Revision as of 12:01, 28 July 2025

Some apps require dependencies to be pulled down (if so it is explained in the apps' README), to pull down the required dependencies make sure you have the following installed:

Python 3 and pip
Docker
QRadar App SDK v2 - Current version 2.2.3

Setup your environment

Install Docker

1) Install Docker-CE on RHEL/CentOS 8

sudo subscription-manager repos --enable codeready-builder-for-rhel-8-$(arch)-rpms
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-8.noarch.rpm
sudo dnf install pass

Important: If you already have Podman/ContainerD, you must remove

sudo dnf uninstall podman runc

2) Start Docker-CE

sudo systemctl enable docker
sudo systemctl start docker

3) Check Do

sudo usermod -aG docker <MY USER>

Install QRadar SDK

4) Download Qradar SDK from XForce

https://exchange.xforce.ibmcloud.com/hub/extension/517ff786d70b6dfa39dde485af6cbc8b

5) Extract package

mkdir SDK
cd SDK
unzip QRadarAppSDK-2.2.3.zip

6) Run installer

Is important to have sudo permission, because script create a qapp in /usr/local/bin/

./install.sh

Cloning sample repository

Let's get some examples

1) Clone the repository and go to HelloWorld application

git clone https://github.com/IBM/qradar-sample-apps.git

cd qradar-sample-apps/HelloWorld

2) Change manifest.json

Let's change the default image, with a new one.

"image": "qradar-app-base:4.0.0",

3) Run HelloWorld

qapp run

Deploy on QRadar

1) Create a package

qapp package -p app.zip

2) Deploy on QRadar

qapp deploy -p app.zip -q 192.168.42.150 -u admin

Ver também