Architecture

The architecture consists of the IBM Security IBM Security QRadar® Suite Software, the Edge Gateway, container repositories, and connections to your data sources or security applications.

The Edge Gateway is available as a .run file or a virtual application (vApp) in Open Virtualization format (.ova file), which you install on a system in your environment. From one installation, you can create one or more Edge Gateway.

From the Settings > Edge Gateway page on IBM Security QRadar Suite Software, you add an Edge Gateway, and then select that Edge Gateway when configuring a data source located in your network or private cloud. Then, you add your data sources, which are located in your environment.

If you are using the Edge Gateway for IBM® Security QRadar SOAR apps, from the IBM Security QRadar SOAR application, you download and install one or more apps from the IBM Security App Exchange. Then configure and test the app and assign it to an Edge Gateway and the app is then available for use. By default, the Edge Gateway connects to the IBM official repository, quay.io, to access the app's executable. However, you can configure the Edge Gateway to use your own repository.

The Edge Gateway is located in your environment and must be able to access:
  • IBM Security QRadar Suite Software
  • The quay.io repository or your own repository
  • IBM Cloud Container Registry icr.io
  • The hosts of the third-party applications that are integrated with IBM Security QRadar SOAR
  • The hosts of the data sources.

You can have multiple Edge Gateways paired to a single IBM Security QRadar Suite Software account.