Modifying an existing stack

You can edit an existing stack to add or remove QRadar Network Insights appliances, set the primary host in the stack, and set the flow inspection level and the raw payload size for all appliances in the stack.

Before you begin

Before you add an appliance to a stack, ensure that the appliance is deployed into your QRadar environment.

All appliances in the stack must be at the same QRadar version and fix pack level as the QRadar Console that manages them.

About this task

You can add up to four QRadar Network Insights managed hosts to an appliance stack. All appliances in the stack must be the same appliance type. The primary host appliance is the appliance that receives data from the network TAP.

By default, the stack uses the global Flow Inspection Level and the Maximum Raw Payload Size settings, as defined in the System Settings on the Admin tab. You can override the global settings by choosing a different setting in the stack configuration. The setting that you choose applies to all appliances in the stack.

1. On the Admin tab, click System and License Management.
2. In the Display list, select Systems.
3. In the host table, select that stack that you want to configure, and click Deployment Actions > Edit Stack.
4. To set custom settings for the Flow Inspection Level level and the Maximum Raw Payload Size, click Change in the appropriate section.
5. To modify the number of hosts in the stack or to set the primary host, make the selections in the Hosts in Stack section.

   All appliances in the stack must be the same type. Appliances that do not match do not appear in the list of appliances.

6. Click Save.

What to do next

You must deploy the changes for the new configuration to take effect.