System management

IBM QRadar has a modular architecture that supports deployments of varying sizes and topologies.

In a single-host deployment, all the software components run on a single appliance, and the QRadar Console provides the user interface, the real-time event and flow views, reports, offenses, asset information, and administrative functions.

To scale QRadar, you can add non-console managed hosts to the deployment. You can configure a specific component type, such as collectors, processors, and data nodes, for each managed host, providing greater flexibility to manage data collection and processing in a distributed environment.