Installing QRadar VA on VirtualBox

Tested with QRadar 7.1 on virtual box 4.2.8

Create a redhat 64 bit VM blank appliance. 32GB minimum disk (either dynamic or static is fine. Allocate 8GB of RAM for all in one SEIM. Link the ISO and boot

  • Select the first option in GRUB (install with VGA), skip checking the media and wait for the redhat install to complete
  • It will reboot at the end. Don’t forget to unlink the ISO image so it boots from the drive
  • Select the first option in GRUB (install QRadar)
  • It will then install actual Q1 components
  • At the end of the installation type “SETUP” to run get QRadar configured
  • Go through the license, and activate. Keep in mind that
  • SIEM All in one - requires 8G
  • Software only - does not need 8Gb but lacks the web console
  • specify server for the time sync - and put in on the next one, so you can pause/resume the VM with no issues
  • Specify your VM network parameters and a fake email server (you’ll get mail right on the box by default).
  • Reboot. Browse to the box, you should see the QRadar console come up. Enjoy

Network configs

For bridged (not natted connection) qradar.hq.dom Net

emailserver: qradar

Name qradar.domain

Email server email.qradar.domain root/admin

Remove vmware tools

yum remove vmware-tools-foundations

Install virtual box tools

click install guest additions mount /dev/cdrom /media/cdrom/

Licensed under CC BY-NC-SA 4.0
Based off the Stack theme.