QRadar: License Information FAQ

Q1PD is the IBM team that handles license fulfillment for end users. The Q1PD team can provide copies of QRadar licenses, generate licenses for new customers, issue Event per Second (EPS) or Flow per Minute (FPM) license increases, or provide activation keys for QRadar systems at version prior to 7.3.0 to an end user or an IBM sales representative.

The Q1PD team can:

• Generate replacement license keys for new appliance purchases or hardware migrations
• Generate licenses that have been lost from a previous purchase
• Generate licenses for purchased increases or renewals
   

Typically, the end user or the IBM Sales Representative will email the Security Licensing team ( Q1PD ) for license keys or regarding any simple license matters. Emails to the Q1PD team must include some form of identification in order to obtain a copy of the license keys for your QRadar products.

The following identification can be used to request license keys:

• IBM SAP Sales Order number. (Best)
  OR
• A copy of the Proof of Entitlement (POE) document. Proof of entitlement is emailed from Passport_Advantage@ibm.com with the subject IBM Passport Advantage Express Proof of Entitlement.
  OR
• A screen capture of the QRadar 'System and License Management' user interface. This should include the serial numbers for your appliances. To take a screen capture, open the Admin tab and click the System and License Management icon. From the Display drop-down, select Systems. Take a screen capture of the page and provide this information to the Q1PD team.
  OR
• A valid site ID or IBM Customer Number (ICN) (Minimum requirement)
  Clients should be able to find their account identification information in their Passport Advantage Account, or on their Proof of Entitlement documentation. IBM Sales representatives can find information on their clients in FastPass. If needed, the Q1PD team can also look up this information by leveraging FastPass on behalf of the customer.
   

The primary contact listed on the account will be the recipient for emails from the Q1PD team. Q1PD cannot assist with updating the primary client account information. The primary account holder should be able to update information through their account, otherwise the Passport Advantage team must be leveraged to make changes.

• For more information about Passport, see: http://ibm.biz/QRadarpassport.
• If you need assistance with Passport, see: http://ibm.biz/QRadarpassport2.
   

1. Hardware serial numbers
   Serial numbers for QRadar appliances can be found by querying the command line.
   
   Where is this information?
   From the command line of the Console, run:

   /opt/qradar/support/deployment_info.sh

   A comma-separated file will export deployment information to a CSV file that can be provided to the Security Licensing team ( Q1PD ). Optionally, you can run the command with the hardware flag to only report the hardware information and serial numbers:

   /opt/qradar/support/deployment_info.sh -F

   Optionally, customers can also find this information in the license details page in the QRadar User Interface or serial number information can be found in the license key email issued by the Security Licensing team ( Q1PD ). If you are unsure where to find this information, you can contact your IBM Sales representative or contact QRadar Support.
2. Software and virtual appliance serial numbers
   QRadar software installations on your hardware and virtual serial numbers are assigned by Q1PD and can be found in the naming convention of the license key title beginning with either QCE or QRV. Administrators can review the LICENSE display view in the UI, which lists every host in the deployment, along with the title of the License Key file associated with each host.
   
   Where is this information?
   Open the Admin tab, click the System and License Management icon. From the Display drop-down, select Licenses. Take a screen capture of the page and provide this information to the Q1PD team.
    

In QRadar 7.3.0 and later, activation keys are no longer emailed to administrators as the software installation menu includes an appliance type list. The Q1PD team will send one license key for the primary Console appliance that contains the Event and Flow rates licensed for the deployment. All QRadar managed hosts, such as Event Processor or Flow Processor managed hosts can apply license allocations in the System and License Management interface.

As of QRadar 7.3.0, there are no longer individual Event or Flow Processor (16XX / 17XX / 18XX) License Keys provided. All new event and flow capacity increases are done using the Console License.

