IBM Security QRadar Packet Capture Version Dell PowerEdge R730 System Setup Guide IBM

Transcription

1 IBM Security QRadar Packet Capture Version Dell PowerEdge R730 System Setup Guide IBM

2 Note Before you use this information and the product that it supports, read the information in Notices on page 17. Product information This document applies to IBM QRadar Security Intelligence Platform V7.3.1 and subsequent releases unless superseded by an updated version of this document. Copyright IBM Corporation 2016, US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

3 Contents Introduction to installing QRadar Packet Capture v 1 QRadar Packet Capture on a PowerEdge R730 system QRadar Packet Capture system requirements... 1 Intel SFP+ and SFP compatibility list Configuring system BIOS on a Dell PowerEdge R730 system Configure the PERC H730P RAID Controller for the Dell PowerEdge R730 system Creating an operating system partition Creating an extraction partition Creating a capture partition Installations on IBM Security QRadar Packet Capture appliances Installing QRadar Packet Capture by using a DVD. 9 Installing QRadar Packet Capture by using an SFS image Installing QRadar Packet Capture by using a PXE Server Configuration of QRadar Packet Capture Configuring the UTC time on your packet capture appliance Configuring the network settings on your packet capture appliance Changing the system passwords on your packet capture appliance Connecting the master and data nodes in a clustered packet capture environment Notices Trademarks Terms and conditions for product documentation.. 18 IBM Online Privacy Statement Privacy policy considerations Copyright IBM Corp. 2016, 2018 iii

4 iv IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

5 Introduction to installing QRadar Packet Capture This documentation provides you with information that you need to install and configure IBM Security QRadar Packet Capture. Intended audience System administrators who are responsible for installing QRadar Packet Capture must be familiar with network security concepts and device configurations. Technical documentation To find IBM Security QRadar product documentation in the QRadar products library, see Accessing IBM Security Documentation Technical Note ( Contacting customer support For information about contacting customer support, see the Support and Download Technical Note ( Statement of good security practices IT system security involves protecting systems and information through prevention, detection and response to improper access from within and outside your enterprise. Improper access can result in information being altered, destroyed, misappropriated or misused or can result in damage to or misuse of your systems, including for use in attacks on others. No IT system or product should be considered completely secure and no single product, service or security measure can be completely effective in preventing improper use or access. IBM systems, products and services are designed to be part of a lawful comprehensive security approach, which will necessarily involve additional operational procedures, and may require other systems, products or services to be most effective. IBM DOES NOT WARRANT THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY. Please Note: Use of this Program may implicate various laws or regulations, including those related to privacy, data protection, employment, and electronic communications and storage. IBM Security QRadar may be used only for lawful purposes and in a lawful manner. Customer agrees to use this Program pursuant to, and assumes all responsibility for complying with, applicable laws, regulations and policies. Licensee represents that it will obtain or has obtained any consents, permissions, or licenses required to enable its lawful use of IBM Security QRadar. Copyright IBM Corp. 2016, 2018 v

6 vi IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

7 1 QRadar Packet Capture on a PowerEdge R730 system Use this document to configure your Dell PowerEdge system as a single-system packet capture solution, or as part of a multi-system packet capture solution. In a multi-system packet capture solution, each cluster must contain one master and 1 or 2 Data Nodes. QRadar Packet Capture system requirements The IBM Security QRadar Packet Capture appliance must meet the following system requirements. Table 1. System Requirements Description System CPU RAID Controller RAM HDD NIC Monitor Optical Cables Value Dell PowerEdge R730 E V3 PERC H730P Mini RAID Controller Minimum 64 GB per CPU (128 GB) Twelve 4 TB near-line SAS front-mounted hard disks that are connected to the RAID Controller. v v 2-4 TB drives in RAID TB drives in RAID5 2 Intel X520 NICs with 10 Gb/s SFP+ modules External monitor plugged into the VGA port. 2 or 3 optical cables for testing packet capture Operating System Red Hat Enterprise Linux V6.9 The system must support the Intel AES and AVX standards that were introduced by Intel in For information about installing IBM Security QRadar Packet Capture on your own appliance, see the IBM Security QRadar Packet Capture Quick Reference Guide. Preparing to setup your packet capture environment Use the following list to help you prepare for setting up your packet capture environment: v Attach an external monitor by using the VGA port. v Have 2 or 3 optical cables available for testing packet capture on Interface 0, and for testing the connectivity between the master and data node in a clustered environment. v Install two Intel X Gbit/s NICs in the exact slots that are shown in these diagrams. You can use a single X520 NIC that is for a stand-alone setup or an individual Data Node. You must install the single NIC where Interface 0 is marked on the diagram. Copyright IBM Corp. 2016,

