IBM QRadar SIEM empowers security analysts and security operations teams with the visibility, automation and insights needed to quickly detect anomalies and uncover advanced threats in real-time.
The QRadar Managed Host Image in AWS enables you to easily deploy a new QRadar managed host, to extend your QRadar systems and gain deeper visibility into AWS. Currently, there are seven supported nodes:
Flow Collector - collects network flows from devices on your network including network taps, span ports, NetFlow and QRadar flow logs
Event Collector - collects event data from sources in AWS and securely transfers data to a QRadar Console on-premises or in the cloud, for threat detection and analysis
Data Node - add-on appliance to event and flow processors to increase storage capacity and improve search performance
Event Processor - processes events that are collected from one or more Event Collector components
Flow Processor - processes flows from one or more Flow Collector appliances
Event/Flow Processor - a single appliance that enables security event and flow data to be collected, processed and stored in a QRadar deployment in AWS