IBM QRadar

 View Only

 Managed Host “Disable Encryption” options vs observed OpenSSH traffic (EC ↔ EP)

Usama Zaky's profile image
Usama Zaky posted 12/17/25 09:51 AM

Hello everyone,

We’re supporting a customer running IBM QRadar, and we’re looking for clarification on the behavior of the Managed Host encryption options.

Context

For a specific technical requirement, the customer attempted to disable the following options from the Managed Host settings:

  • Encrypted Tunnel (OpenSSH)
  • Encryption / Compression

Observed Behavior

Although the QRadar administrator confirmed that encryption was turned off, our packet capture analysis shows the following:

  • All traffic between Event Collector (EC) and Event Processor (EP) is still transmitted over SSH (TCP port 22), which indicates that the OpenSSH tunnel is still active.
  • We expected that disabling the encryption options would result in direct TCP communication over QRadar’s internal port ranges rather than SSH.
  • Even if QRadar applies encryption at the application or payload level, the transport layer should still appear as plain TCP.
    Seeing SSH at the transport level strongly suggests that the OpenSSH tunnel has not been disabled.

Questions

  1. Do the Managed Host encryption settings actually disable the OpenSSH tunnel, or do they only affect payload-level encryption/compression inside the SSH tunnel?
  2. Is there any supported method to force non-SSH TCP communication between EC and EP for controlled testing or inspection?
  3. If OpenSSH cannot be disabled by design, is this behavior expected and documented, and are there recommended alternatives for traffic visibility?

Perf1's profile image
Perf1 posted 12/18/25 09:18 AM

Disable encryption option is supposed to disable the encrypted ssh tunnel. Make sure config changes are deployed after the change. If the tunnel is not disabled then open a support ticket.

Vardaan Saproo's profile image
Vardaan Saproo posted 06/08/26 11:18 AM

Hi Usama, Greetings!


QRadar uses an SSH-based tunnel infrastructure for inter-host communications (Console ↔ Managed Hosts, EC ↔ EP, EP ↔ Data Nodes, etc). Many internal services communicate through QRadar-managed SSH tunnels regardless of whether payload encryption/compression options are enabled.

 The observed SSH traffic between the Event Collector and Event Processor is expected behavior. In QRadar, disabling the Managed Host encryption/compression options does not remove the underlying SSH-based communication framework used between managed hosts. These settings affect how data is handled within the communication channel rather than forcing direct unencrypted TCP communication. At present, QRadar does not provide a supported method to disable SSH transport between managed hosts or force plain TCP communications for ECS traffic.

Ref Link: https://www.ibm.com/docs/en/qradar-on-cloud?topic=hosts-encryption

Regards,

Related Content