8 Figure 1. Cluster Master or Stand-Alone System Figure 2. Cluster Data Node Intel SFP+ and SFP compatibility list The QRadar Packet Capture appliance has only one capture port (DNA0). The appliance is not equipped with an SFP transceiver, so you must install either an SFP+ 10G transceiver or an SFP 1G (Copper RJ45) transceiver into the capture port. When an SFP 1G transceiver is installed, it truncates the capture rate to 1 Gbps. To have multiple 1G connections, you can put a switch or an aggregator in front of where the 10G outbound port goes into the QRadar Packet Capture SFP+ 10G port. As a result, you can have multiple 1 Gb ports aggregated into the QRadar Packet Capture 10G SFP+ interface. The following transceiver types are compatible with the PowerEdge R730 system: v Dual rate 10GBASE-SR/1000BASE-SX, Intel Ethernet SFP+ SR Optical v Dual rate 10GBASE-LR/1000BASE-LX, Intel Ethernet SFP+ LR Optical v 1000BASE-T, Finisar Gigabit Ethernet v HP Gigabit SX To purchase an SFP transceiver for your QRadar Packet Capture appliance, contact your IBM Sales Representative for specific part numbers, and then see the following vendor websites: v Digi-Key web site ( v Mouser Electronics web site ( v CDW web site ( v Newegg web site ( v Amazon web site ( 2 IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

9 2 Configuring system BIOS on a Dell PowerEdge R730 system Use the BIOS to configure the system settings for your IBM Security QRadar Packet Capture appliance. The settings are based on system BIOS version If your BIOS is newer, verify that these same settings exist in the version that you have. Procedure 1. To access the BIOS system setup, press the F2 key while the system is powering on. 2. From the System Setup Main Menu screen, select System BIOS. 3. On the lower right side of the screen, click Default to load the default settings. 4. On the System BIOS page, click Processor Settings and configure these settings: Table 2. Processor Settings Setting Logical processor QPI Speed Value Enabled 9.6 GT/s 5. Press the Esc key to return to the System BIOS Settings page. 6. On the System BIOS Settings page, click System Profile Settings and configure these settings: Table 3. System Profile Settings Setting System Profile CPU Power Management Memory Frequency Turbo Boost Energy Efficiency Policy Value Custom OSDBPM Max Performance Disabled Performance 7. Press the Esc key twice to return to the System BIOS screen. 8. Save changes when prompted. 9. When prompted, select Yes to exit and restart the system. Copyright IBM Corp. 2016,

