App Hosts
An App Host is a managed host that is dedicated to running apps. App Hosts provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar® Console. Apps such as User Behavior Analytics with Machine Learning Analytics require more resources than are currently available on the Console.
The App Host replaces the App Node. Unlike the App Node, QRadar manages all updates to the App Host. The App Host supports high availability, and you can include the App Host in your high availability deployments.
- The appliance ID for the App Host is 4000.
- You can have only one App Host in your deployment.
- Port 5000 must be open on your console.
- Port 443 must be open on your console.
- If your App Host is not encrypted, open port 9000 and 14433 for unidirectional communication from your console to the App Host.
- If your App Host is encrypted and you are deploying QRadar 7.5.0 Update Package 3 or earlier, open port 26000 and 26001 for unidirectional communication from your console to the App Host.
App Host specifications
CPU cores | RAM | Disk Space | Description | |
---|---|---|---|---|
Small | 4 | 12 GB | 256 GB | Minimum requirements for an App Host. You can run most apps with the minimum requirements, but not larger apps such as QRadar DNS Analyzer and User Behavior Analytics with Machine Learning. |
Medium | 12 or more | 64 GB or more | 500 GB or more | *You can run all apps that exist today, but this specification does not give you room for future apps. |
Large | 24 or more | 128 GB or more | 1 TB or more | *You can run all apps that exist today and you would have room for future apps. |
Installation scenarios
If you are installing an App Host and you do not have an App Node in your deployment, see Installing an App Host.
If you have an App Node and you are upgrading to 7.5.0, see Migrating from an App Node to an App Host.