Release of QRadar 7.5.0 Update Package 12 SFS (2021.6.12.20250509154206)

Release Notes

Abstract

This technical note contains installation instructions, and a list of new features and resolved issues for the IBM Security QRadar 7.5.0 Update Package 12 (2021.6.12.20250509154206) SFS. These instructions are intended for administrators who are upgrading to QRadar 7.5.0 Update Package 12 by using an SFS file.

Content

What's New

For more information on new and changed features in QRadar 7.5.0, see What's new in 7.5.0.

Predictive Parsing Enhancements for Custom Event Properties
QRadar SIEM Predictive Parsing for Custom Event Properties

Enhanced Search Progress Visualization
The search visualization on the Log and Network Activity screen has been improved by replacing the previous circling animation with a dynamic progress bar. This update includes an estimated time to completion, calculated based on elapsed time and remaining percentage, providing users with a clearer view of the search execution speed.

Search Performance Improvement in Multi-Tenant Deployments with Reference Set Filters
Search performance is increased by up to 100 times or more in QRadar deployments with multi-tenancy, where Reference Set filters are used in search.

Add Creation Date to the offense summary page and the offense search page
In previous versions of QRadar, the offense summary page would show the offense start date, which is tied to the first event related to the offense. We have also added the creation date, which indicates when the offense was created, typically after the start time.

Enhanced Log Search by Event Collector Name
Searching logs by event collector is now simplified by allowing the use of the new Event Collector field and the previous Event Collector ID in the user interface. This update offers a more intuitive search experience with an auto-populated list of Event Collector IDs dropdown of compatible values and operators, aligning with the search functionality used for other host criteria like Event Processor.

Improved Scattering with Absolute Space Thresholds on larger Data Nodes
Data Scattering, the process of distributing data across Data Nodes, has been improved to use absolute space thresholds, optimizing disk space utilization on larger Data Nodes. This change ensures more efficient disk space management by comparing available free space with calculated thresholds, allowing for storing more data without risk of shutdown.

Streamlined QRadar UI with Key Enhancements
Enhanced QRadar UI with updates to Auto Update, Network Hierarchy, Backup & Recovery, Index Management, Aggregated Data Management, System Health, System Settings, QVM Configuration, Routing Rules, Custom Offense Close Reasons, and Forwarding Destinations applications within the Admin tab.

The package DSM DSM-JuniperJunOS-7.5-20240628064229.noarch has been added
To enhance the customer experience, this package should be pre-installed to ensure log parsing works seamlessly for Juniper customers, especially those in air-gapped environments where automatic updates are not available.

Updated Protocols: Common, UniversalCloudRESTAPI, TLSSyslog, BoxRESTAPI, and CertificateUtilsCommon
These protocols have been enhanced to ensure compatibility with Java 11 by implementing the necessary updates to meet Java 11 compliance requirements.

Updated Default AutoUpdate Version to 9.21
The enhanced AutoUpdate version 9.21 is now set as the default to provide support for Java 11 and PostgreSQL 16.

Released New DSM for Storage Protect: https://www.ibm.com/docs/en/dsm?topic=storage-protect

Released New DSM for Azure Monitor Agent(AMA) for Linux: https://www.ibm.com/docs/en/dsm?topic=configuration-microsoft

Released New Palo Alto Firewall PAN-OS Support
Parsing capabilities have been extended to support PAN-OS version 11.0, including DNS Security, FILE, Tunnel, and URL logs.

Protocol Cisco Duo Pagination Enhancement
Resolved an issue in the CiscoDuo Protocol where events were missed between two recurrences when the response contained more events than the limit defined by Cisco. This update implements pagination to ensure all events between recurrences are processed.

Protocol Salesforce Enhancement
Enhanced the Salesforce REST API Protocol to optimize user API calls to the Salesforce account. This update ensures that both active and inactive accounts are retrieved. Administrators with automatic updates disabled need to manually install the Salesforce REST API Protocol RPM on the Console to enable this feature.

Protocol IBM Security QRadar EDR Enhancement
Enhanced the IBM Security QRadar EDR REST API Protocol to retrieve more detailed alert information by calling the events endpoint.

Resolved Issues

The Known Issues listed below are resolved in QRadar 7.5.0 Update Package 12. For a complete list of Known Issues, see Known Issues. The Known Issues search page allows users to search for Known Issues by version or status.

Some Known Issues links might take 24 hours to display properly after a software release is posted to IBM Fix Central.

The following is a list of Known Issues fixed in QRadar 7.5.0 Update Package 12:

DT149076 IJ40242: Add host fails if an entry exists for the host in the known_hosts file and that entry is valid
DT396625 Ingress restarted during full deploy, not prompting user
DT418741 Upgrading to 7.5.0 UP10 fails with: Error running 14: /media/updates/scripts/QRADAR-20338.install
DT425142 qradarca-monitor restarts services every hour when the expiring cert is skipped for regeneration
DT423580 Asset is not getting updated or deleted, and creates duplicate assets
DT424536 The "Show AQL" generates incorrect AQL with missing parentheses '(' , ')'

Upgrade information

QRadar 7.5.0 Update Package 12 resolves reported issues from users and administrators from previous QRadar versions. This cumulative software update fixes known software issues in your QRadar deployment. QRadar software updates are installed by using an SFS file, and update all appliances attached to the QRadar Console.