10 4 IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

11 3 Configure the PERC H730P RAID Controller for the Dell PowerEdge R730 system The virtual drive configuration consists of a 128 GB operating system RAID 1 partition on the first two disk drives, and an extraction RAID 1 partition that uses the remaining space on those same two drives. The remaining 10 drives are used for a RAID 5 capture partition. It is important to create the RAID partitions in a specific order, and by using the configuration settings as described. Some settings can change dynamically, so it is important to verify the settings throughout the process. An incorrect RAID configuration can cause performance or system failures later. 1. Create the operating system partition. 2. Create the extraction partition. 3. Create the capture partition. Creating an operating system partition Use the following settings to create a 128 GB operating system partition RAID 1 configuration on the first two disk drives. Some settings can change dynamically. It is important to double-check the settings as you progress. An incorrect RAID configuration can cause performance or system failures later. Procedure 1. Press the F2 key while the system powers on to access the BIOS System Setup. 2. From the System Setup Main menu, select Device Settings. 3. Select Integrated RAID Controller 1: Dell Perc <PERC H730P Mini> Configuration Utility. 4. From the Main menu, select Configuration Management > Create Virtual Disk and use the following table to configure the virtual disk settings: Table 4. Configuration Management - Create Virtual Disk Setting Select RAID Level Secure Virtual Disk Use Data Protection Select Physical Disks From Value RAID1 Clear Clear Unconfigured Capacity 5. Click Select Physical Disks. This selection takes you to the Main Menu > Configuration Management > Create Virtual Disk > Select Physical Disks menu. 6. Use the following table to configure the physical disk parameters: Table 5. Physical Disk parameters Setting Select Media Type Select Interface Type Logical Sector Value HDD SAS 512 B Copyright IBM Corp. 2016,

12 7. Under Choose Unconfigured Physical Disks > RAID 1, select the first two disks, which are identified as 00:01:00 and 00:01:01 and then select Apply Changes. 8. Click OK to accept the message that indicates that the operation was completed successfully. 9. Select Configure Virtual Disk Parameters and use the following table to configure the virtual disk parameters: Table 6. Virtual Disk parameters Setting Virtual Disk Name Value Leave default setting. Virtual Disk Size 128 Virtual Disk Size Unit Strip Element Size Read Policy Write Policy Disk Cache Default Initialization GB 256 KB Read Ahead Force Write Back Enable Fast 10. Check Confirm and select Yes to confirm creating the virtual disk and permanently deleting the data. 11. Click OK to accept the successful operation message. Creating an extraction partition Use the following configuration settings to create an extraction RAID 1 virtual partition from the remaining space that was used to configure the operating system partition. Some settings can change dynamically. It is important to double-check the settings as you progress. An incorrect RAID configuration can cause performance or system failures later. Procedure 1. From the Main menu, select Configuration Management. 2. Use the following table to configure the virtual disk: Table 7. Configuration Management - Create Virtual Disk Setting Select RAID Level Secure Virtual Disk Use Data Protection Select Physical Disks From Value RAID1 Clear Clear Free Capacity 3. Click Select Disk Groups. This selection takes you to the Main Menu > Configuration Management > Create Virtual Disk > Select Disk Groups menu. Use the following table to verify the disk group parameters: Table 8. Disk Group parameters Setting Disk Group 0: RAID1 Free Space Value Selected 3597 GB 6 IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

13 Table 8. Disk Group parameters (continued) Setting Associated Physical Disks Value Verify the selections: Physical Disk 00:01:00: HDD, SAS, 3725GB, Online, (512B) Physical Disk 00:01:01: HDD, SAS, 3725GB, Online, (512B) 4. Click Apply changes and then click OK to accept the successful operation message. 5. Select Configure Virtual Disk Parameters and use the following table to configure the virtual disk parameters: Table 9. Virtual Disk parameters Setting Virtual Disk Name Value Leave default setting. Virtual Disk Size 3597 Virtual Disk Size Unit Strip Element Size Read Policy Write Policy Disk Cache Default Initialization GB 256 KB Read Ahead Force Write Back Enable Fast 6. Click Create Virtual Disk to save the configuration changes. 7. Check Confirm and select Yes to confirm the virtual disk creation and permanently delete the data. 8. Click OK to accept the successful operation message. Creating a capture partition Use the following settings to create a RAID 5 capture partition for the remaining 10 disk drives. Some settings can change dynamically. It is important to double-check the settings as you progress. An incorrect RAID configuration can cause performance or system failures later. Procedure 1. From the System Setup Main menu, select Configuration Management > Create Virtual Disk. 2. Use the following table to configure the virtual disk: Table 10. Configuration Management - Create Virtual Disk Setting Select RAID Level Secure Virtual Disk Use Data Protection Select Physical Disks From Value RAID5 Clear Clear Unconfigured Capacity 3. Click Select Physical Disks. This selection takes you to the Main Menu > Configuration Management > Create Virtual Disk > Select Physical Disks menu. 3 Configure the PERC H730P RAID Controller 7

