Good Morning ,
    I'm currently attempting to tackle a problem of having QRadar CE read some local .pcap files that I have on the Qradar CE server itself.  I have a few things that I have tried but to no avail and while im very new to qradar , the process in the past on previous iterations of Qradar seemed to be extremely simple.

I have installed tcpreplay as tcpdump was already within the .so. from the .iso we have a successful installation of qradar ce . however there is no ingestion of traffic on the network itself. Im working in a test environment that does not have internet access as well so the use of .pcaps is pretty important as i am also learning the product as well within this deployment.

I 've watched the jose bravo yt and its super helpful however the replay with logrun.pl isn't providing traffic either.

is there a plugin or intergration that i need to perform the activity that i am seeking to perform ?

this is the version of Qradar CE that I am using 
**7.5.0 UpdatePackage 8 (Build 20240302192142)**

thanks in advance

Hello Nico,

You can replay the network traffic but to register same on QRadar, You need to create the flow source first on network interface. Have you created the same? 

Also, You can also explore below application to replay the events.
https://exchange.xforce.ibmcloud.com/hub/extension/4b8a49187611ae8f746c27c8da4727e3?q=experience Link old Experience Center
https://exchange.xforce.ibmcloud.com/hub/extension/3ff30fa2eb92ef1740ba308e4e50a370
For more details check below document.
https://www.ibm.com/docs/sk/qradar-common?topic=app-whats-new-in-qradar-experience-center

------------------------------
Vishal Tangadkar
IBM INDIA PVT LTD
------------------------------

The error that I get when i use the Experience Center App 

" This application is not supported. Please check the X-Force Application Exchange to identify the latest version of this application compatible with this platform or update the minimum app base image stream in System Settings . "

i have gone to the admin > system settings and lowered the app base and no change to the installation of the app, it still does not install to the latest version of QRadar CE .

Unforuntaely the Experience Center app is not supported on CE.

From the link above

This version of the app is not fully supported in IBM QRadar Community Edition.

Hello Nico,

Whether creating a flow source on QRadar for interface worked for you for replaying pcaps?   

I have edited my post with latest version Experience Center. 
https://exchange.xforce.ibmcloud.com/hub/extension/3ff30fa2eb92ef1740ba308e4e50a370 ( This version of the app is not fully supported in IBM QRadar Community Edition) It says this but you can install and explore. I managed to install it on my CE installation.



 

https://www.ibm.com/products/qradar-siem