Configuring a QRadar 7.4.3 virtual appliance on Amazon Web Services

Configure an IBM QRadar virtual appliance on an Amazon Web Services (AWS) instance by using the provided Amazon Machine Image (AMI).

Before you begin

You must acquire entitlement to a QRadar® Software Node for any QRadar instance that is deployed from a third-party cloud marketplace. Entitlement to the software node should be in place before you deploy the QRadar instance. To acquire entitlement to a QRadar Software Node, contact your QRadar Sales Representative.

For any issues with QRadar software, engage IBM® Support. If you experience any problems with AWS infrastructure, refer to AWS documentation. If IBM Support determines that your issue is caused by the AWS infrastructure, you must contact AWS for support to resolve the underlying issue with the AWS infrastructure.

You must use static IP addresses.

If you are installing IBM QRadar Network Insights, you must ensure that the instance configuration can support the flow inspection rate that you want to achieve. To view examples of how the hardware configuration can impact the flow inspection rate, see System requirements for QRadar Network Insights on Amazon Web Services installations.

If you are installing a data gateway for QRadar on Cloud, go to Installing a QRadar data gateway in Amazon Web Services from the marketplace image (https://www.ibm.com/support/knowledgecenter/en/SSKMKU/com.ibm.qradar.doc_cloud/t_hosted_aws_image.html).

If you deploy a managed host and a Console in the same virtual network, use the private IP address of the managed host to add it to the Console. If they are deployed in different virtual networks, you must allow firewall rules for the communication between the Console and the managed host. For more information, see QRadar port usage.

Procedure

  1. Go to IBM Security QRadar SIEM 7.4.3 (BYOL) (https://aws.amazon.com/marketplace/pp/prodview-f6d7zsi6jtipa).
  2. Click Continue to Subscribe.
  3. Click Accept Terms.
  4. When the subscription is ready, click Continue to Configuration.
  5. Select a region and click Continue to launch.
  6. From the Choose Action list, select Launch through EC2.
  7. Click Launch.
  8. Give your instance a name.
  9. Select an EC2 Instance from the following list that meets the system requirements for virtual appliances. (T3, T3A, M6i, M6a, M5, M5a, M5zn, C6i, C6a, C5, C5a, C5n, R6i, R5, R5a, R5b, R5n, X2iezn)
  10. Configure or select a key pair. You use this key pair every time you connect to the appliance by using SSH.
  11. Click Edit in the Network settings section.
    1. Select a virtual private cloud (VPC).
    2. Create or select a subnet for your VPC.
    3. Create or select a security group that allows ports 22, and 443 for a QRadar console, to create an allowlist of trusted IP addresses that can access your QRadar deployment.

      In a QRadar deployment with multiple appliances, other ports might also be allowed between managed hosts. For more information about what ports might need to be allowed in your deployment, see Common ports and servers used by QRadar.

  12. Navigate to the Configure Storage section
    1. Click Add new volume
    2. Estimate your storage needs and then enter a size in GiB.
      The minimum size is 250 GiB. The added disk must be the second disk. It cannot be the third or greater disk. When the installation is complete, this disk contains the /store and /transient partitions.
      Warning: It is not possible to increase storage after installation.
    3. Select the volume type of the data disk.
  13. Click Launch Instance
  14. Add Additional Network Interfaces if installing a QRadar Network Insights 6500 appliance.
    1. When the instance is ready, click the Network Interfaces link in the left menu.
    2. Click Create Network Interface. Configure the interface as wanted and ensure it is in the same subnet as the instance you started.
    3. When the network interface is created, select it from the list of available interfaces.
    4. When selected, click Actions -> Attach, select the QNI instance that you created to attach to, then click Attach.
  15. When the instance is ready, log in using your key pair by typing the following command:
    ssh -i <key.pem> ec2-user@<public_IP_address>
  16. Type the following command to install the virtual appliance:
    sudo /root/setup <appliance_id>

    For example, to deploy an Event Collector type the following command:

    sudo /root/setup 1599

    You can install the following virtual appliance types:

    Appliance type ID Appliance type
    1299 Flow Collector
    1400 Data Node
    1599 Event Collector
    1699 Event processor
    1799 Flow Processor
    1899 Event and Flow Processor
    3199 All-In-One Console
    4000 App host appliance
    6500 QRadar Network Insights
    7000 Data Gateway Appliance
  17. Enter a password for the admin account for an All-In-One Console, or the root password for all other appliance types. Set a strong password that meets the following criteria.
    • Contains at least 5 characters
    • Contains no spaces
    • Can include the following special characters: @, #, ^, and *.

What to do next

For All-In-One Console installations, the QRadar instance uses Coordinated Universal Time (UTC). You can change the time zone of the instance. For more information about changing the time zone, see Configuring system time.

This image does not receive automatic software upgrades. You must manually upgrade your system to keep it up to date. To receive QRadar upgrade notifications, see: Receiving QRadar update notifications.

For all managed host (except data gateways) installations, see adding a managed host

For QRadar Network Insights installations, you must add the virtual appliance as a managed host and configure flow sources and traffic mirroring. For more information, see QRadar Network Insights installations on Amazon Web Services.