Configuring system settings

To get your IBM QRadar security system up and running or to maintain your system, you must configure your QRadar Console and managed hosts system settings from the System Information window.

About this task

Assign roles for network interfaces, bond interfaces, manage licenses, configure the email server that you want QRadar to use, and use the local firewall to manage access from external devices to QRadar.

If you need to make network configuration changes, such as an IP address change to your QRadar Console and managed host systems after you install your QRadar deployment, use the qchange_netsetup utility. If you use qchange_netsetup, verify all external storage which is not /store/ariel or /store is not mounted. For more information about network settings, see the IBM QRadar Risk Manager Installation Guide.

If you change the External Flow Source Monitoring Port parameter in the QFlow configuration, you must also update your firewall access configuration.

Procedure

  1. Click the Admin tab.
  2. In the System Configuration section, click the System and License Management icon.
  3. From the Display menu, select Systems.
  4. Select the relevant host.
  5. From the Actions menu, click View and Manage System.
    You can right-click the selected host to access this menu option, or you can double-click the host to open the Systems Information window.
  6. To configure your local firewall to allow access to this host from specified devices outside of your QRadar deployment, click the Firewall tab.
    1. Configure access for devices that are outside of your deployment and need to connect to this host.
    2. Add this access rule by clicking the arrow.
  7. To configure network interfaces on your QRadar system, click the Network Interfaces tab.
    1. Select a network interface from the Device column.
    2. To edit your network interfaces, click Edit, and then configure the parameters.
    3. To bond network interfaces, click Bond, and then configure the parameters.

    For more information about configuring network interfaces, see the IBM QRadar Administration Guide.

    Important:

    You can't edit a network interface with a management, HA crossover, or secondary role.

  8. To configure an email server to distribute alerts, reports, notifications, and event messages, click the Email Server tab.
    1. In the Email Server Address field, type the hostname or IP address of the email server that you want to use.
    2. If you don't have an email server and you want to use the email server that QRadar provides, type localhost to provide local email processing.
    3. If you configure the mail server setting as localhost, then the mail messages do not leave the QRadar computer. If you want external mail delivery, use a valid mail relay server.
      Tip: It is a good practice to use port 25 for the email server connection.
  9. Click Save.

What to do next

Updating the system time on the QRadar Console