Adding the QRadar Network Insights appliance as a managed host

After you install the QRadar Network Insights appliance, you must add the appliance to the QRadar Console as a managed host.

Before you begin

Ensure that the QRadar Network Insights appliance uses the same software version and fix pack level as the QRadar Console that you are using to manage it.

Procedure

  1. Log in to the QRadar Console as an administrator.
  2. On the navigation menu ( Navigation menu icon ), click Admin.
  3. In the System Configuration section, click System and License Management.
  4. In the Display list, select Systems.
  5. On the Deployment Actions menu, click Add Host.
  6. Configure the settings for the QRadar Network Insights managed host and then click Add.
  7. On the Admin tab, click Advanced > Deploy Full Configuration.
    Important: QRadar continues to collect events when you deploy the full configuration. When the event collection service must restart, QRadar does not restart it automatically. A message displays that gives you the option to cancel the deployment and restart the service at a more convenient time.

What to do next

Configure the QRadar Network Insights appliance.

Optionally, you can install the QRadar Network Insights content extension. The content extension includes custom rule engine content, including rules, searches, reports, and custom property extractions, that provide analysis, alerts, and reports for QRadar Network Insights.