QRadar: Adding a QFlow appliance to QRadar

Answer

1. Log in to the QRadar Web User Interface.
2. Click Admin tab > System and License Management > Deployment Actions > View Deployment.
   
3. Once in View Deployment, verify that the Qflow component is connected to the Event Collector.  
   

Flow sources created and assigned?  

1. Click on the Admin tab > Flow Sources icon.  
   
   
2. If no flow sources are configured for that particular Qflow component, it will not have any sources to report data to the Network Activity tab.
   
   
    
3. When you add a QFlow Collector managed host, it will create multiple Flow Sources by default. One for each additional interface other than eth0 or the default QRadar 7.3 predictable Network Interface en[s|p|o|x]<interface number>, as well as high-speed Napatech card.
   
   

   QRadar 7.3.x

   
   
   

   QRadar 7.2.x

   
   
4. If the Interface does not exist, then you will need to create it. See examples above.
   
   
5. From the menu bar click Deploy Changes.

Note: If a qflow component exists with no Flow Sources assigned, you will see Dashboard System notifications that the process has failed to start X times. The qflow process will exit if no Flow Sources are assigned, and the hostcontext service will continually try to restart it.



Where do you find more information?