Installing the QRadar Network Insights content extension

QRadar® Network Insights content extensions include extra content, such as rules, reports, searches, and custom properties, that can be used to provide in-depth analysis, alerts, and reports in QRadar Network Insights deployments.

Before you begin

Download the QRadar Network Insights content extension to your local computer from the IBM® Security App Exchange (https://exchange.xforce.ibmcloud.com/hub/extension/5faf57a09236654323cbc4db41bd74f4).

Procedure

  1. Log in to the QRadar Console as an administrator.
  2. On the navigation menu ( Navigation menu icon ), click Admin.
  3. Click Extension Management.
  4. To upload an extension and install it immediately, follow these steps:
    1. Click Add and select the extension to upload.
    2. To install the extension immediately, select the Install immediately check box, and then click Add.
  5. To preview the contents of an extension before you install it, follow these steps:
    1. Select the extension from the list, and click More Details.

      The content items are compared to content items that are already in the deployment. If the content items exist, you can choose to overwrite them or to keep the existing data.

    2. Select Replace existing items. This setting ensures that existing custom properties are updated when the extension is installed.
    3. Click Install.
    4. Review the installation summary, and click OK.

Results

After the extension is added, a yellow caution icon in the Status column indicates potential issues with the digital signature. Hover the mouse over the triangle for more information. Extensions that are unsigned or are signed by the developer, but not validated by your vendor, might cause compatibility issues in your deployment.