 MB and for the bundled QRadar Use Case Manager 500 MB of free memory are required from the application pool of memory.

If QRadar Advisor with Watson fails to install, then your application pool does not have enough free memory to run. Consider adding an app node or an app host to your QRadar deployment.

QRadar 7.3.3 and later uses an App Host, which is a managed host, that is dedicated to running apps. App Hosts provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar Console. For more information, see App Host.

About this task

Attention: After the app is installed, you must deploy the full configuration.

Procedure

  1. Install the QRadar Advisor with Watson app.
    • If the IBM QRadar Assistant app is configured on QRadar, use the following instructions to install the QRadar Advisor with Watson app: Downloading apps with the QRadar Assistant app.
    • If the IBM QRadar Assistant app is not configured, download the QRadar Advisor with Watson app archive from the IBM Security App Exchange onto your local computer. You must have an IBM ID to access the IBM Security App Exchange.
  2. On the navigation menu ( Navigation menu icon ), click Admin.
  3. Click System Configuration and then click Extensions Management.
  4. In the Extensions Management window, click Add and select the app archive that you downloaded from Step 1.
  5. Select the Install immediately checkbox.
    Important: You might have to wait several minutes before your app becomes active.
  6. To preview the contents of an app after it is added and before it is installed, select it from the list of extensions, and click More Details. Expand the folders to view the individual content items in each group.
  7. On the Admin tab, click Advanced > Deploy Full Configuration.
    Note: Depending on which version of QRadar you have the QRadar Advisor with Watson app installed on, the following content packages are also installed:
    • QRadar Advisor with Watson Log Source Contents
    • Cyber Adversary Framework Mapping App Because of the dynamic nature of the mapping extension generation, an alert message indicating that the extension is installed and not signed displays. This is expected behavior.
    Extension Manager installed components

Results

If the app installed successfully, you see it listed as 'Installed' on the Extensions Management page of the Admin tab. If the app didn't install correctly, see QRadar apps troubleshooting.

What to do next

When the installation is complete, clear your browser cache and refresh the browser window before you use the app.