Configuring a QRadar 7.4.3 virtual appliance on Amazon Web Services

Configure an IBM® QRadar® virtual appliance on an Amazon Web Services (AWS) instance by using the provided Amazon Machine Image (AMI).

Before you begin

You must acquire entitlement to a QRadar Software Node for any QRadar instance that is deployed from a third-party cloud marketplace. Entitlement to the software node should be in place before you deploy the QRadar instance. To acquire entitlement to a QRadar Software Node, contact your QRadar Sales Representative.

For any issues with QRadar software, engage IBM Support. If you experience any problems with AWS infrastructure, refer to AWS documentation. If IBM Support determines that your issue is caused by the AWS infrastructure, you must contact AWS for support to resolve the underlying issue with the AWS infrastructure.

You must use static IP addresses.

If you are installing IBM QRadar Network Insights, you must ensure that the instance configuration can support the flow inspection rate that you want to achieve. To view examples of how the hardware configuration can impact the flow inspection rate, see Prerequisites for installing QRadar Network Insights on Amazon Web Services.

If you are installing a data gateway for QRadar on Cloud, go to Installing a QRadar data gateway in Amazon Web Services from the marketplace image (https://www.ibm.com/support/knowledgecenter/en/SSKMKU/com.ibm.qradar.doc_cloud/t_hosted_aws_image.html).

If you deploy a managed host and a Console in the same virtual network, use the private IP address of the managed host to add it to the Console.

If you deploy a managed host and a Console in different virtual networks, you must allow firewall rules for the communication between the Console and the managed host. For more information, see QRadar port usage.

Procedure

Go to IBM Security QRadar SIEM 7.4.3 (BYOL) (https://aws.amazon.com/marketplace/pp/prodview-f6d7zsi6jtipa).

Note: Go to the Amazon Web Services China marketplace (https://awsmarketplace.amazonaws.cn/marketplace/pp/prodview-ejtrfvtaya6k6) to obtain an image for use with your IBM QRadar SIEM in China.
Click Continue to Subscribe.
Click Accept Terms.
When the subscription is ready, click Continue to Configuration.
Select a region and click Continue to launch.
From the Choose Action list, select Launch through EC2.
Click Launch.
Give your instance a name.
Select an EC2 Instance from the following list that meets the system requirements for virtual appliances. (T3, T3A, M6i, M6a, M5, M5a, M5zn, C6i, C6a, C5, C5a, C5n, R6i, R5, R5a, R5b, R5n, X2iezn)
Configure or select a key pair. You use this key pair every time you connect to the appliance by using SSH.
Click Edit in the Network settings section.
1. Select a virtual private cloud (VPC).
2. Create or select a subnet for your VPC.
3. Create or select a security group that allows ports 22, and 443 for a QRadar console, to create an allowlist of trusted IP addresses that can access your QRadar deployment.
  
  In a QRadar deployment with multiple appliances, other ports might also be allowed between managed hosts. For more information about what ports might need to be allowed in your deployment, see Common ports and servers used by QRadar.
Navigate to the Configure Storage section
1. Click Add new volume.
  
  For information about available disk options, see AWS Volume Types.
2. Estimate your storage needs and then enter a size in GiB.
  
  The minimum size is 250 GiB. The added disk must be the second disk. It cannot be the third or greater disk. When the installation is complete, this disk contains the /store and /transient partitions.
  Warning: It is not possible to increase storage after installation.
3. Select the volume type of the data disk.
Click Launch Instance
Add Additional Network Interfaces if installing a QRadar Network Insights 6500 appliance.
1. When the instance is ready, click the Network Interfaces link in the left menu.
2. Click Create Network Interface. Configure the interface as wanted and ensure it is in the same subnet as the instance you started.
3. When the network interface is created, select it from the list of available interfaces.
4. When selected, click Actions -> Attach, select the QRadar Network Insights instance that you created to attach to, then click Attach.
When the instance is ready, log in using your key pair by typing the following command:
```
ssh -i <key.pem> ec2-user@<public_IP_address>
```

Type the following command to install the virtual appliance:

sudo /root/setup <appliance_id>

For example, to deploy an Event Collector type the following command:

sudo /root/setup 1599

You can install the following virtual appliance types:

Appliance type ID	Appliance type
1299	Flow Collector
1400	Data Node
1599	Event Collector
1699	Event Processor
1799	Flow Processor
1899	Event and Flow Processor
3199	All-in-One Console
4000	App host appliance
6500	QRadar Network Insights
7000	Data Gateway appliance

Enter a password for the admin account for an All-in-One Console, or the root password for all other appliance types. Set a strong password that meets the following criteria.
- Contains at least 5 characters
- Contains no spaces
- Can include the following special characters: @, #, ^, and *.

What to do next

For All-in-One Console installations, the QRadar instance uses Coordinated Universal Time (UTC). You can change the time zone of the instance. For more information about changing the time zone, see Configuring system time.

This image does not receive automatic software upgrades. You must manually upgrade your system to keep it up to date. To receive QRadar upgrade notifications, see: Receiving QRadar update notifications.

For all managed host (except data gateways) installations, see adding a managed host

For QRadar Network Insights installations, see QRadar Network Insights installations on Amazon Web Services for information about adding the virtual appliance as a managed host and configuring flow sources and traffic mirroring.