Installing QRadar Console

For distributed installations, install the QRadar Console on an appliance and the IBM QRadar Incident Forensics managed host on another appliance.

Restriction: Software versions for all appliances in a deployment must be the same version and fix level. Deployments that use different versions of software are not supported.

Before you begin

Ensure that the following requirements are met:

  • The required hardware is installed.
  • You have the required license key for your appliance.
  • A keyboard and monitor are connected by using the VGA connection.
  • If you want to configure bonded network interfaces, see the topic titled Configuring bonded management interfaces in the IBM QRadar Installation Guide.

Procedure

  1. For installations on your own hardware or on virtual machines, add the QRadar Console ISO image in the root directory.
    1. Create the /media/dvd directory by typing the following command:

      mkdir /media/dvd

    2. Mount the QRadar Console ISO image by typing the following command:

      mount -o loop <QRadar_ISO> /media/dvd

  2. Use the setup script to start the installation.
    1. Change the working directory by typing the command:
      cd /media/dvd
    2. Start the setup script by typing the command:
      setup.sh
  3. Follow the instructions in the installation wizard.
    • In the Enter your activation key below, when you are prompted for the activation key, enter the 24-digit, 4-part, alphanumeric string that you received from IBM®.

      The letter I and the number 1 (one) are treated the same. The letter O and the number 0 (zero) are also treated the same.

    • In the Enter the network information to use page, if you do not have an email server, enter localhost in the Email server name field.
    • In the Root password field, create a password that meets the following criteria:
      • Contains at least 5 characters.
      • Contains no spaces.
      • Can include the following special characters: @, #, ^, and *.

    The installation process might take several minutes.

  4. If you are installing a Console, apply your license key.
    1. Log in to QRadar as the admin user:

      https://<IP_Address_QRadar>

    2. Click Login.
    3. On the navigation menu ( Navigation menu icon ), click Admin.
    4. In the navigation pane, click System Configuration.
    5. Click the System and License Management icon.
    6. From the Display list box, select Licenses, and upload your license key.
    7. Select the unallocated license and click Allocate System to License.
    8. From the list of systems, select a system, and click Allocate System to License.

What to do next

You can now install QRadar Incident Forensics.