14 Use the following table to configure the physical disk parameters: Table 11. Physical Disk parameters Setting Select Media Type Select Interface Type Logical Sector Value HDD SAS 512 B 4. Under Choose Unconfigured Physical Disks, click Check all to select the remaining drives. 5. Click Apply changes and then click OK to accept the successful operation message. 6. Select Configure Virtual Disk Parameters and use the following table to configure the settings: Table 12. Virtual Disk parameters Setting Value Virtual Disk Name Leave default setting. Virtual Disk Size Virtual Disk Size Unit GB Strip Element Size 1 MB Read Policy Read Ahead Write Policy Force Write Back Disk Cache Enable Default Initialization Fast 7. Click Create Virtual Disk to save the configuration changes. 8. Select Confirm to create the virtual disk. 9. Press the Esc key twice to return to the Integrated RAID Controller Main menu. 10. Select Virtual Disk Management from the Integrated RAID Controller Main menu and verify that all of the virtual disks were created as shown in the following table: Table 13. Virtual Disk Management Virtual Disk RAID Level Virtual Disk Size Status Virtual Disk 0 RAID1 128 GB Ready Virtual Disk 1 RAID GB Ready Virtual Disk 2 RAID GB Optimal 11. Press the Esc key several times to return to the System Setup Main menu. 12. When prompted, select Yes to exit and restart the system. 8 IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

15 4 Installations on IBM Security QRadar Packet Capture appliances Choose the method that you want to use to install the software on your IBM Security QRadar Packet Capture appliance. For information about installing the software on your own hardware, see the IBM Security QRadar Packet Capture Quick Reference Guide. Installing QRadar Packet Capture by using a DVD You can use a DVD to install QRadar Packet Capture on your packet capture appliance. Before you begin Use this checklist to prepare for the installation: v Download the stand-alone image from IBM Fix Central ( You must be able to boot the system by using this image. v If you are configuring a multi-system packet capture solution, you also need to download the data node image. You must be able to boot the system by using this image. v Ensure that the RAID configuration is setup and that the system was restarted. v Ensure that you do not have additional USB devices, or extra network / packet capture cables plugged into the system while you are installing. About this task A multi-system clustered configuration consists of one master system, and 1 or 2 data nodes. Make sure that you boot from the appropriate image source, depending on the final system configuration that you want. The cluster master device uses the same image as a stand-alone device. Procedure 1. Plug in an external DVD drive into the system with the image DVD inserted. 2. During the startup process, press F12 to enter the Select Boot Device screen. 3. Select the option that refers to the DVD option. For example, select USB12:CD/DVD - USP Port 12 REAR CONNECTOR 5. This will start Clonezilla. 4. When you see the screen indicating that you are about to restore the image to the hard drive /partition, type Y when prompted with the message Are you sure you want to continue?. 5. Type Y again when prompted to confirm that you want to restore the image. 6. After the imaging process completes successfully, select Power off. 7. Disconnect the DVD drive from the system. 8. Power on the system and log in as the root user. The default password is P@ck3t Type cd /root to change to the root directory. 10. Type./Reset_Interfaces.sh to run the script and restart the system. 11. After the system restarts, log in as the root user again. 12. At the command prompt, type df -h and verify the following information: a. On the line that begins with /dev/sdc, check that the size of the /storage0 partition is 33 TB. b. On the line that begins with /dev/sdb1, check that the size of the /extraction partition is 3.5 TB. Copyright IBM Corp. 2016,

