I have two IBM QRadar SIEM systems in different group companies. I want the IBM QRadar SIEM at the head office to be able to view and monitor the IBM QRadar SIEM at the other location, including dashboards and generated detections. Is it possible to achieve this without forwarding logs? This is because there is a request not to impact the existing EPS (Events Per Second) license. I have looked into the Qradar Offenses Forwarder (https://www.ibm.com/docs/en/uax?topic=overview-setting-up-qradar-offenses-forwarder), but it appears to be for Qradar Suites SaaS-based systems, and I am using an on-premise setup.
------------------------------
Naufal Arkaan
------------------------------