Changing QRadar user passwords

IBM® QRadar® occasionally changes the password policy to align with current security standards. When the password policy is updated, users who have local passwords are prompted to update their password the first time that they log in after the upgrade. In very few situations, some users may not be prompted to change their password after the upgrade, and you will have to change it for them.

To change SIEM user passwords, complete the following steps:
  1. On the Admin tab, click Users.
  2. Select a user from the list and click Edit.
  3. In the User Details pane, enter the new password for the user, and click Save.
To change PCAP user passwords, complete the following steps:
  1. On the Admin tab, click System and License Management.
  2. Select Systems View from the Display list.
  3. Highlight your QRadar Incident Forensics device.
  4. On the Deployment Actions menu, click Edit Host.
  5. Select the Component Management Settings icon.
  6. In the PCAP Device Management window, reenter or change the login password for the user and click Save.
  7. On the Admin tab, click Advanced > Deploy Full Configuration for the changes to take effect.
To change FTP user passwords, complete the following steps:
  1. On the Admin tab, click Forensics User Permissions.
  2. Select a user from the Users list on the left side of the window.
  3. In the Edit User pane, check the Enable FTP access box.
  4. Reenter or change the password for the user.
  5. Under Assigned Cases, click Save User.