Configuring an off-site source

To forward event and flow data to an Event Collector in another deployment, configure the target deployment to include an off-site source so that it knows which computer is sending the data.

About this task

To prevent connection errors, when you configure off-site source and target components, deploy the IBM QRadar Console with the off-site source first. Then, deploy the QRadar Console with the off-site target.

Procedure

  1. On the navigation menu ( Navigation menu icon ), click Admin.
  2. In the System Configuration section, click System and License Management.
  3. In the Display list, select Systems.
  4. On the Deployment Actions menu, click Manage Off-site Sources.
  5. Click Add and configure the parameters.

    The name can be up to 20 characters in length and can include underscores or hyphens.

    In the IP field, enter the IP address of the QRadar Console of the deployment that you want to receive events and flows from.

  6. Click Save.
  7. Click Manage Connections to specify which QRadar hosts you want to receive the data.

    The host must have an Event Collector to receive the data.

  8. Repeat the steps to configure all off-site sources that you want to configure.
  9. Deploy the changes and restart the event collection service.