Deploy QRadar EDR on Red Hat OpenShift using CASE

Managing a fleet of endpoints can be a challenging task. If your organization has specific security goals or requirements, strict regulatory or compliance laws, or data sovereignty concerns, you might not be able to use security solutions delivered as "software as a service" (SaaS). You need flexible deployment options for endpoint detection and response (EDR) in your environment. So how can you safeguard your business continuity and endpoint security needs while still meeting stringent compliance requirements?

IBM QRadar EDR running on premises remediates known and unknown endpoint threats in near real-time, using AI and intelligent automation that requires little to no human interaction.

This tutorial takes you through the deployment procedure for IBM Security QRadar EDR on Red Hat OpenShift with Container Application Software for Enterprises (CASE). You'll learn two distinct processes:

• Step-by-step installation: You'll find a comprehensive step-by-step approach to installing QRadar EDR, outlining detailed commands for setting up the environment, creating a namespace, setting environment variables, and installing QRadar EDR using the oc command-line interface. You'll follow a clear, concise process to deploy successfully.
• Verification and post-installation steps: You'll verify the deployment and walk through additional steps required after installation. You'll learn how to check the success of the installation, retrieve initial login credentials for the QRadar EDR dashboard, and review post-installation considerations.

Prerequisites

Before following the steps in this article, ensure you meet the following software and hardware requirements:

Software

• Red Hat OpenShift Container Platform cluster: To ensure that IBM Security QRadar EDR works correctly, you must meet or exceed the minimum requirements on your Red Hat OpenShift Container Platform cluster. See the QRadar system requirements documentation. )

  Important: These requirements are for one instance of QRadar EDR running on Red Hat OpenShift Container Platform. Do not install anything other than QRadar EDR on your cluster.

• Operating system: Linux 64-bit (x86_64) systems

  Tip: QRadar EDR includes support for huge pages. The huge pages feature makes it possible for the operating system to support memory pages greater than the default, which is usually 4 KB.

• Red Hat OpenShift Container Platform 4.12.x , or 4.14.x installed by a user with cluster administrator permissions. For more information, see Setting up Red Hat OpenShift Container Platform clusters

Hardware

• IBM® Security QRadar® EDR is supported and tested for AMD64 architecture.

  Important: These requirements are for one instance of QRadar EDR running on Red Hat® OpenShift® Container Platform.

Cluster configuration

In this tutorial, we use the following hardware for the cluster configurations:

Deployment

Storage

The integration capabilities in IBM Security QRadar EDR use persistent storage to provide reliable and resilient storage of state data. The cluster administrator must provide appropriate storage classes that meet the requirements of the respective Red Hat OpenShift Container Platform environment.

Important: To install QRadar EDR, you must configure a VSphere CSI (thin-csi) storage class in the cluster with allowVolumeExpansion set to true. For more information, see the Red Hat OpenShift documentation for VMware vSphere CSI Driver Operator.

In this tutorial, we use the storage capacity shown in the following table:

Before starting, review the following documentation:

• QRadar EDR security considerations
• QRadar EDR domain name and TLS certificates

Notes:

• The user who installs QRadar EDR must have cluster administrator permissions.
• You can install multi-zone and single-zone deployments where appropriate storage providers are available to support that deployment model.

Component technologies

These are the components required during the installation of QRadar EDR. (See Installing QRadar EDR by using CASE for full details.)

• WSL (Windows operating system only): The Windows Subsystem for Linux (WSL) enables you to install a Linux distribution (such as Ubuntu, OpenSUSE, Kali, Debian, Arch Linux, etc) and use Linux applications, utilities, and Bash command-line tools directly on Windows, unmodified, without the overhead of a traditional virtual machine or dualboot setup.

• Red Hat OpenShift CLI: The Red Hat OpenShift CLI client helps you develop, build, deploy, and run your applications on any Red Hat OpenShift or Kubernetes cluster. It also includes the administrative commands for managing a cluster under the adm subcommand.

  Download Red Hat OpenShift CLI 4.12 or later from the Red Hat mirror site.

