Configuring TLS over TCP communication with QRadar

When IBM® Disconnected Log Collector uses TLS over TCP, it buffers incoming events during times when it’s disconnected from IBM QRadar® and sends them when the connection is restored.

Buffer capacity can be configured, and is limited by the available disk space.

You must add the public IP address of the Disconnected Log Collector to the allowlist so that the Disconnected Log Collector can communicate with the QRadar on Cloud appliance.