Follow these steps if you want to add another traffic monitoring interface after you
install IBM®
QRadar® Network Insights.
Procedure
-
Create a network interface and add it to the QRadar Network
Insights instance.
- Create a network interface in the same VPC and subnet as your QRadar Network
Insights instance.
Give it a name that you can easily recognize.
- Attach the interface to your QRadar Network
Insights instance.
- In the AWS Console, view the QRadar Network
Insights instance and note the new
device name.
For example, the device name might be
eth2.
- Use SSH to log in to the QRadar Console as root
user.
- From the QRadar
Console, use SSH to connect to the QRadar Network
Insights instance as root
user.
- Specify the configuration parameters for the QRadar Network
Insights instance.
- Create the per-interface configuration file
/etc/sysconfig/network-scripts/ifcfg-<device name> where
<device name> is the name of the interface.
- Edit the configuration file and add or update the following parameters:
BOOTPROTO=none
DEVICE=<device name>
IPV6INIT=no
ONBOOT=yes
MTU=9001
- Restart the
hostcontext
service.
systemctl restart hostcontext
- Verify that the new interface is added to the device list file.
/opt/qradar/conf/capabilities/device.list
What to do next
Log in to QRadar and
add a flow source for the new network interface. Ensure that the flow source is enabled.