IBM Support

QRadar: How to identify a 'Software' install by appliance function

Question & Answer


Administrators who see appliances listed in Admin > System and License Management interface as appliance type "Software" often ask how to identify the appliance type. When a software appliance is installed, the type is added in the hostcapabilities.xml file, which denotes the appliance type by a numeric ID. This technical note describes how to confirm the software type for a QRadar® appliance installed as "Software".


When a software installation is performed on your own hardware, the appliance type can be listed in the user interface and deployment.xml as type "Software". Administrators with root access to the QRadar appliance can use the command line to verify a "Software" installation by appliance ID.

  1. Use SSH to log in to the QRadar Console as the root user.
  2. Open an SSH session to the QRadar appliance you want to identify.
  3. To view the appliance ID, type:
    grep -i softwareType /opt/qradar/conf/capabilities/hostcapabilities.xml
    The command returns the software type number, which matches an appliance ID. For example,
  4. Compare the returned result to the following table to identify your appliance by function:
    Name Software type ID (numeric)
    Console or All-in-One Console (31xx) 0
    Event Collector (15xx) 102
    Event Processor (16xx) 103
    Flow Processor (17xx) 104
    Combination Event & Flow Processor (18xx) 105
    Data Node (14xx) 106
    QRadar Vulnerability Manager (processor) 107
    QRadar Vulnerability Manager (scanner) 108
    QRadar Risk Manager 109
    Flow Collector (QFlow) 101normal
    Table 1: Partial list of software type IDs for QRadar® appliances. For more information, review the appliances_list.xml file.

    Administrators can also verify this information from the command line within your QRadar version. To confirm their software appliance types by ID number, administrators can compare the table in this technical note to the contents of the following file on your appliance: /opt/qradar/conf/templates/deployments/appliances_list.xml.

Related Information

[{"Type":"SW","Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtNAAQ","label":"Deployment"}],"ARM Case Number":"TS005330882","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Document Information

Modified date:
30 April 2021