Configuring a QRadar managed host on Google Cloud Platform

Configure an IBM® QRadar® managed host on a Google Cloud Platform (GCP) instance by using the provided image.

1. Go to QRadar Security Intelligence Platform Managed Host v7.3.2 P1 (https://console.cloud.google.com/marketplace/details/ibm-security-public/qradar-mh?q=IBM%20qradar&id=19dda1c2-9483-4ddc-a7bf-43e5e0d2fc01).
2. Click LAUNCH.
3. Set a deployment name for the appliance that allows for a fully qualified domain name (FQDN) to be no more than 63 characters long. The FQDN consists of the deployment name, the zone, the project name, and .internal.

   For example, if your project name is abc-stq-xyz, the appliance deployment name is qr-con, the zone is us-east4-c, and the region is c, the FQDN is qr-con-vm.us-east4-c.c.abc-stq-xyz.internal. The zone can be between 10 and 25 characters long. Depending on the zone, this leaves somewhere between 25 and 40 characters to be split between your project name and your deployment name.

4. Select the zone that your project is in.
5. Select a Machine Type that meets the system requirements for virtual appliances.
6. Select the network interface that you created.
7. Set the firewall rules for your appliance that allow ports 22 and 443 only from trusted IP addresses to create an allowlist of IP addresses that can access your QRadar deployment.
   In a QRadar deployment with multiple appliances, other ports might also be allowed between managed hosts. For more information about what ports might need to be allowed in your deployment, see Common ports and servers used by QRadar.
8. Check I accept the GCP Marketplace Terms of Service.
9. Click Deploy.
10. Set a static IP address for your appliance.
    1. Click Google Cloud Platform > Compute Engine > VM instances.
    2. Select your appliance from the list.
    3. Click Edit.
    4. Edit the network interface.
       • Set the Internal IP type parameter to Static and reserve a new IP address.
       • Select or create a static External IP address.
    5. Click Done.
11. When the instance is ready, log in using SSH and your key pair by typing the following command:

    ssh -i <key.pem> cloud-user@<public_IP_address>

12. Type the following command to check the length of your FQDN:

    hostname -f | wc -c

    If the command returns a value greater than 63 installation will fail. Restart this procedure with a shorter deployment name.
13. Type the following command for the virtual appliance that you're installing:

    sudo /root/setup_mh <appliance_type_id>

    For example, to deploy an Event Collector type the following command:

    sudo /root/setup_mh 1599

    You can install the following managed host appliance types:

    Table 1. Appliance types

    Appliance type ID	Appliance type
    1299	Flow Collector
    1400	Data Node
    1599	Event Collector
    1699	Event Processor
    1799	Flow Processor
    1899	Event and Flow Processor

14. The system prompts you to set the root password. Set a strong password that meets the following criteria.
    • Contains at least 5 characters
    • Contains no spaces
    • Can include the following special characters: @, #, ^, and *.
15. Type the following command to restart the host and complete the installation:

    sudo reboot

16. Become the root user by typing the following command:

    sudo -i

17. Update the license file to address the issue described in APAR IJ30161 (https://www.ibm.com/support/pages/apar/IJ30161) by typing the following command:

    echo -n "QRadar:Q1 Labs Inc.:0007634bda1e2:WnT9X7BDFOgB1WaXwokODc:12/31/20" | tee /opt/qradar/ecs/license.txt /opt/ibm/si/services/ecs-ep/current/eventgnosis/license.txt /opt/ibm/si/services/ecs-ec-ingress/current/eventgnosis/license.txt /opt/ibm/si/services/ecs-ec/current/eventgnosis/license.txt /usr/eventgnosis/ecs/license.txt /opt/qradar/conf/templates/ecs_license.txt

18. Exit the superuser shell by typing the following command:

    exit

19. Add the host to your deployment in QRadar.
    1. On the navigation menu ( ), click Admin.
    2. In the System Configuration section, click System and License Management.
    3. In the Display list, select Systems.
    4. On the Deployment Actions menu, click Add Host.
    5. Configure the settings for the managed host by providing a static IP address, and the root password to access the operating system shell on the appliance.
    6. Click Add.
    7. Optional: Use the Deployment actions > View Deployment menu to see visualizations of your deployment. You can download a PNG image or a Microsoft Visio (2010) VDX file of your deployment visualization.
    8. On the Admin tab, click Advanced > Deploy Full Configuration.
       Important: QRadar continues to collect events when you deploy the full configuration. When the event collection service must restart, QRadar does not restart it automatically. A message displays that gives you the option to cancel the deployment and restart the service at a more convenient time.