License management

License keys entitle you to specific IBM® QRadar® products, and control the event and flow capacity for your QRadar deployment. You can add licenses to your deployment to activate other QRadar products, such as QRadar Vulnerability Manager.

When you install QRadar, the default license key is temporary and gives you access to the system for 35 days from the installation date. The email that you received from IBM when you purchased QRadar contains your permanent license keys. These license keys extend the capabilities of your appliance, and you must apply them before the default license expires.

To apply a license key to the system, follow these steps:
  1. Obtain the license key. For new or updated license keys, contact your local sales representative.
  2. Upload the license key.
  3. Allocate the license to a system.
  4. Deploy the full configuration.

After you apply the license keys to QRadar, redistribute the EPS and FPM rates to ensure that each of the managed hosts is allocated enough capacity to handle the average volume of network traffic, and still have enough EPS and FPM available to efficiently handle a data spike. You do not need to deploy the changes after you redistribute the EPS and FPM capacity.

License expiry

The processing capacity of the system is measured by the volume of events and flows that QRadar can process in real time. The capacity can be limited by either the appliance hardware or the license keys. The temporary license key allows for 5,000 events per second (EPS) on the QRadar Console, and 10,000 EPS on each managed host. The FPM rate for the temporary license is 200,000 on both the QRadar Console and the managed hosts.

When a license expires, QRadar continues to process events and flows up to the licensed capacity limits. If the EPS and FPM capacity of the expired license was allocated to a host, the shared license pool might go into a deficit, and cause QRadar to block capabilities on the Network Activity and Log Activity tabs.

When QRadar is not licensed to handle the volume of incoming network data, you can add a license that has more event or flow capacity.