Business scenarios for using Disconnected Log Collector

Disconnected Log Collector is suitable for a range of business scenarios:

Secured network zones

In high-security unidirectional networks (also known as data diodes), Disconnected Log Collector can use the connectionless UDP protocol to send events to QRadar®.

Managed security service providers (MSSPs)

Disconnected Log Collector can be installed on small to medium-sized customer sites and doesn’t rely on a virtual private network (VPN) to send events to the MSSP. Disconnected Log Collector simplifies administration because each instance clearly belongs to a particular customer domain.

Multi-location businesses

In large retailers and other multi-location businesses, each location typically generates only a few events per second that doesn’t justify the cost of a 15xx Event Collector appliance. Disconnected Log Collector can be installed on a cost-effective Linux® computer or virtual machine, where it can collect and send events to the central security infrastructure.

IBM® QRadar on Cloud deployments

For businesses that track only events (not flows or vulnerability scans), Disconnected Log Collector is a lightweight alternative to installing a Data Gateway managed host and doesn’t rely on a VPN to send events to QRadar on Cloud.