Adding a flow source

If you add a network interface to your appliance after the initial installation, you must add it as a flow source before you can use it to monitor network flows. After you change the flow sources configuration, you must deploy the changes.

1. Log in to the QRadar Console as an administrator.
2. Click the Admin tab.
3. In the Flows section, click Flow Sources, and click Add.
4. Configure the flow source details.
   1. In the Flow Source Name field, type a descriptive name.
   2. In the Target Flow Collector field, select a flow collector or accept the value provided.
   3. In the Flow Source Type list, select Netflow v.1/v.5/v.7/v.9/IPFIX.
   4. In the Monitoring Interface, select the network interface that supplies the flow traffic.
   5. In the Monitoring Port field, select a port or accept the value provided.
   6. In the Linking Protocol list, select the protocol to use.
   7. To forward flows, select the Enable Flow Forwarding checkbox and configure the settings.
5. Click Save.
6. On the Admin tab, click Deploy Changes.