16 c. If the partitions are not the correct size, ensure that the operating system, extraction, and capture RAID arrays were created correctly, and in the correct order before you deployed the image. The sizes of sdc and sdb1 are based on using all 4 TB hard disks in the system. If different disks are used, the relative size of the sdc and sdb increases or decreases with the size of the hard disks. The operating system partition (sda) is always fixed because it was set up in the RAID configuration. Installing QRadar Packet Capture by using an SFS image You can use an.sfs image to install QRadar Packet Capture on your packet capture appliance. Before you begin Use this checklist to prepare for the installation: v Download the stand-alone image from IBM Fix Central ( You must be able to boot the system by using this image. v If you are configuring a multi-system packet capture solution, you also need to download the data node image. You must be able to boot the system by using this image. v Ensure that the RAID configuration is setup and that the system was restarted. v Ensure that you do not have additional USB devices, or extra network / packet capture cables plugged into the system while you are installing. About this task A multi-system clustered configuration consists of one master system, and 1 or 2 data nodes. Make sure that you boot from the appropriate image source, depending on the final system configuration that you want. The cluster master device uses the same image as a stand-alone device. Procedure 1. Download the.sfs image from IBM Fix Central ( The.sfs file is named x.x.x-qradar-pcap-build-nnnn.sfs, where: v v x.x.x is the release version. nnnn is a four-digit number that is allocated to the build. 2. Type mkdir -p /tmp/qradar_pcap_install to create a temporary directory. If the temporary directory already exists, ensure that it is empty. 3. Type the following command to mount the installer file to the temporary directory: mount -o loop -t squashfs x.x.x-qradar-pcap-build-nnnn.sfs /tmp/qradar_pcap_install 4. Type the following command to change into the installer directory: cd /tmp/qradar_pcap_install 5. Type the following command to run the installation script: sh./installer.sh 6. Restart the system. Ensure that the release version and build number match installed version. Installing QRadar Packet Capture by using a PXE Server You can use a PXE Server to install QRadar Packet Capture on your packet capture appliance. Before you begin Use this checklist to prepare for the installation: 10 IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

17 v Download the stand-alone image from IBM Fix Central ( You must be able to boot the system by using this image. v If you are configuring a multi-system packet capture solution, you also need to download the data node image. You must be able to boot the system by using this image. v Ensure that the RAID configuration is setup and that the system was restarted. v Ensure that you do not have additional USB devices, or extra network / packet capture cables plugged into the system while you are installing. About this task A multi-system clustered configuration consists of one master system, and 1 or 2 data nodes. Make sure that you boot from the appropriate image source, depending on the final system configuration that you want. The cluster master device uses the same image as a stand-alone device. Procedure 1. Plug in a network cable provided from the PXE Server into the Eth2/PXE0 port. For images of the back panel on specific hardware, see the IBM Security QRadar Packet Capture Quick Reference Guide. 2. Reboot the system from the PXE interface by using the downloaded image. 3. Depending on the image that you are installing, the following steps might be automated. If so, skip to the next step. a. When the system restarts, select the default menu option at the top. b. Select Y at the prompt Are you sure you want to continue? c. Select Y at the prompt Let me ask you again. Are you sure you want to continue? 4. After the imaging process completes successfully, select Power off. 5. Power on the system and log in as the root user. The default password is P@ck3t Type cd /root to change to the root directory. 7. Type./Reset_Interfaces.sh to run the script and restart the system. 8. After the system restarts, log in as the root user again. 9. At the command prompt, type df -h and verify the following information: a. On the line that begins with /dev/sdc, check that the size of the /storage0 partition is 33 TB. b. On the line that begins with /dev/sdb1, check that the size of the /extraction partition is 3.5 TB. c. If the partitions are not the correct size, ensure that the operating system, extraction, and capture RAID arrays were created correctly, and in the correct order before you deployed the image. The sizes of sdc and sdb1 are based on using all 4 TB hard disks in the system. If different disks are used, the relative size of the sdc and sdb increases or decreases with the size of the hard disks. The operating system partition (sda) is always fixed because it was set up in the RAID configuration. 4 Installations on IBM Security QRadar Packet Capture appliances 11

