Managed hosts
For greater flexibility over data collection and event and flow processing, build a distributed IBM® QRadar® deployment by adding non-console managed hosts, such as collectors, processors, and data nodes.
For more information about planning and building your QRadar environment, see the IBM QRadar Architecture and Deployment Guide.
Software compatibility requirements
Software versions for all QRadar appliances in your deployment must be at the same version and update package level. Deployments that use different versions of software are not supported because mixed software environments can prevent rules from firing, prevent offenses from being created or updated, or cause errors in search results.
When a managed host uses a software version that is different than the QRadar Console, you might be able to view components that were already assigned to the host, but you cannot configure the component or add or assign new components.
Internet Protocol (IP) requirements
The following table describes the various combinations of IP protocols that are supported when you add non-console managed hosts.
Managed hosts | QRadar Console (IPv6, single) | QRadar Console (IPv6, HA) | QRadar Console (dual-stack, single) | QRadar Console (dual-stack, HA) |
---|---|---|---|---|
IPv4, single | No | No | Yes* | No |
IPv4, HA | No | No | No | No |
IPv6, single | Yes | Yes | Yes | No |
IPv6, HA | Yes | Yes | Yes | No |
A dual-stack console supports both IPv4 and IPv6. The following list outlines the conditions you must follow in dual-stack environments:
- You can add IPv6 managed hosts to a dual-stack single console, or to an IPv6-only console.
- You can add only IPv4 managed hosts to a dual-stack single console.
- Do not add a managed host to a dual-stack console that is configured for HA.
- Do not add an IPv4 managed host that is not in an HA pair to an IPv6-only console, or to a dual-stack console that is in an HA pair.
- Adding a managed host to a dual-stack console that is configured for HA
- Adding an IPv4 managed host that is not in an HA pair to an IPv6-only console
- Adding an IPv4 managed host that is not in an HA pair to a dual-stack console that is in an HA pair