• Docker: Download and set up the Docker CLI tool for your computer operating system (OS).

  • CentOS
  • Debian
  • Fedora
  • MacOS
  • Ubuntu

• Podman (if Docker is not available): Download and set up the Podman CLI tool for your relevant computer operating system:

  • Linux distributions
  • MacOS

• IBM Catalog Management plug-in for Red Hat OpenShift CLI: Download the latest version of the plug-in.

  1. To download the latest release version on MacOS from the public GitHub repository, type the following command.

     curl -L https://github.com/IBM/ibm-pak-plugin/releases/latest/download/oc-ibm_pak-darwin-amd64.tar.gz -o oc-ibm_pak-plugin.tar.gz

     To download the latest release version on Linux from the public GitHub repository, type the following command.

     curl -L https://github.com/IBM/ibm-pak-plugin/releases/latest/download/oc-ibm_pak-linux-amd64.tar.gz -o oc-ibm_pak-plugin.tar.gz
     

  2. Extract the plug-in from the archive file by typing the following command.

         `tar -xvf oc-ibm_pak-plugin.tar.gz`
     

• Move the extracted plug-in to your /usr/local/bin directory by typing the following command.

      `oc ibm-pak --version `
  

Installing QRadar EDR on-premises

For full details on installing the QRadar EDR on-premises, see Installing QRadar EDR by using CASE in the QRadar documentation.

IBM Entitled Registry entitlement key

After you purchase a license for QRadar EDR, an entitlement for the software is associated with your MyIBM account ID. You must have an entitlement key for the IBM Entitled Registry to install QRadar EDR using the online or air-gapped method. You will be prompted for the key value during installation.

Fully qualified domain name chosen for EDR application

The fully qualified domain name (FQDN) of the Red Hat OpenShift Container Platform cluster is used with the TLS certificate for the platform FQDN. You can choose to create a unique FQDN for the QRadar EDR platform if you don’t want to use the Red Hat OpenShift Container Platform cluster FQDN.

Certificate of Authority (CA) (if required)

You will need to provide a TLS certificate for your QRadar EDR FQDN. The TLS certificate can be one of the following types:

• A certificate for a specific FQDN; for example, my.example.com
• A wildcard certificate; for example, *.example.com or *.apps.example.com

See Domain name and TLS certificates in the QRadar documentation. this for more information.

Steps

Following are the steps to install QRadar EDR. (For full details, see Installing QRadar EDR in the QRadar documentation.)

1. Create the edr_install working directory by typing the following command:

   export QRADAR_EDR_DIR=HOME/edr_install && mkdirQRADAR_EDR_DIR && cd $QRADAR_EDR_DIR

2. Set the following environment variables with CASE details:

   export CASE_NAME=ibm-security-edr
   export CASE_VERSION=1.0.5 
   export QRADAR_EDR_DIR=$HOME/edr_install 
   export IBMPAK_HOME=$QRADAR_EDR_DIR
   

3. Download and extract the QRadar EDR archive file by typing the following command:

   oc ibm-pak get $CASE_NAME --version $CASE_VERSION --disable-top-level-images-mode \
   && tar -xf $QRADAR_EDR_DIR/.ibm-pak/data/cases/$CASE_NAME/$CASE_VERSION/ibm-security-*.tgz \
   -C $QRADAR_EDR_DIR/.ibm-pak/data/cases/$CASE_NAME/$CASE_VERSION
   

4. Log in to the cluster by using either of the following commands, where openshift_url is the URL for your Red Hat OpenShift Container Platform environment:

   # Using a username and password:
   oc login <openshift_url> -u <username> -p <password>
   
   # Using a token:
   oc login --token=<token> --server=<openshift_url>
   

5. Set the QRadar EDR namespace variable and create a namespace in the cluster by typing the following commands:

    export QRADAR_EDR_NAMESPACE=edr
    oc new-project $QRADAR_EDR_NAMESPACE
   

6. Update the parameters in the $QRADAR_EDR_DIR/.ibm-pak/data/cases/ibm-security-edr/1.0.5/ibm-security-edr/inventory/ibmSecurityEdrOperatorSetup/files/values.conf file.

