IBM QRadar

We want to add (40) Windows 10 machines.

Can you help us to know if our license can convert or the amount of EPS to add, the EPS licence limit is 1100 .

Hi,

Please follow the steps given in the link to know the EPS of your Windows server.

https://www.ibm.com/support/pages/qradar-how-measure-eps-rate-microsoft-windows-host

Once, you have the EPS from your 40 Windows machines, then you decide where to integrate them based on the EPS capacity and availability of Event Collector or Event Processor in your deployment.

Hope it helps.

HI,

For the onboarding 40 Windows 10 devices. first you need to select that what types of events are required. Like SYSTEM,APPLICATION,SECURITY. wherever as per my experience an AD WINDOWS server with Drirectory services it is taking ~12 EPS per average, now for Windows 10 it might not more the ~2 EPS on an Average.

depends on the Logging you are select.

Now if you still want to increase the EPS limit from 1100 EPS to e.g. 1000 EPS you need to contact IBM Sales Team.

For applying the additional License - https://www.ibm.com/docs/en/qsip/7.4?topic=migration-applying-allocating-qradar-siem-license-key

Hope it helps