Business scenarios for using Disconnected Log Collector
Disconnected Log Collector is suitable for a range of business scenarios:
- Secured network zones
- In high-security unidirectional networks (also known as data diodes), Disconnected Log Collector can use the connectionless UDP protocol to send events to QRadar®.
- Managed security service providers (MSSPs)
- Disconnected Log Collector can be installed on small to medium-sized customer sites and doesn’t rely on a virtual private network (VPN) to send events to the MSSP. Disconnected Log Collector simplifies administration because each instance clearly belongs to a particular customer domain.
- Multi-location businesses
- In large retailers and other multi-location businesses, each location typically generates only a few events per second that doesn’t justify the cost of a 15xx Event Collector appliance. Disconnected Log Collector can be installed on a cost-effective Linux® computer or virtual machine, where it can collect and send events to the central security infrastructure.
- IBM® QRadar on Cloud deployments
- For businesses that track only events (not flows or vulnerability scans), Disconnected Log Collector is a lightweight alternative to installing a Data Gateway managed host and doesn’t rely on a VPN to send events to QRadar on Cloud.