7. Install QRadar EDR by typing the following command (Note: The installation takes approximately 30 minutes):

    oc ibm-pak launch -t 1 \
    $CASE_NAME \
    --version $CASE_VERSION --inventory ibmSecurityEdrOperatorSetup \
    --namespace $QRADAR_EDR_NAMESPACE  \
    --action install --args "--acceptLicense true"
   

8. Verify the QRadar EDR installation by typing the following command:

    oc ibm-pak launch -t 1 $CASE_NAME --version $CASE_VERSION  
    --inventory ibmSecurityEdrOperatorSetup  --namespace $QRADAR_EDR_NAMESPACE  --action validate
   

9. When the installation is complete, the following message displays:

   [INFO] IBM Security EDR deployment is complete.

10. Log in to your QRadar EDR Dashboard as the initial admin user:

    a. Retrieve the URL for your QRadar EDR Dashboard by typing the following command:

    `oc get route -n $QRADAR_EDR_NAMESPACE`
    

    The following example output shows the QRadar EDR Dashboard URL:

    `iscp4s.example.eu-de.containers.appdomain.cloud`
    

    The name is isc-route-default and the host/port is cp4s.example.eu-de.containers.appdomain.cloud.

    b. Retrieve your initial QRadar EDR Dashboard log in credentials by typing the following command.

    oc get secret reaqta-hive-maia-users-secret -o json -n $QRADAR_EDR_NAMESPACE | jq '.data | map_values(@base64d)'

    The following example output shows that the login username is admin@example.com and the login password is <initial_admin_password>:

    {
    "admin.password": "<initial_admin_password>",
    "admin.username": "admin@example.com",
    "keeper.password": "<initial_keeper_password>",
    "keeper.username": "keeper@example.com"
    }
    

    c. In a web browser, go to your QRadar EDR Dashboard URL and log in with your initial admin credentials.

Benefits of deployment

QRadar EDR on-premises deployment using RedHat OpenShift (CASE) offers several value-added benefits for specific audiences, including:

• Organizations with sensitive data (one of the few EDR solutions to provide on-premise deployment): This type of deployment is beneficial for organizations that prioritize data residency and compliance with regulations or data sovereignty laws. QRadar EDR on premises allows these organizations to manage endpoint detection and response in-house, providing greater control over their sensitive data.
• Companies with air-gapped environments: On-premises deployment of QRadar EDR supports air-gapped environments, minimizing the risk of exposure to sensitive information by reducing internet connectivity. This setup is ideal for industries requiring a high level of security and autonomy.
• Organizations needing flexible deployment options: QRadar EDR running on Red Hat OpenShift offers long-term elasticity, allowing organizations to start small and scale later. The flexibility to deploy QRadar Suite across SIEM, SOAR, NDR, and EDR functions provides a customizable security solution.
• Operations needing Red Hat OpenShift support: The guide outlines the system requirements for Red Hat OpenShift, offering validated storage options and support for AMD64 architecture. This support ensures scalable and resilient storage for endpoint detection and response. This deployment is beneficial for security-focused organizations, especially those requiring a secure and flexible endpoint detection and response system on-premises with detailed deployment instructions and support.

Demo video

The following video demonstrates the steps outlined in this tutorial:

Video will open in new tab or window

Summary

In this article, we've discussed the benefits and shown you how to install IBM Security QRadar EDR in an environment with internet connectivity by using the Container Application Software for Enterprises (CASE). A CASE provides a package to configure multiple user roles to install, manage, and upgrade the software.

Next steps

After you install, there are multiple essential tasks: you need to secure your data through encryption, install Qradar EDR Agent on your endpoints, and enable Hive-Cloud. For details, see Postinstallation in the QRadar EDR documentation.

To learn more about security and QRadar EDR, see the following resources:

• Securing hybrid cloud and AI
• IBM QRadar EDR
• IBM Developer: Security hub (tutorials, articles, and resources)