Installing extensions by using Extensions Management

Use the Extensions Management tool to add security extensions to IBM® QRadar®. The Extensions Management tool allows you to view the content items in the extension and specify the method of handling content updates before you install the extension.

Before you begin

Extensions must be on your local computer before you install them in QRadar.

You can download QRadar extensions from the IBM Security App Exchange (https://apps.xforce.ibmcloud.com/) and from IBM Fix Central (www.ibm.com/support/fixcentral/).

About this task

An extension is a bundle of QRadar functions. An extension can include content such as rules, reports, searches, reference sets, and dashboards. It can also include applications that enhance QRadar functions.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. In the System Configuration section, click Extensions Management.
  3. To upload a new extension to the QRadar console, follow these steps:
    1. Click Add.
    2. Click Browse and navigate to find the extension.
    3. Optional: Click Install immediately to install the extension without viewing the contents. Go to 5.b.
    4. Click Add.
  4. To view the contents of the extension, select it from the extensions list and click More Details.
  5. To install the extension, follow these steps:
    1. Select the extension from the list and click Install.
    2. To assign a user to the app, select the User Selection menu, and select a user.
      For example, you might want to associate the app with a specified user that is listed in the User Selection menu who has the defined permissions.
      Note:

      This screen appears only if any of the apps in the extension that you are installing are configured to request authentication for background processes.

    3. If the extension does not include a digital signature, or it is signed but the signature is not associated with the IBM Security Certificate Authority (CA), you must confirm that you still want to install it. Click Install to proceed with the installation.
    4. Review the changes that the installation makes to the system.
    5. Select Preserve Existing Items or Replace Existing Items to specify how to handle existing content items.
      Note: If the extension contains overridden system rules, select Replace Existing Items to ensure that the rules are imported correctly.
    6. Click Install.
    7. Review the installation summary and click OK.