QRadar Insights

Installing a Device Adapter on the QRadar Risk Manager

Posted on August 6, 2014 Updated on August 6, 2014

Today I was trying to install device adapters into the new QRadar Risk Manager 7.2. After sometime struggling (due the “incomplete” IBM documentation) I decided to create this post to help you guys to configure a new adapter in the Risk Manager. First things first, for those who don’t know, the QRadar Risk Manager need an adapter for each kind of device that you want to monitor the configuration. It means for example, if you have few Checkpoint Firewalls and few Cisco routers that you want to monitor the configuration, you will need to install the Checkpoint adapter and the Cisco adapter.

So, here’s the step by step to configure the adapters:

[All the files mentioned in this post can be found in this link, or at www.ibm.com/support/fixcentral ]

– Install the dependencies: (Only necessary in the first time configuration)

• Download the rpm files: “ziptie-server” and “adapters-common” in your machine;
• Connect to the Risk Manager server using SSH.
• Create a new folder: /tmp/adapters
• Copy the downloaded files from your computer into the new folder
• Execute:  rpm -Uvh ziptie_filename.rpm   (use the ziptie file that you just transferred)
• Execute:  rpm -Uvh adapterscommon_filename.rpm    (use the adapterscommon file that you just transferred)
• Execute: service ziptie-server restart

– Install the adapter: (Repeat it for all the necessary adapters)

• Download the rpm files for your adapter, example: cisco_adapter.rpm into your machine;
• Connect to the Risk Manager server using SSH;
• Copy the downloaded files from your machine to the folder /tmp/adapters ;
• Execute:  rpm -Uvh cisco_adapter.rpm   (Change the filename for the adapter downloaded)
• Execute: service ziptie-server restart

After those steps your adapter will be ready for use.

If you want, you can check the official IBM documentation in this link, but I found some missing steps on it.