How do we go about adding a second interface for monitoring raw network traffic in the QRadar CE VM? When importing the VM, there is only 1 interface by default. I installed QRadar, but even if I try to shutdown the VM, and add a second interface, when I boot back up, QRadar doesn't detect the second interface.

My understanding is that there are typically two interfaces when monitoring raw network traffic from a span port on a switch. One interface is for management, the second is connected to the span port and is where the monitoring occurs.

Any help would be appreciated.

Hey Bro,

You can configure a secondary network interface with a private IP address to connect to an iSCSI storage area network (SAN). You use secondary network interface to improve performance.

Thanks and Best Regards:

www.windows-club.com