IBM QRadar

I have a requirment where I need to deploy the event collection solution but when I searched, I found two options 1) DLC and 2) EC.
Which one should I use and what difference these two have.

I am looking for the solution which can be deployed on the virtual server like vmware.

------------------------------
Akash Bhardwaj
------------------------------

Hello Akash,
you can deploy both component (DLC or EC) in a virtual infrastructure based on VMware.

The main differences is that the EC is a QRadar appliance and it is a managed host by the Console and you need a license for it, while the DLC is a software component that is installed in a Linux VM and must be managed manually locally. Other differences are related to the supported log sources (https://www.ibm.com/docs/en/qradar-common?topic=collector-overview-disconnected-log ). Last but not least the DLC can be used as "data diode" (rif https://www.ibm.com/docs/en/qradar-common?topic=collector-business-scenarios-using-disconnected-log ) in some high-security environment.

Hope this helps.

Best regards,

Mario

------------------------------
Mario Sebastiani
------------------------------

Original Message:
Sent: Wed July 07, 2021 01:58 AM
From: Akash Bhardwaj
Subject: Difference between Event Collector and Event Collector

I have a requirment where I need to deploy the event collection solution but when I searched, I found two options 1) DLC and 2) EC.
Which one should I use and what difference these two have.

I am looking for the solution which can be deployed on the virtual server like vmware.

------------------------------
Akash Bhardwaj
------------------------------