QRadar: License Information FAQ
This article contains common questions and answers for customers about QRadar licenses and how to get help with license issues.
1. What is q1pd and how can they help with QRadar licenses?
Q1PD is the IBM team that handles license fulfillment for end users. The Q1PD team can provide copies of QRadar licenses, generate licenses for new customers, issue Event per Second (EPS) or Flow per Minute (FPM) license increases, or provide activation keys for QRadar systems at version prior to 7.3.0 to an end user or an IBM sales representative.
2. How to contact Q1PD and required information
Typically, the end user or the IBM Sales Representative will email email@example.com for license keys or regarding any simple license matters. Emails to the q1pd team must include some form of identification in order to obtain a copy of the license keys for your QRadar products.
The following identification can be used to request license keys:
- IBM SAP Sales Order number. (Best)
- A copy of the Proof of Entitlement (POE) document. Proof of entitlement is emailed from Passport_Advantage@ibm.com with the subject IBM Passport Advantage Express Proof of Entitlement.
- A screen capture of the QRadar 'System and License Management' user interface. This should include the serial numbers for your appliances. To take a screen capture, open the Admin tab and click the System and License Management icon. From the Display drop-down, select Systems. Take a screen capture of the page and provide this information to the Q1PD team.
- A valid site ID or IBM Customer Number (ICN) (Minimum requirement)
Clients should be able to find their account identification information in their Passport Advantage Account, or on their Proof of Entitlement documentation. IBM Sales representatives can find information on their clients in FastPass. If needed, the Q1PD team can also look up this information by leveraging FastPass on behalf of the customer.
2a. What other contact options are available?
As a service for end users, QRadar administrators of the site contact for your account can contact your IBM Sales representative or a QRadar Support for assistance with license issues. Both the IBM sales representative or a QRadar Support representative can email firstname.lastname@example.org on your behalf for a copy of the license keys for your Console or other managed hosts. If you want to open a case to start a license investigation or troubleshooting, see: https://ibm.biz/qradarsupport .
NOTE: Communication between Q1PD and end users is email-based. If you require phone support, contact QRadar Support .
3. Who receives these emails or how to update email contact information?
The primary contact listed on the account will be the recipient for emails from the Q1PD team. Q1PD cannot assist with updating the primary client account information. The primary account holder should be able to update information through their account otherwise the Passport Advantage team must be leveraged to make changes.
- To update the primary contact information for your site: http://ibm.biz/QRadarpassport .
- For online access, request access, or add a secondary contact to your account, see: http://ibm.biz/QRadarpassport2 .
- If you continue to have issues with Passport Advantage, you can email email@example.com or contact customer e-Customer Care via phone service using 1-800-978-2246.
4. Where to find QRadar serial numbers for hardware, VMs, or software installations?
4a. Hardware serial numbers
Serial numbers for QRadar appliances can be found by querying the command-line.
Where is this information?
From the command-line of the Console, run ./opt/qradar/support/deployment_info.sh. A comma-separated file will export deployment information to a CSV file that can be provided to firstname.lastname@example.org. Optionally, you can run the command with the hardware flag to only report the hardware information and serial numbers, ./opt/qradar/support/deployment_info.sh -F.
Optionally, customers can also find this information in the license details page in the QRadar User Interface or serial number information can be found in the license key email issued by email@example.com. If you are unsure where to find this information, you can contact your IBM Sales representative or contact QRadar Support.
4b. Software and virtual appliance serial numbers
QRadar software installations on your hardware and virtual serial numbers are assigned by q1pd and can be found in the naming convention of the license key title beginning with either QCE or QRV. Administrators can review the LICENSE display view in the UI, which lists every host in the deployment, along with the title of the License Key file associated with each host.
Where is this information?
Open the Admin tab, click the System and License Management icon. From the Display drop-down, select Licenses. Take a screen capture of the page and provide this information to the Q1PD team.
5. What QRadar appliances need licenses?
In QRadar 7.3.0 and later, activation keys are not provided via email as a selectable installation menu is used to determine the appliance type. The Q1PD team will send one license key for the primary Console appliance that contains the Event and Flow rates licensed for the deployment. All QRadar managed hosts, such as Event Processor or Flow Processor managed hosts can apply license allocations in the System and License Management interface.
As of QRadar 7.3.0, there are no longer individual Event or Flow Processor (16XX / 17XX / 18XX) License Keys provided. All new event and flow capacity increases are done using the Console License.
License keys are always required for the following add-on appliances as these appliances add new tabs and increase the functionality of the core QRadar SIEM product:
- QRadar Vulnerability Manager
- QRadar Risk Manager
- QRadar Network Insights.
- QRadar Incident Forensics
5a. For version 7.2.8 or earlier
Q1PD will provide a license or activation key for each appliance in the QRadar deployment for software versions at 7.2.8 or earlier. This includes a license and activation key for the Console/All-in-One appliance, Event Processors, Flow Processors, QFlow Collectors, Event Collectors, and any add-on products, such as QRadar Vulnerability Manager, QRadar Risk Manager, QRadar Incident Forensics, and QRadar Network Insights. Event and flow rate increases are added per appliance and these licenses are provided by q1pd. A serial number is required for each appliance or you can provide a screen capture from the QRadar user interface (System & License Managment > License view).
6. About licenses and multi-Console deployments
The licensing pool is established per each Console deployment and will include the capacity for all of the events and flows for the managed hosts attached to a single Console. If you have a multi-Console deployment the event and flow rate is assigned to each Console and cannot be transferred or shared. Each Console in the deployment will have their own unique licensing pool to be allocated to hosts and multi-Console deployments cannot share a licensing pool as you cannot transfer license capacity from one Console to another.
