IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  CP4S Licensing for Qradar

    Posted 06/15/23 04:06 AM
    Edited by İsmail Kaya 06/15/23 04:07 AM
    Hi all,
     
    I am a bit confused about CP4S licensing for Qradar. As you know, Qradar can be licensed as EPS or CP4S. At this point CP4S calculate server counts but it doesn't count Firewall as a source. Which sources are counting at this licensing model? Wincollect agent log sources(not collected server), client PCs (endpoints), network devices such as access point, switches.... Is there a calculator for a method to estimate license estimation?
     
    If someone clarify that I will be appreciate.
    Thanks,



    ------------------------------
    İsmail Kaya
    ------------------------------



  • 2.  RE: CP4S Licensing for Qradar

    Posted 06/15/23 12:55 PM

    Ismail

    very good question indeed. Yes there is a tool but no it isn't working, from our experience.

    so the only way to go is to contact your technical IBM sales person for help with your customer site.

    Regards

    Karl



    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------



  • 3.  RE: CP4S Licensing for Qradar

    Posted 06/16/23 11:30 AM

    The part you mentioned about counting the servers is true. All servers (physical or virtual, no matter what is the underlying infrastructure or OS), as well as Kubernetes nodes should be accounted for; switches, firewalls, client machines ... as I am aware are NOT counted. This sum is then mapped to some value units with ratios set based on the software this license model is going to be applied to. The intention is to make this something like a fair-use licensing model.  Number of log sources is not a topic for this.

    As Karl mentioned, you should reach out to  your IBM representative for an accurate calculation. This will give you an answer if (in your particular case) this is a more price-effective option vs the EPS/FPM metric or not.



    ------------------------------
    Dusan VIDOVIC
    ------------------------------



Related Content