QRadar provides a unique approach to security analytics by chaining together related events to provide security teams with a single alert on each potential incident. This advanced correlation helps to reduce alert fatigue, streamline attack detection, and enable security analysts to respond to critical incidents faster. QRadar has free downloadable AWS content extensions that deliver catered security rules, reports, and reference sets to provide context and visibility into your AWS environment.

The QRadar Console Image in AWS enables you to easily deploy a QRadar Console to act as either an All in One appliance or a Console in a distributed deployment.
All in One Appliance - a stand-alone appliance capable of all QRadar functionality. This includes dashboards, receiving event and flow data, processing the data to create assets, offenses, reports, vulnerability data, and using apps from the IBM X-Force Exchange. The data on an All in One Console is stored locally.

Any All in One Console can become part of a distributed deployment simply by adding a managed host to it. This does not require a new license for the Console.