Hi everyone,
Is it possible to change a QRadar All-In-One node into an EP attached to a different Console without doing reinstallation?
The objective is to avoid losing log sources and events.

------------------------------
Famara Bodian
------------------------------

The short answer is  no, it is not possible, I'm afraid.

The only way to keep your current data if you are adding new hardware to your current deployment - as an EP in your case.
Then the current AiO would became the console containing all your previous config, log sources and all the data.

If that not what you want, then my best advice would be to: 
Keep the old AiO (you can migrate it to a separate VM for example) till the data is relevant/needed.
And re-implement/migrate the relevant configurations/log sources to the new deployment.

IBM Security Expert Lab Services would help you about planning and implementing such extension and/or 'migration' - if needed.



------------------------------
Laszlo Zrubecz
------------------------------

hi Laszlo, thank you for your advice.
effectively I think also it would need to migrate first to an intermediary console before reinstalling

------------------------------
Famara Bodian
------------------------------

Original Message:
Sent: Wed January 18, 2023 09:40 AM
From: Laszlo Zrubecz
Subject: QRadar : change deployment type without reinstall

The short answer is  no, it is not possible, I'm afraid.

The only way to keep your current data if you are adding new hardware to your current deployment - as an EP in your case.
Then the current AiO would became the console containing all your previous config, log sources and all the data.

If that not what you want, then my best advice would be to: 
Keep the old AiO (you can migrate it to a separate VM for example) till the data is relevant/needed.
And re-implement/migrate the relevant configurations/log sources to the new deployment.

IBM Security Expert Lab Services would help you about planning and implementing such extension and/or 'migration' - if needed.



------------------------------
Laszlo Zrubecz
------------------------------

Hi Famara,

as Laszlo mentioned, if you have a new seperate managed host szenario (console, ep) and you just want to transfer your ariel event data from your obsolate AiO, you can use a syncAriel script to achieve. More details in Step 7 in the following documentation: https://www.ibm.com/support/pages/qradar-replacing-console-appliance-deployment-using-same-ip-address-or-hostname-updated

Regards,
Ralph

------------------------------
Ralph Belfiore
SIEM Expert
pro4bizz GmbH
Karlsruhe
+4972190981727
------------------------------

Original Message:
Sent: Wed January 18, 2023 06:48 PM
From: Famara Bodian
Subject: QRadar : change deployment type without reinstall

hi Laszlo, thank you for your advice.
effectively I think also it would need to migrate first to an intermediary console before reinstalling

------------------------------
Famara Bodian
------------------------------


Original Message:
Sent: Wed January 18, 2023 09:40 AM
From: Laszlo Zrubecz
Subject: QRadar : change deployment type without reinstall

The short answer is  no, it is not possible, I'm afraid.

The only way to keep your current data if you are adding new hardware to your current deployment - as an EP in your case.
Then the current AiO would became the console containing all your previous config, log sources and all the data.

If that not what you want, then my best advice would be to: 
Keep the old AiO (you can migrate it to a separate VM for example) till the data is relevant/needed.
And re-implement/migrate the relevant configurations/log sources to the new deployment.

IBM Security Expert Lab Services would help you about planning and implementing such extension and/or 'migration' - if needed.



------------------------------
Laszlo Zrubecz

Hi Ralph,
thank you for your advice. The link you shared is very helpfull

------------------------------
Famara Bodian
------------------------------

Original Message:
Sent: Thu January 19, 2023 08:44 AM
From: Ralph Belfiore
Subject: QRadar : change deployment type without reinstall

Hi Famara,

as Laszlo mentioned, if you have a new seperate managed host szenario (console, ep) and you just want to transfer your ariel event data from your obsolate AiO, you can use a syncAriel script to achieve. More details in Step 7 in the following documentation: https://www.ibm.com/support/pages/qradar-replacing-console-appliance-deployment-using-same-ip-address-or-hostname-updated

Regards,
Ralph

------------------------------
Ralph Belfiore
SIEM Expert
pro4bizz GmbH
Karlsruhe
+4972190981727
------------------------------


Original Message:
Sent: Wed January 18, 2023 06:48 PM
From: Famara Bodian
Subject: QRadar : change deployment type without reinstall

hi Laszlo, thank you for your advice.
effectively I think also it would need to migrate first to an intermediary console before reinstalling

------------------------------
Famara Bodian


Original Message:
Sent: Wed January 18, 2023 09:40 AM
From: Laszlo Zrubecz
Subject: QRadar : change deployment type without reinstall

The short answer is  no, it is not possible, I'm afraid.

The only way to keep your current data if you are adding new hardware to your current deployment - as an EP in your case.
Then the current AiO would became the console containing all your previous config, log sources and all the data.

If that not what you want, then my best advice would be to: 
Keep the old AiO (you can migrate it to a separate VM for example) till the data is relevant/needed.
And re-implement/migrate the relevant configurations/log sources to the new deployment.

IBM Security Expert Lab Services would help you about planning and implementing such extension and/or 'migration' - if needed.



------------------------------
Laszlo Zrubecz