18 12 IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

19 5 Configuration of QRadar Packet Capture After you set up IBM Security QRadar Packet Capture, you must configure the system before you can capture packet data. Configuring the UTC time on your packet capture appliance Use these steps to configure the date and time on your IBM Security QRadar Packet Capture appliance. About this task By default, the Network Time Protocol (NTP) service uses public servers. If you want to use an internal server, you must edit the /etc/ntp.conf file and change the lines that begin with "server" to your server. Procedure 1. At the command line, use the date command to change the current Coordinated Universal Time time. The format for the date command is: date <month><day><hour><minutes><year> For example, to set the date and time to February 25, 2016 at 3:07 PM, type date To set the hardware / BIOS clock, type /sbin/hwclock --systohc. Configuring the network settings on your packet capture appliance Before you can capture packets, you must configure the network settings on the IBM Security QRadar Packet Capture appliance. Before you begin You must have a display and keyboard connected. You must provide an Ethernet connection to one of the onboard Ethernet ports (Eth2, Eth3, or Eth4). Procedure 1. Check which network interfaces are available by using the following command: ifconfig grep eth 2. Note the hardware address /etc/sysconfig/nework-scripts/ifcfg-eth*. 3. Edit the /etc/sysconfig/nework-scripts/ifcfg-eth* files to configure the standard Ethernet interfaces that you use to communicate remotely with the system. Copyright IBM Corp. 2016,

20 eth* represents ETH4, ETH5, ETH6, and so on. Ensure that you do not change the preconfigured 10G static interfaces (1.1.1.X or X) because they are used for master and data node connectivity. To set a static IP address, use the following table and replace the values with information that is specific to your deployment. By default, the system has active DHCP ports. If DHCP is used, no IP address configuration is required. Table 14. IP address configuration Setting DEVICE HWADDR BOOTPROTO Value ETH0 34:40:B5:A3:9F:F7 Static GATEWAY IPADDR NETMASK NM_CONTROLLED ONBOOT 4. Provide fiber 10G connections by using the Interface 0 ports that are shown in the diagram above. Yes Yes Important: Ensure that there is traffic over the connections. To capture traffic, you must use a Tap or SPAN (mirror) port. When you use a SPAN port on a switch, if the switch assigns a lower priority to the SPAN port, some packets might be dropped. 5. Restart the system, and log in by using the following credentials: User: continuum Password: P@ck3t After you are logged in, open a terminal session and type #ifconfig -a. Record the IP address for the connected Ethernet port. Note: For information about setting a static IP address, see the IBM Security QRadar Packet Capture User Guide. 7. Test the connection by pinging the internal network, or by remote login via SSH on port Important: To configure a clustered environment, you must first connect the master and data node systems together. Changing the system passwords on your packet capture appliance After you set up the appliance, change the default operating system password for IBM Security QRadar Packet Capture. The operating system passwords and the QRadar Packet Capture web interface accounts are independent accounts and are set separately. Procedure 1. Use SSH and port 4477 to log in as the root user. The default password for the root user is P@ck3t To change the default operating system passwords, type this command for both the root and continuum user names: passwd <user name> 14 IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

