Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Installing QRadar Use Case Manager

 

Use the QRadar Extensions Management tool or the QRadar Assistant app to install the QRadar Use Case Manager app on your QRadar Console.

Before you install QRadar Use Case Manager, ensure that it meets the minimum memory (RAM) requirements. QRadar Use Case Manager requires 500 MB of free memory from the application pool of memory. If QRadar Use Case Manager fails to install, then your application pool does not have enough free memory to run the app. Consider adding an App Node or an App Host to your QRadar deployment. For more information on calculating the required memory, see Apps and Resource Limitation.

QRadar 7.3.1 uses an App Node, which is an unmanaged host, that is dedicated to running apps. Provision an App Node to provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar Console.

QRadar 7.3.2 and later use an App Host, which is a managed host, that is dedicated to running apps. App Hosts provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar Console. For more information, see https://www.ibm.com/support/knowledgecenter/SS42VS_latest/com.ibm.qradar.doc/c_qradar_deployment_apphost.html.

  1. Choose one of the following methods to download your app:
    • If the IBM QRadar Assistant app is configured on QRadar, use the following instructions to install QRadar Use Case Manager: QRadar Assistant app.

    • If the QRadar Assistant app is not configured, download the QRadar Use Case Manager app archive from the IBM Security App Exchange.

  2. If you downloaded the app from the App Exchange, complete the following steps:
    1. On the QRadar Console, click Admin >Extensions Management.

    2. In the Extension Management window, click Add and select the app archive that you want to upload to the console.

    3. Select the Install immediately checkbox.

      Note

      You might have to wait several minutes before your app becomes active.

    4. To preview the contents of an app after it is added and before it is installed, select it from the list of extensions, and click More Details. Expand the folders to view the individual content items in each group.

  3. If IBM QRadar Advisor with Watson is installed in your environment, it includes the Cyber Adversary Framework Mapping app. This MITRE-mapping app that is no longer needed when you install QRadar Use Case Manager 2.3.0 or later. To remove the Cyber Adversary Framework Mapping app, follow steps 5 and 6 in Upgrading QRadar Use Case Manager.