IBM Support

QRadar: Architecture recommendations and support policies

Question & Answer


Question

This article informs administrators about QRadar® Support policies for cases related to architectural questions, such as appliance network location, interoperability with other security products, data integrations, unique storage considerations, or license sizing and scoping. This document outlines out-of-scope work for architecture cases and the responsibilities of the QRadar administrator. 

Answer

Responsibilities for consultation issues

QRadar is an enterprise-level security product and can integrate with hundreds of security products and technologies. The function of QRadar Support is to repair QRadar and investigate software issues reported by users and administrators. However, QRadar Support is often asked questions or architecture questions that fall outside of our technical capability, which require consultation with the appropriate experts. This can include, but is not limited to:

  • Infrastructure questions, such as application placement or hardware vendor questions
  • Storage solution architecture
  • Appliance or license expansion questions
  • Expected data ingestion rates for log sources or network flow
  • Integration questions about third-party software interoperability or undocumented protocols
Support type Description Responsibility
Consultations and support
QRadar® Support can assist with error messages or confirm product functionality issues. For example, QRadar Support can:
  1. Answer specific and reasonable number of queries regarding the general functionality of the product.
    • Acceptable: "Does QRadar support data from manufacturer A at version 3.1?"
    • Acceptable: "What RFC does QRadar use for Syslog events?"
    • Out of scope: "I need a list of rules, searches, and reports that cover the following compliance use cases: ISO 27001, NERC, and PCI DSS."
    • Out of scope: "Can I install QRadar on my hardware or reuse leftover hardware with X specifications for my Event Collector or Event Processor?"
  2. Questions pertaining to procedures or cases where users believe IBM Documentation is lacks content.
  3. Technical queries that arise during the break and fix process of the support service.
 QRadar technical support

To open a case or report an error, contact QRadar technical support.
Out-of-scope for QRadar Support The following topics are considered out-of-scope for technical support. QRadar Support reserves the right to close cases related to the following issues:
 
  • Questions that are deemed research and not related to product functionality. For example, the following questions are outside the role of support:
    • "I need to confirm the following data sources for the attached list of manufacturers is supported by QRadar."
    • "I would like to know how many Events per Second are generated for the following devices."
    • "Which appliance is more suitable for better in the end for cost versus performance?"
    • "How should I allocate licenses between my appliances?"
  • Commenting, advising, or assisting with queries pertaining solely to the client’s environment, unless the queries are directly related with the product’s functionality. For example, "We use custom servers in our data centers, can I install, rebuild, or upgrade QRadar with the following hardware or drivers?"
     
Resources:
  • For questions about sizing, licensing, and appliances administrators can contact their IBM Sales representative.
  • For assistance with custom solutions or architecture consultations, administrators can contact the IBM Security® Expert Labs.
  • Community-based assistance can be provided from the QRadar Forums.

[{"Line of Business":{"code":"LOB24","label":"Security Software"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwsyAAA","label":"Admin Tasks"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Document Information

Modified date:
15 November 2021

UID

ibm16428211

Page Feedback