21 3. To force a password change to the OS user accounts with the next log in, type the following command for every user account: change -d 0 <user name> This should be the last thing that you do before shutting down the system. 4. To change the Packet Capture web user interface account passwords, as required upon first login, use the following steps: a. Log in to the UI b. Click the Admin tab. c. Under User Management, edit the current user account password as required, and click Save. Note: Passwords need to be at least 8 characters long. They must have one or more uppercase and lowercase letters, and one or more special characters ($,%,*). Connecting the master and data nodes in a clustered packet capture environment To configure a clustered environment, use a fiber optic cable to connect the QRadar Packet Capture Data Node appliances to the master packet capture device. If you have only a standalone packet capture system, this step is not required. Before you begin Ensure that you have a successful network connection to the master packet capture device. About this task Use the following hardware diagram to help you configure a clustered packet capture environment by using a Dell PowerEdge R730 packet capture device and QRadar Packet Capture Data Node. 5 Configuration of QRadar Packet Capture 15

22 Procedure 1. On the back of the packet capture device, connect the left cluster-interface port on the master to the left cluster-interface port on the first data node. 2. If you are connecting a second data node, connect the right cluster-interface port on the master to the right cluster-interface port on the second data node. 3. Open a terminal session on the master system and check the connections with a ping test. ping ping If you do not receive a response from the ping test, swap the cable connections on only the data node interfaces. v v If only one data node is attached, only one ping must respond successfully. After you switch the cables, if you do not get a response from the ping test, switch the cables on the data node NIC to the second optical Ethernet NIC (if installed). Repeat the ping test. 16 IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

23 Notices This information was developed for products and services offered in the U.S.A. IBM may not offer the products, services, or features discussed in this document in other countries. Consult your local IBM representative for information on the products and services currently available in your area. Any reference to an IBM product, program, or service is not intended to state or imply that only that IBM product, program, or service may be used. Any functionally equivalent product, program, or service that does not infringe any IBM intellectual property right may be used instead. However, it is the user's responsibility to evaluate and verify the operation of any non-ibm product, program, or service. IBM may have patents or pending patent applications covering subject matter described in this document. The furnishing of this document does not grant you any license to these patents. You can send license inquiries, in writing, to: IBM Director of Licensing IBM Corporation North Castle Drive Armonk, NY U.S.A. For license inquiries regarding double-byte character set (DBCS) information, contact the IBM Intellectual Property Department in your country or send inquiries, in writing, to: Intellectual Property Licensing Legal and Intellectual Property Law IBM Japan Ltd , Nihonbashi-Hakozakicho, Chuo-ku Tokyo , Japan INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS PUBLICATION "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some jurisdictions do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the publication. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this publication at any time without notice. Any references in this information to non-ibm websites are provided for convenience only and do not in any manner serve as an endorsement of those websites. The materials at those websites are not part of the materials for this IBM product and use of those websites is at your own risk. IBM may use or distribute any of the information you provide in any way it believes appropriate without incurring any obligation to you. Licensees of this program who wish to have information about it for the purpose of enabling: (i) the exchange of information between independently created programs and other programs (including this one) and (ii) the mutual use of the information which has been exchanged, should contact: Copyright IBM Corp. 2016,

24 IBM Director of Licensing IBM Corporation North Castle Drive, MD-NC119 Armonk, NY US Such information may be available, subject to appropriate terms and conditions, including in some cases, payment of a fee. The licensed program described in this document and all licensed material available for it are provided by IBM under terms of the IBM Customer Agreement, IBM International Program License Agreement or any equivalent agreement between us. The performance data and client examples cited are presented for illustrative purposes only. Actual performance results may vary depending on specific configurations and operating conditions.. Information concerning non-ibm products was obtained from the suppliers of those products, their published announcements or other publicly available sources. IBM has not tested those products and cannot confirm the accuracy of performance, compatibility or any other claims related to non-ibm products. Questions on the capabilities of non-ibm products should be addressed to the suppliers of those products. Statements regarding IBM's future direction or intent are subject to change or withdrawal without notice, and represent goals and objectives only. All IBM prices shown are IBM's suggested retail prices, are current and are subject to change without notice. Dealer prices may vary. This information contains examples of data and reports used in daily business operations. To illustrate them as completely as possible, the examples include the names of individuals, companies, brands, and products. All of these names are fictitious and any similarity to actual people or business enterprises is entirely coincidental. Trademarks IBM, the IBM logo, and ibm.com are trademarks or registered trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at Terms and conditions for product documentation Permissions for the use of these publications are granted subject to the following terms and conditions. Applicability These terms and conditions are in addition to any terms of use for the IBM website. Personal use You may reproduce these publications for your personal, noncommercial use provided that all proprietary notices are preserved. You may not distribute, display or make derivative work of these publications, or any portion thereof, without the express consent of IBM. 18 IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

