Appliance configuration

After your IBM® QRadar® Network Insights appliance is installed, you must attach the appliance to the QRadar Console as a managed host.

On initial installation, QRadar Network Insights is configured to capture a maximum of 64 bytes of raw payload data. There are a number of configuration changes that you can make after the software is installed, such as changing the size of the payload capture, the flow collector format, and traffic decryption settings.

After the appliance is configured, it reads the raw packets from the network tap or span port and then generates IPFIX packets. The IPFIX packets are sent to flow processes in the deployment.