License keys are always required for the following add-on appliances as these appliances add new tabs and increase the functionality of the core QRadar SIEM product:

• QRadar Risk Manager
• QRadar Network Insights
• QRadar Incident Forensics
• QRadar Vulnerability Manager: For more information, see the QVM End of Life announcement.
   

1. General questions
   For questions on entitled capacity, clients should first contact their assigned IBM Sales Representative. Q1PD can assist with identifying capacity sent on previously sent license keys, or in validating specific license key orders were delivered.
2. For license capacity increases
   To purchase license capacity, clients should contact their assigned IBM Sales Representative. The IBM Sales representatives have access to a recommended sizing guidelines and can help you scope the required license capacity increase for your deployment.
3. I ordered an event rate or flow license capacity increase, will I get an email from Q1PD?
   Yes, if you ordered an EPS or Flow increase for your deployment, we will need their console license key serial number. We may need to reconcile their entire deployment, at which point, we will need the cumulative EPS and flow values. Once stackable licensing is launched (v7.3.2) & adopted by the client base, we will not need to reconcile the entire deployment.
    

Prior to 2017, the standard base license for QRadar came with support for 750 log sources, and upgrades to that limit were available through additional purchases. In January of 2017, this limit was removed and upgrades are no longer a chargeable component.

Administrators are strongly encouraged to upgrade to the latest version of the software, where the log source limit is no longer enforced. This license change was released in QRadar 7.3.0 and later. If for some reason an administrator cannot update their QRadar deployment to 7.3.0 and needs their limit increased, a request can be sent to q1pd@us.ibm.com and a new license with a raised limit will be dispatched.

No, administrators who are upgrading their QRadar software from 7.2.8 to 7.3.0 or later do not need to email the Security Licensing team ( Q1PD ) to receive an updated license. The upgrade should remove the restriction and users should not any issues related to log source license limits after upgrading.

If your software version is QRadar 7.3.0 or later and you are experiencing log source limit issues or System Notifications related to the log source license limit, you can contact QRadar Support for assistance as this system notification should not exist on QRadar 7.3.0 software versions. All new clients or new appliances at QRadar v7.3.0 or above should not face any issues related to log source license limits.

NOTE: QRadar Support always recommends that administrators upgrade to the latest version to avoid issues resolved is prior software releases.

No, QRadar Community Edition is a free product and includes a fixed event and flow license for 50 events per second and 5,000 flows per minute. QRadar Community Edition is a unique build of QRadar and this license cannot be increased, nor does it support any managed hosts.

Download QRadar Community Edition.
QRadar Community Edition limitations: QRadar Forums

Authorized Business Partners can use the IBM Partner World portal to request a set of one-year activation/license keys to do software installations for the following products:

• QRadar 31XX All-in-One SIEM (Software install & license key)
• QRadar Risk Manager (Software install & license key)
• QRadar Vulnerability Manager (Software install & license key)
• Data Node (Software install & license key)
• QRadar Incident Forensics (Software install & license key)
   

1. I'm a Business Partner, but I do not have access to IBM Partner World.
   For information on the IBM Software Access Catalog or questions related to Partner World offerings, see: http://www.ibm.com/partnerworld/wps/servlet/ContentHandler/isv/sac.
2. I have a special use case and IBM Partner World is not appropriate, what do I do?
   If the software access keys available through IBM Partner World are not appropriate for your use case, you can follow up with your IBM channels rep.
    

If there is a question or specific issue you want to discuss, users have the following options:

• Talk to your Sales Representative or email the Security Licensing team ( Q1PD ).
• If it is a technical issue or you are not sure how to proceed further, use our Forums or QRadar Support.
   

After the pertinent request details are compiled, the POC manager is responsible for contacting the Security Licensing team ( Q1PD ) with a request to release License Keys. Only the POC Manager will be able to approve the release of POC Licenses.

For appliance projects, the license will be generated and delivered to your Sales Team upon delivery of the appliance.  For Virtual projects the license will be generated based on the start date provided to the License team and delivered to your Sales Team.