IBM Security QRadar

 View Only
  • 1.  My Experience Setting Up QRadar CE

    Posted Wed December 08, 2021 12:57 PM
    Edited by John Tyson Tue December 14, 2021 09:41 PM

    I want to thank Karl Jaeger and Ralph Belfiore of Pro4bizz for all their help and patience helping me get QRadar CE up and running for me. Here are the steps I used.

    The issues I had was that while I could login to QRadar CE, I wasn't getting any data under Log Activity or Network Activity.

    High-Level Overview

    1. Setup your virtual machine (
    2. Set the static IP addr (Jose Bravo video listed in link above)
    3. Install QRadar CE
    4. Apply the License Patch (
    5. Apply the Auto Updates patches (2) - see My Journey doc attached
    6. Edit the syslog/rsyslog conf file on the machine(s) that will be sending log data to CE and add *.* @ at the bottom of the file, where is the IPv4 addr of your CE vm.
    7. Configure Log Sources and make sure to use the hostname, not the IP addr, in the Log Source Identifier field (I have updated the My Journey attachment complete with IBM-style change bars).
    8. Configure Flow Sources
    For the "gory details" I will add them as Word doc attachments.
    The first one "QRadar CE My Journey.docx" goes thru the installation and setup process.
    The second doc "CE 3rd Install.docx" is somewhat redundant to the first doc, but contains a lot of screen shots, esp of NMTUI. It doesn't have the Flow Sources setup.
    I may merge the 2 docs at a later date.

    -John Tyson

    John Tyson


    QRadar CE My Journey.docx   142 KB 1 version
    CE 3rd Install.docx   632 KB 1 version

  • 2.  RE: My Experience Setting Up QRadar CE

    IBM Champion
    Posted Thu December 09, 2021 07:38 AM
    Edited by Karl Jaeger Thu December 09, 2021 10:29 AM
    it was a great pleasure for Ralph and myself to chat and email with you and watch you walking up the steap QRadar hill.

    Even more thanks for the two documents that will help many beginners getting in close contact with QRadar using the "community edition".

    We have done hundreds of training sessions in the past five years. From the very beginning we've been using CE for our boot camps.
    Setting up your own QRadar helps a lot to understand the technology and how to integrate logsources and evaluate data using the many functions provided for free!

    As an alternative to your great papers, members may download our whitepaper P4B Boot Camp - QRadar 7.3.3 CE VM-Setup which is in German. Its containing many pictures and the amount of German you need for getting the message is low. Using the URL its available for free and you receive a download link via email.

    Thx again and stay tuned
    Best Regards

    PS just realized that the latest version of the CE whitepaper has much more info. So i have uploaded it to the QRadar library folder

  • 3.  RE: My Experience Setting Up QRadar CE

    Posted Thu December 09, 2021 06:47 PM
    Thank you, Karl.  I will look it over mit ein bier oder zwei oder drei :)

    It was a big learning process for me as I am not familiar with:
      The IBM ecosystem of patches, installs, etc
      New to cyber security
      New to Linux, relying on Unix commands I used in the 80's
      New to networking at this level
      Hadn't used virtual machines in a long time

    John Tyson

  • 4.  RE: My Experience Setting Up QRadar CE

    Posted Fri December 10, 2021 10:17 AM

    Congratulations for having a running CE and managing to go through the whole process, I know this is a nice feeling.

    Thank you for sharing your experience with us, have fun :)

    Steven Dunstone