IBM Support

Release of the QRadar Network Insights 7.4.3 ISO (743_QRadar_QNIFull_2020.11.0.20210517144015)

Release Notes


Abstract

A list of the installation instructions, new features, and resolved issues for the release of QRadar Network Insights 7.4.3 (743_QRadar_QNIFull_2020.11.0.20210517144015) ISO. These instructions are intended for administrators who want to install QRadar Network Insights 7.4.3 by using an ISO file.

Content

  • FIPS enabled version of QRadar Log Source Management app

    QRadar Network Insights 7.4.3 includes QRadar Log Source Management app 7.0.0 by default. This version is not Federal Information Processing Standard (FIPS) enabled. To download and install QRadar Log Source Management app 7.0.1, which is FIPS enabled, go to the IBM Security App Exchange. 

For more information, see Installing the QRadar Log Source Management app.

  • Reconfiguring SAML authentication

You must reconfigure SAML authentication after you upgrade to QRadar Network Insights 7.4.3 if you use QRadar Local Certificate Authority (CA). To identify which CA you are using, follow these steps:
  1. On the Admin tab, click Authentication.
  2. On the Authentication Module Settings window, select SAML 2.0.
If QRadar_SAML appears in the Certificate for signing and encryption field, you are using local CA.
SAML authentication
If single sign on or single logout fails, ensure that the QRadar SAML metadata that you uploaded to the Identity Provider matches the latest deployed metadata at https://<yourqradarserverhostname>/console/SAMLMetadata.
Also, ensure that you uploaded the root CA, root CA CRL, intermediate CA, intermediate CA CRL files of your selected certificate to the right location of the IDP server's certificate stores. When the provided QRadar_SAML certificate is used, you can download these files at:
http://<yourqradarserverhostname>:9381/root-qradar-ca_ca
http://<yourqradarserverhostname>:9381/QRadarSAML_ca.crt
http://<yourqradarserverhostname>:9381/root-qradar-ca_ca.crl
http://<yourqradarserverhostname>:9381/QRadarSAML_ca.crl
Important: If you are using the provided QRadar_SAML certificate, the above steps are required after you restore QRadar from a backup.

Known issues in QRadar Network Insights 7.4.3

 

Authorized Service tokens cannot be used after configuration restore

If you use the QRadar Data Synchronization app to perform a configuration restore, Authorized Service tokens cannot be used. For more information, and possible workarounds, see IJ32756.
 

Resolved issues

For a list of APAR links of resolved issues in QRadar Network Insights 7.4.3, see Authorized Program Analysis Reports.

Some APAR links might take 24 hours to display properly after a software release is posted to IBM Fix Central.

What's new

For information on what's new in QRadar products for version 7.4.3, see the following information: https://www.ibm.com/support/knowledgecenter/SS42VS_7.4.2/com.ibm.qradar.doc/c_qradar_ov_whats_new_742.html

About this installation

These instructions are intended to assist you when you install QRadar Network Insights 7.4.3 by using an ISO file.

Part 1. Installing the QRadar Network Insights 7.4.3 ISO

These instructions guide you through the process of installing QRadar Network Insights 7.4.3. 
Important: You can use the verify signature tool to validate the integrity of your downloads from IBM Fix Central. For more information, see How to verify downloads from IBM Fix Central are trusted and code signed.
Procedure
  1. Download the QRadar Network Insights 7.4.3 ISO (5+ GB) from the IBM Fix Central website: http://www.ibm.com/support/fixcentral/swg/quickorder?parent=IBM%20Security&product=ibm/Other+software/IBM+QRadar+Network+Insights&release=All&platform=All&function=fixId&fixids=7.4.2-QRADAR-QNIFULL-20201113144954&includeSupersedes=0&source=fc
    NOTE: QRadar Incident Forensics and QRadar Network Insights use separate ISO files to install 7.4.3.
  2. Use SSH to log in to the Console as the root user.
  3. Use SSH to log in to the QRadar Network Insights appliance.
  4. To run the ISO installer on the Console, type the following command: /media/cdrom/setup
    Important: Installing QRadar Network Insights 7.4.3 can take approximately 1 to 2 hours.

  5. Wait for the installation to complete.
Results

A summary of the ISO installation advises you of any issues. If there are no issues, you can now SSH to managed hosts and start the installer on each host to run the setup in parallel.

Part 2. Installation wrap-up

  1. After all hosts are updated, send an email to your team to inform them that they will need to clear their browser cache before they log in to the QRadar Network Insights SIEM interface.
  2. To unmount the /media/cdrom directory on all hosts, type: umount /media/cdrom"
  3. Delete the ISO from all appliances.
  4. Review any static routes or customized routing. As mentioned in the administrator notes, all routes were removed and will need to be reconfigured after the upgrade completes.
  5. Review any iptable rules that are configured as the interface names have changed in QRadar Network Insights 7.4.3 due to the Red Hat Enterprise 7 operating system updates. Update any iptables rules that use Red Hat 6 interface naming conventions.

[{"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Component":"Release Notes","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.4","Edition":"All Editions","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
24 September 2021

UID

ibm16450859

Page Feedback