Requirements and network
Check before installing: host size, Docker version, QRadar and API version, the authorized-service token, the LLM endpoint, the hostname, and the inbound / outbound ports to open.
Form factor
QRadar AI Copilot ships as Docker only: one gateway container + Caddy reverse proxy (TLS) + Postgres (multi-user accounts). It does not ship QRadar: it connects to the existing Console with an authorized-service token and reads events, flows, offenses, rules and log sources from there. Its own state is one SQLite file, copilot.db, on a Docker volume; nothing is left on the QRadar side.
Host
| Item | Requirement |
|---|---|
| OS | Ubuntu 20.04 / 22.04 / 24.04 or equivalent Linux (Debian, RHEL family) |
| Size | 2 vCPU / 4 GB RAM / 20 GB disk and up; the gateway container is capped at 2 CPU / 2 GB by default (RST_GATEWAY_CPUS / RST_GATEWAY_MEM) |
| Runtime | Docker Engine 24+, Docker Compose v2 (docker compose version works) |
| Privileges | An account that can run docker; deploy.sh works as a normal user in the docker group or via sudo |
QRadar
| Item | Requirement |
|---|---|
| Version | 7.5.x, REST API Version: 20.0 (default QRADAR_API_VERSION). 7.4 would be 16.0, untested |
| Network | Gateway host reaches the Console on 443; Consoles usually run a self-signed certificate, so verification is off by default; for a trusted certificate set RST_QRADAR_VERIFY_CERTS=true, for a private CA put the PEM in ./certs/ and set RST_QRADAR_CA_CERT |
| Token | One authorized-service SEC token (Admin → Authorized Services); rights in QRadar token permissions |
| Deployment | Single Console or distributed; the gateway talks to the Console only, never to an Event Processor |
LLM
Any OpenAI-compatible endpoint: Volcengine Ark, DeepSeek, Qwen, Azure OpenAI, self-hosted vLLM / Ollama. Needs URL, API key and model name. Offline sites use a local model with the "air-gapped" masking mode. More providers can be added later for failover in AI settings.
Triage, investigation and rule drafting on a reasoning model take tens of seconds to minutes per call; the provider timeout_s defaults to 180 and needs raising for slow models.
Hostname
CADDY_SITE_ADDRESS must be a domain name (e.g. copilot.corp.local), not a bare IP: an IP literal is not a valid TLS SNI and some browsers refuse the handshake. Without internal DNS, add a hosts entry on the analysts' machines.
Ports
Inbound (to the gateway host):
| Port | From | Purpose |
|---|---|---|
| 443 / TCP | Analyst network | https://<hostname>/v2/, the only entry point |
| 80 / TCP | Analyst network | HTTP → HTTPS redirect (optional) |
Gateway 8000 and userdb 5432 are not exposed; they stay on the compose network. On cloud hosts, open 443 in the security group.
Outbound (the gateway host must reach):
| Target | Port | Purpose | Required |
|---|---|---|---|
| QRadar Console | 443 | Ariel searches / offense polling / rule and log-source catalogue / checks | Yes |
| LLM endpoint | 443 | Inference | Yes (internal for a local model) |
license.reallysec.com | 443 | Activation + heartbeat + online update | Online licences; not for offline licences |
| Feishu / DingTalk / WeCom / Teams / Slack / SMTP | 443 / 465 / 587 | Outbound channels | Optional |
| syslog collector (can be QRadar itself) | 514 / 6514 | Audit forwarding | Optional |
Quick start
The shortest path from the delivery archive to a working login: one Linux host, Docker, your existing QRadar Console and an authorized-service token, one run of deploy.sh.
Installing from the archive
What is in the delivery archive, what each step of deploy.sh does, how to answer each prompt, how to install by hand, and the post-install checklist.