Applying and allocating a QRadar SIEM license key

Obtain and apply an IBM® QRadar® license key to migrate your IBM QRadar Log Manager software to QRadar SIEM.

Before you begin

If your QRadar Log Manager is in a High-Availability pair, you must break the pair before you apply the QRadar SIEM license key.

All rule changes including custom rules, saved searches, and reports are reset to the defaults that are in QRadar SIEM. Your changes to rules, saved searches, and reports are lost. Because versions change between the two products, a backup and restore does not preserve your configured rules.

Follow these guidelines to maintain your configurations:

  • Note any rules, searches, and reports that you want to keep, and then re-create them after the migration
  • Export rules, searches, and reports that you want to maintain by using the content management tool

The content management tool restores settings between deployments.

Procedure

  1. Download the QRadar license key to your desktop system.
  2. Log in to QRadar Log Manager.
  3. Click the Admin tab.
  4. Under System Configuration, click System and License Management.
  5. In the System and License Management window, select the QRadar Console that has the QRadar Log Manager license key.
  6. Click Upload License.
  7. Click Select File to locate and select the QRadar SIEM license key.
  8. Click Open.
  9. Click Upload.
  10. Return to the System and License Management window to allocate your QRadar SIEM license key.
    1. From the Display list, select Systems.
    2. Right-click your QRadar Log Manager system.
    3. Select Allocate License to System.

Results

After you migrate, the following settings are maintained:

  • Log sources and log source extensions
  • Retention settings and forwarding rules
  • User configuration, but limited settings for a user in QRadar Log Manager can require updated user settings in QRadar SIEM
  • Network hierarchy and log source groups

What to do next

Available QRadar SIEM capabilities after migration