The 750-QRADAR-QRSIEM-2021.6.12.20250509154206 SFS file can upgrade the following QRadar versions to QRadar 7.5.0 Update Package 12:

QRadar 7.5.0 Update Package 10
QRadar 7.5.0 Update Package 10 Interim Fix 01 to Interim Fix 02
QRadar 7.5.0 Update Package 11
QRadar 7.5.0 Update Package 11 Interim Fix 01 to Interim Fix 04

This document does not cover all of the installation messages and requirements, such as changes to appliance memory requirements or browser requirements for QRadar. To review any additional requirements, see the QRadar Upgrade Guide.

See QRadar: Software update check list for administrators for a list of steps to review before you update your QRadar deployment.

Before you begin

Ensure that you take the following precautions:

Back up your data before you begin any software upgrade. For more information about backup and recovery, see the QRadar Administration Guide.
To avoid access errors in your log file, close all open QRadar sessions.
The QRadar software update cannot be installed on a managed host that is at a different software version from the Console. All appliances in the deployment must be at the same software revision to update the entire deployment.
Verify that all changes are deployed on your appliances. The update cannot install on appliances that have changes that are not deployed.
If this is a new installation, review the instructions in the QRadar Installation Guide.

Installing the QRadar 7.5.0 Update Package 12 Software Update

These instructions guide you through the process of upgrading an existing QRadar version to QRadar 7.5.0 Update Package 12. To update appliances in parallel, see QRadar: How to Update Appliances in Parallel.

Procedure

Download the software update to install QRadar 7.5.0 Update Package 12 from the IBM Fix Central website:
https://www.ibm.com/support/fixcentral/quickorder?product=ibm%2FOther+software%2FIBM+Security+QRadar+Vulnerability+Manager&fixids=7.5.0-QRADAR-QRSIEM-20250509154206&source=SAR
Important: Please confirm that you are installing the latest SFS file posted on 05/13/2025. The updated file sha256sum is 096d095f08d48dadd0867c10f10cbff56c07bcc02113647ab25c5f614017f8fb

Note: To confirm QRadar 7.5.0 Update Package 12 is code signed by IBM, you must use the latest code signing utility 1.0.2. For more information, see https://ibm.biz/qradarcodesigning.
Use SSH to log in to your Console as the root user.
To verify you have enough space (10GB) in /store/tmp for the QRadar Console, type the following command:
```
  df -h /tmp /storetmp /store/transient | tee diskchecks.txt
```
- Best directory option: /storetmp
  It is available on all appliance types at all versions. In QRadar 7.5.0 versions /store/tmp is a symlink to the /storetmp partition.

If the disk check command fails, retype the quotation marks from your terminal, then rerun the command. This command returns the details to both the command window and to a file on the Console named diskchecks.txt. Review this file to ensure that all appliances have at minimum 10GB of space available in a directory to copy the SFS before attempting to move the file to a managed host. If required, free up disk space on any host that fails to have less that 10GB available.

Note: In QRadar 7.3.0 and later, an update to directory structure for STIG-compliant directories reduces the size of several partitions. This can impact moving large files to QRadar.

To create the /media/updates directory, type the following command:
```
  mkdir -p /media/updates
```
Use SCP to copy the files to the QRadar Console to the /storetmp directory or a location with 10GB of disk space.
Change to the directory where you copied the patch file. For example,
```
  cd /storetmp
```

To mount the patch file to the /media/updates directory, type the following command:

  mount -o loop /storetmp/750-QRADAR-QRSIEM-2021.6.12.20250509154206.sfs /media/updates

To run the patch installer, type the following command:
```
  /media/updates/installer 
```
Note: The first time that you run the software update, there might be a delay before the software update installation menu is displayed.
Using the patch installer, select all.
- The all option updates the software on all appliances in the following order:
  1. Console
  2. No order required for remaining appliances. All remaining appliances can be updated in any order that you require.
- If you do not select the all option, you must select your Console appliance.
  
  As of QRadar 7.2.6 Patch 4 and later, you are only provided the option to update all or update the Console appliance. Managed hosts are not displayed in the installation menu to ensure that the Console is patched first. After the Console is patched, a list of managed hosts that can be updated is displayed in the installation menu. This change was made starting with QRadar 7.2.6 Patch 4 to ensure that the Console appliance is always updated before managed hosts to prevent upgrade issues.
  
  If you want to patch systems in series, you can update the Console first, then copy the patch to all other appliances and run the patch installer individually on each managed host. The Console must be patched before you can run the installer on managed hosts. When updating in parallel, there is no order required in how you update appliances after the Console is updated.
  
  If your Secure Shell (SSH) session is disconnected while the upgrade is in progress, the upgrade continues. When you reopen your SSH session and rerun the installer, the patch installation resumes.

Installation wrap-up

After the system reboot is not initiated after the patch completes and you have exited the installer, type the following command:
```
  umount /media/updates
```
Clear your browser cache before you log in to the Console.
Delete the SFS file from all appliances.
For administrators with managed WinCollect 7 agents, upgrades to 7.5.0 Update Package 12 require WinCollect version 7.3.1 Patch 4. Depending on your upgrade path, you might be required to update your WinCollect agent version on the Console. For more information, see the WinCollect 7.3.1 Patch 4 release notes.
To run AQL queries that use geographic data or the flags on the Log Activity tab, update to the latest database from Maxmind after you upgrade to QRadar 7.5.0 Update Package 12.

Results

A summary of the software update installation advises you of any managed hosts that were not updated. If the software update fails to update a managed host, you can copy the software update to the host and run the installation locally.

After all hosts are updated, send an email to your team to inform them that they will need to clear their browser cache before they log in to the QRadar SIEM interface.

Security Bulletin

Security Bulletin: IBM QRadar SIEM contaIns multiple vulnerabilities

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtdAAA","label":"Upgrade"}],"ARM Case Number":"","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.5.0"}]

Tips