IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only
  • 1.  Distributed mode - Component with a bit confusing

    Posted 09/06/19 05:17 AM
    I know that there're three component which is console, proccessor and collector. I will deploy console and proccessor at HQ and collector at branches for receiving log. All component is virtual appliance.

    My question is 
    Is there any cost for collector at branch?
    Where's location for install license? Is it Console?
    Do you have a number of EPS limit on each components?

    ------------------------------
    MAC Strater
    ------------------------------


  • 2.  RE: Distributed mode - Component with a bit confusing

    Posted 09/09/19 03:28 AM
    If the Event Collector is going to be installed on a virtual machine or own server, then there is IBM QRadar Software Node Install License that applies per instance of installed QRadar image (it is basically there to cover support for (re)used OS software code).
    There is a free option, though, that might be acceptable - DLC (Disconnected Log Collector); have a look at IBM Knowledge Center - DLC
    Licensing is always deployed and allocated using your console instance. Collectors do not have EPS/FPM license applied (this is reserved for Processor instances), but should be sized accordingly - e.g. have a look at QRadar memory requirements

    ------------------------------
    Dusan VIDOVIC
    ------------------------------