System requirements for QRadar Network Insights on Microsoft Azure installations

To prepare for the IBM® QRadar® Network Insights installation, ensure that your virtual appliance meets the minimum system requirements.
The QRadar Network Insights instance must meet the following requirements:
Requirement Value
Processor

16 cores (minimum) on a single NUMA node

Do not use virtual CPUs for QRadar Network Insights processing.
Memory

64 GB (minimum)
Storage
QRadar Network Insights requires two EBS General Purpose SSD volumes:
  • 1 x 98 GiB (OS and Software)
  • 1 x 250 GiB (Data)

The 98 GiB volume for the OS and software is configured automatically by the QRadar image. You must manually configure the additional 250 GiB volume for data.

Warning: It is not possible to increase storage after installation.
Networking
QRadar Network Insights requires a minimum of two NIC interfaces:
  • One management interface
  • One monitoring interface
    • The Maximum Transmission Unit (MTU) for the monitoring interface must be set to 9001.
    • For best results, use the accelerated networking option.
    • For larger compute-optimized instance types, you can add more monitoring interfaces.
Security Groups

The management interface must have an assigned security group that includes rules to allow SSH, NetFlow, and messaging connections between the QRadar Network Insights host and the QRadar Console and any flow collectors or processors that might be installed.

The monitoring interface must have an assigned security group that allows VXLAN traffic (UDP port 4789) from the mirror source. The Network ACL (VPC) level also must allow VXLAN traffic.

To view the system requirements for other IBM QRadar virtual appliances, see System requirements for virtual appliances in the IBM QRadar Installation Guide.