25 Commercial use You may reproduce, distribute and display these publications solely within your enterprise provided that all proprietary notices are preserved. You may not make derivative works of these publications, or reproduce, distribute or display these publications or any portion thereof outside your enterprise, without the express consent of IBM. Rights Except as expressly granted in this permission, no other permissions, licenses or rights are granted, either express or implied, to the publications or any information, data, software or other intellectual property contained therein. IBM reserves the right to withdraw the permissions granted herein whenever, in its discretion, the use of the publications is detrimental to its interest or, as determined by IBM, the above instructions are not being properly followed. You may not download, export or re-export this information except in full compliance with all applicable laws and regulations, including all United States export laws and regulations. IBM MAKES NO GUARANTEE ABOUT THE CONTENT OF THESE PUBLICATIONS. THE PUBLICATIONS ARE PROVIDED "AS-IS" AND WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO IMPLIED WARRANTIES OF MERCHANTABILITY, NON-INFRINGEMENT, AND FITNESS FOR A PARTICULAR PURPOSE. IBM Online Privacy Statement IBM Software products, including software as a service solutions, ( Software Offerings ) may use cookies or other technologies to collect product usage information, to help improve the end user experience, to tailor interactions with the end user or for other purposes. In many cases no personally identifiable information is collected by the Software Offerings. Some of our Software Offerings can help enable you to collect personally identifiable information. If this Software Offering uses cookies to collect personally identifiable information, specific information about this offering s use of cookies is set forth below. Depending upon the configurations deployed, this Software Offering may use session cookies that collect each user s session id for purposes of session management and authentication. These cookies can be disabled, but disabling them will also eliminate the functionality they enable. If the configurations deployed for this Software Offering provide you as customer the ability to collect personally identifiable information from end users via cookies and other technologies, you should seek your own legal advice about any laws applicable to such data collection, including any requirements for notice and consent. For more information about the use of various technologies, including cookies, for these purposes, See IBM s Privacy Policy at and IBM s Online Privacy Statement at the section entitled Cookies, Web Beacons and Other Technologies and the IBM Software Products and Software-as-a-Service Privacy Statement at Privacy policy considerations IBM Software products, including software as a service solutions, ( Software Offerings ) may use cookies or other technologies to collect product usage information, to help improve the end user experience, to tailor interactions with the end user or for other purposes. In many cases no personally identifiable information is collected by the Software Offerings. Some of our Software Offerings can help enable you to Notices 19

26 collect personally identifiable information. If this Software Offering uses cookies to collect personally identifiable information, specific information about this offering s use of cookies is set forth below. Depending upon the configurations deployed, this Software Offering may use session cookies that collect each user s session id for purposes of session management and authentication. These cookies can be disabled, but disabling them will also eliminate the functionality they enable. If the configurations deployed for this Software Offering provide you as customer the ability to collect personally identifiable information from end users via cookies and other technologies, you should seek your own legal advice about any laws applicable to such data collection, including any requirements for notice and consent. For more information about the use of various technologies, including cookies, for these purposes, See IBM s Privacy Policy at and IBM s Online Privacy Statement at the section entitled Cookies, Web Beacons and Other Technologies and the IBM Software Products and Software-as-a-Service Privacy Statement at 20 IBM Security QRadar Packet Capture: Dell PowerEdge R730 System Setup Guide

27 Notices 21

28 IBM Printed in USA