At this time a multi-Console license infrastructure is not a feature of QRadar. Existing customers can request new features using the IBM Request for Enhancement system. For more information, see: http://www.ibm.com/support/docview.wss?uid=swg22016126
7. How to request an activation key?
Activation keys can be provided by firstname.lastname@example.org for those running version 7.2.8 or earlier. In QRadar 7.3.x, clients are able to select their appliance from an installation menu without the need to request activation keys from email@example.com.
8. The installation menu does not display the appliance I want to install, what is wrong?
Administrators who do not see their appliance listed in the installation menu in QRadar 7.3.0 or later should review the QRadar Hardware Guide . The list of available appliance types that can be installed using a QRadar ISO file is dependent on the hardware capability of the system QRadar is installing on. If the hardware capability of the appliance is not sufficient, the installation menu will not display certain appliance types. QRadar Support recommends that you review the QRadar Hardware Guide to determine what IBM capabilities are shipped on certain appliance types, then increase your hardware to meet the specifications of the physical appliances sold by IBM.
9. Who to contact for license capacity questions?
9a. General questions
For questions on entitled capacity, clients should first contact their assigned IBM Sales Representative. Q1PD can assist with identifying capacity sent on previously sent license keys, or in validating specific license key orders were delivered.
9b. For license capacity increases
To purchase license capacity, clients should contact their assigned IBM Sales Representative. The IBM Sales representatives have access to a recommended sizing guidelines and can help you scope the required license capacity increase for your deployment.
9c. I ordered an event rate or flow license capacity increase, will I get an email from Q1PD?
Yes, if you ordered an EPS or Flow increase for your deployment, we will need their console license key serial number. We may need to reconcile their entire deployment, at which point, we will need the cumulative eps and flow values. Once stackable licensing is launched (v7.3.2) & adopted by the client base, we will not need to reconcile the entire deployment.
10. I am on QRadar 7.2.x and I need more log source license limit. How does this work?
Prior to 2017, the standard base license for QRadar came with support for 750 log sources, and upgrades to that limit were available through additional purchases. In January of 2017, this limit was removed and upgrades are no longer a chargeable component.
Administrators are strongly encouraged to upgrade to the latest version of the software, where the log source limit is no longer enforced. This license change was released in QRadar 7.3.0 and later. If for some reason an administrator cannot update their QRadar deployment to 7.3.0 and needs their limit increased, a request can be sent to firstname.lastname@example.org and a new license with a raised limit will be dispatched.
11. I need help with my log source license limit
If you are using QRadar 7.2.8 or earlier and unable to upgrade at this time, q1pd can assist with extending the log source limit associated to the Console license. A customer in this scenario should email email@example.com with the serial number of their primary 31XX AIO / Console. The q1pd team can create a license that includes 9.9 Million log sources.
12. I'm upgrading from QRadar 7.2.8 to QRadar 7.3.0 or 7.3.1. Do I need a new license to extend my log source limit?
No, administrators who are upgrading their QRadar software from 7.2.8 to 7.3.0 or later do not need to email q1pd to receive an updated license. The upgrade should remove the restriction and users should not any issues related to log source license limits after upgrading.
If your software version is QRadar 7.3.0 or later and you are experiencing log source limit issues or System Notifications related to the log source license limit , you can contact QRadar Support for assistance as this system notification should not exist on QRadar 7.3.0 software versions. All new clients or new appliances at QRadar v7.3.0 or above should not face any issues related to log source license limits.
NOTE: QRadar Support always recommends that administrators upgrade to the latest version to avoid issues resolved is prior software releases.
13. Can I contact Q1PD for QRadar Community Edition license updates?
No, QRadar Community Edition is a free product and includes a fixed event and flow license for 50 events per second and 5,000 flows per minute. QRadar Community Edition is a unique build of QRadar and this license cannot be increased, nor does it support any managed hosts.
Download QRadar Community Edition: https://ibm.biz/qradarce .
QRadar Community Edition limitations: https://developer.ibm.com/answers/questions/411519/what-are-the-limitationsrestrictions-for-qradar-co/
14. I am a Business Partner for IBM, how do I request a license for QRadar?
Authorized Business Partners can use the IBM Partner World portal to request a set of one-year activation/license keys to do software installations for the following products:
- QRadar 31XX All-in-One SIEM (Software install & license key)
- QRadar Risk Manager (Software install & license key)
- QRadar Vulnerability Manager (Software install & license key)
- Data Node (Software install & license key)
- QRadar Incident Forensics (Software install & license key)
For more information, see the following website: http://www.ibm.com/partnerworld/page/swg_frm_sfw_qradar_keys .
14a. I'm a Business Partner, but I do not have access to IBM Partner World.
For information on the IBM Software Access Catalog or questions related to Partner World offerings, see: http://www.ibm.com/partnerworld/wps/servlet/ContentHandler/isv/sac .
14b. I have a special use case and IBM Partner World is not appropriate, what do I do?
If the software access keys available through IBM Partner World are not appropriate for your use case, you can follow up with your IBM channels rep.
15. I need further help, what should I do?
If there is a question or specific issue you want to discuss, users have the following options:
- Talk to your Sales Representative or email firstname.lastname@example.org .
- If it is a technical issue or you are not sure how to proceed further, use our forums or contact support ( https://ibm.biz/qradarforums ).
16. QRadar Proof-of-Concept (POC) & QRadar Evaluation Programs (IBM Only)
After the pertinent request details are compiled, the POC manager is responsible for contacting the Security Licensing team ( Q1PD ) with a request to release License Keys. Only the POC Manager will be able to approve the release of POC Licenses.
For appliance projects, the license will be generated and delivered to your Sales Team upon delivery of the appliance. For Virtual projects the license will be generated based on the start date provided to the License team and delivered to your Sales Team.
Where do you find more information?