Configuring multi-tenants in QRadar SOAR Plug-in app

The QRadar® SOAR Plug-in app supports multitenancy in QRadar. The tenants only see the instance that is assigned to their security profile. Each security profile can be assigned to only one instance of the plug-in, establishing a one-to-one relationship between security profiles and instances.

Before you begin

Ensure that the QRadar Assistant App is installed in your QRadar environment. Each instance of the plug-in requires 800 MB of memory.

Set up tenants with domains and security profiles. For more information, see Configuring QRadar for creating multiple instances.

The prerequisites for configuring multi-tenant apps for QRadar are as follows:

  1. Create the tenants, for example, tenant 1 and tenant 2.
  2. Create domains, for example, domain A and domain B and assign tenants to the domains. A domain can only be assigned to one tenant, not vice versa.
  3. Create security profiles, for example, SP1 and SP2 for tenants and assign domain A and domain B to them respectively. Each security profile can have domains from only one tenant.
  4. Create a user role and make sure that is has access to offenses and the QRadar SOAR Plug-in.
  5. Create a user account and assign a user role with the appropriate security profile and tenant so that they can only view offenses from a specific tenant and domains assigned to it.

About this task

Administrators can access all multi-tenant instances.

Procedure

  1. Log in to the QRadar Console as an administrator.
  2. Go to QRadar Assistant App > Manage > IBM QRadar SOAR Plugin.
  3. Click the overflow icon in the Options column and select Create New Instance.
  4. When prompted, select a security profile and user role to access the plug-in configuration.
  5. Click Confirm and Create.

What to do next

To configure each instance, click the overflow icon in the Options column and select Configure Instance > Configuration. For more information, see Configuring the QRadar SOAR Plug-in app.