Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
ON THIS PAGE
 

Installing the App

Use the QRadar Assistant app to install the app archive on your QRadar computer.

Before you install the app, ensure that the app meets the minimum memory (RAM) requirements. The app requires ∫100 MB of free memory from the application pool of memory. If the app fails to install, then your application pool does not have enough free memory to run the app. Consider adding an App Host to your QRadar deployment.

QRadar 7.3.0 and 7.3.1 use an App Node, which is an unmanaged host, that is dedicated to running apps. Provision an App Node to provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar Console.

QRadar 7.3.2 uses an App Host, which is a managed host, that is dedicated to running apps. App Hosts provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar Console. For more information, see Juniper Secure Analytics Administration Guide.

  1. Choose one of the following methods to download your app:

    • If the QRadar Assistant app is configured on QRadar, use the instructions from QRadar Assistant App Guide to install the app.

    • If the QRadar Assistant app is not configured, download the app archive from the IBM Security App Exchange onto your local computer. You must have an IBM ID to access the App Exchange.

  2. If you downloaded the app from the App Exchange, complete the following steps:

    1. On the QRadar Console, click Admin >Extensions Management.

    2. On the Extension Management page, click Add and select the app archive that you want to upload to the console.

    3. Select the Install immediately check box.

      Note:

      You might have to wait several minutes before your app becomes active.

    4. To preview the contents of an app after it is added and before it is installed, select it from the list of extensions, and click More Details. Expand the folders to view the individual content items in each group.

When the installation is complete, if you have Admin > System Administrator assigned to your User Role, a QRadar Log Source Management subsection appears in the Apps section on the Admin tab.

If you have Delegated Administration > Manage Log Sources assigned to your User Role, a system administrator must add the QRadar Log Source Management capability to your user role.

When the installation is complete, clear your browser cache and refresh the browser window before you use the app.

Upgrading the QRadar Log Source Management App

To take advantage of new capabilities, defect fixes, and updated workflows, upgrade to new versions of the QRadar Log Source Management app. Use the Extensions Management tool in QRadar to upgrade your app, or use the QRadar Assistant app to upgrade. You must be an administrator to upgrade to new versions of the app.

You must have a Juniper ID to access the App Exchange.

  1. Choose one of the following methods to download your app:

    • If the QRadar Assistant app is configured on QRadar, use the following instructions from QRadar Assistant App Guide to install QRadar Log Source Management.

    • If the QRadar Assistant app is not configured, download the QRadar Log Source Management app archive from the IBM Security App Exchange onto your local computer. You must have an ID to access the App Exchange.

  2. If you downloaded the app from the App Exchange, complete the following steps:

    1. On the Admin tab, click Extensions Management.

    2. In the Extensions Management window, click Browse and select the app archive that you want to upload to the console.

    3. Select the Install immediately checkbox, and click Add.

    4. In the window that prompts you to update the current app version, leave the Replace existing items option selected, and click Install.

You must refresh your browser before you can use the upgraded app.

Uninstalling Your App

Use the Extensions Management tool to uninstall the QRadar Log Source Management app from your QRadar Console. Your data is retained when you uninstall the app.

Note:

When you uninstall the QRadar Log Source Management app in QRadar 7.4.0 or later, you are not able to edit your log sources.

  1. On the Admin tab, in the System Configuration section, click Extensions Management.

  2. On the INSTALLED tab in the Extension Management page, select your app and click Uninstall.

Related Documentation