Requirements and network
Host size, Docker version, QRadar version, the authorized-service token, the LLM endpoint, the hostname, and the inbound and outbound ports to open before installing.
RST AI Copilot for QRadar ships as three Docker containers: the gateway, a Caddy reverse proxy that terminates TLS, and PostgreSQL for the account table. It does not include QRadar. It connects to your existing Console with one authorized-service token and reads events, flows, offenses, rules and log sources from there. The gateway keeps its own state in one SQLite file, copilot.db, on a Docker volume, and leaves nothing on the QRadar side.
The archive carries the images for all three containers, so installation needs no registry access.
Host
| Item | Requirement |
|---|---|
| OS | Ubuntu 20.04, 22.04, 24.04 or an equivalent Linux (Debian, RHEL family) |
| Size | At least 2 vCPU, 4 GB RAM and 20 GB disk. The gateway container is capped at 2 CPU and 2 GB by default, set by RST_GATEWAY_CPUS and RST_GATEWAY_MEM |
| Runtime | Docker Engine 24 or later, Docker Compose v2 |
| Privileges | An account that can run docker. The one-command install needs root |
QRadar
| Item | Requirement |
|---|---|
| Version | 7.5 or later, REST API 20.0 (the QRADAR_API_VERSION default). Verified on 7.6.0 FP1. 7.4 (API 16.0) has not been tested |
| Network | The gateway host reaches the Console on 443. The gateway talks to the Console only, never to an Event Processor |
| Certificate | The Console certificate is not verified by default. For a trusted certificate, set RST_QRADAR_VERIFY_CERTS=true; for a private CA, put the PEM file in ./certs/ and set RST_QRADAR_CA_CERT |
| Token | One authorized-service SEC token. See QRadar token permissions |
LLM
Any OpenAI-compatible endpoint: Volcengine Ark, DeepSeek, Qwen, Azure OpenAI, self-hosted vLLM or Ollama. Installation asks for the URL, API key and model name. Air-gapped sites use a local model with the air-gapped masking mode. You can add more providers in AI settings after installation.
On a reasoning model, triage, investigation and rule drafting take tens of seconds to minutes per call. The per-call timeout LLM_TIMEOUT_S defaults to 180 seconds; raise it for slow models.
Hostname
Set CADDY_SITE_ADDRESS to a hostname such as copilot.corp.local. An IP literal is not a valid TLS SNI, and some browsers refuse the handshake. Without internal DNS, add a hosts entry on the analysts' machines.
Ports
Inbound, to the gateway host:
| Port | From | Purpose |
|---|---|---|
| 443/TCP | Analyst network | https://<hostname>/v2/, the only entry point |
| 80/TCP | Analyst network | HTTP to HTTPS redirect, optional |
The gateway's port 8000 and the account database's port 5432 stay on the internal compose network and are not exposed.
Outbound, from the gateway host:
| Target | Port | Purpose | Required |
|---|---|---|---|
| QRadar Console | 443 | Ariel searches, offense sync, rule and log-source catalog, platform check-up | Yes |
| LLM endpoint | 443 | Inference | Yes. Internal for a local model |
license.reallysec.com | 443 | Activation, heartbeat | For commercial licenses activated online. Not needed by an unactivated Community install or an offline license |
github.com, release-assets.githubusercontent.com | 443 | Online update: a daily check for new versions and content packs, and the archive download. The release manifest and content packs are read from GitHub Releases | For online update, in every edition. Hosts activated offline do not connect |
| Feishu, DingTalk, WeCom, Teams, Slack, SMTP | 443, 465, 587 | Outbound channels | Optional |
| syslog receiver, which can be QRadar itself | 514, 6514 | Audit forwarding, Enterprise | Optional |