Managed hosts

For greater flexibility over data collection and event and flow processing, build a distributed IBM® QRadar® deployment by adding non-console managed hosts, such as collectors, processors, and data nodes.

For more information about planning and building your QRadar environment, see the IBM QRadar Architecture and Deployment Guide.

Software compatibility requirements

Software versions for all QRadar appliances in your deployment must be at the same version and update package level. Deployments that use different versions of software are not supported because mixed software environments can prevent rules from firing, prevent offenses from being created or updated, or cause errors in search results.

When a managed host uses a software version that is different than the QRadar Console, you might be able to view components that were already assigned to the host, but you cannot configure the component or add or assign new components.

Internet Protocol (IP) requirements

The following table describes the various combinations of IP protocols that are supported when you add non-console managed hosts.

Table 1. Supported combinations of IP protocols on non-console managed hosts
Managed hosts QRadar Console (IPv6, single) QRadar Console (IPv6, HA) QRadar Console (dual-stack, single) QRadar Console (dual-stack, HA)
IPv4, single No No Yes* No
IPv4, HA No No No No
IPv6, single Yes Yes Yes No
IPv6, HA Yes Yes Yes No
Restriction: *By default, you cannot add an IPv4-only managed host to a dual-stack single console. You must run a script to enable an IPv4-only managed host. For more information, see Adding an IPv4-only managed host in a dual-stack environment.

A dual-stack console supports both IPv4 and IPv6. The following list outlines the conditions you must follow in dual-stack environments:

  • You can add IPv6 managed hosts to a dual-stack single console, or to an IPv6-only console.
  • You can add only IPv4 managed hosts to a dual-stack single console.
  • Do not add a managed host to a dual-stack console that is configured for HA.
  • Do not add an IPv4 managed host that is not in an HA pair to an IPv6-only console, or to a dual-stack console that is in an HA pair.
Important: IBM does not support the following configurations:
  • Adding a managed host to a dual-stack console that is configured for HA
  • Adding an IPv4 managed host that is not in an HA pair to an IPv6-only console
  • Adding an IPv4 managed host that is not in an HA pair to a dual-stack console that is in an HA pair