Virtual appliance installations for QRadar Incident Forensics

You can install IBM QRadar Incident Forensics on a virtual appliance. Ensure that you use a supported virtual appliance that meets the minimum system requirements.

A virtual appliance is a QRadar Incident Forensics system that consists of QRadar Incident Forensics software that is installed on a VMWare ESXi virtual machine.

A virtual appliance provides the same visibility and function in your virtual network infrastructure that QRadar appliances provide in your physical environment.

Installation process

To install a virtual appliance, complete the following tasks in sequence:
  • Create a virtual machine.
  • Install IBM QRadar Incident Forensics software on the virtual machine.
  • If you installed QRadar Incident Forensics Processor, add your virtual appliance to the deployment.

System requirements for virtual appliances

Before you install your virtual appliance, ensure that the following minimum requirements are met:
Table 1. Requirements for virtual appliances

Requirement

Description

VMware client

VMware ESXi Version 5.0

VMware ESXi Version 5.1

VMware ESXi Version 5.5

For more information about VMWare clients, see the VMware website (www.vmware.com)

Virtual disk size

Minimum: 256 GB

Important: For optimal performance, ensure that an extra 2-3 times the minimum disk space is available.