Licensing

Before the 7.3 version of QRadar, there were two types of licenses – one for appliance activation and one for the capacity of the appliance in terms of EPS or FPM. For QRadar version 7.4 and above, the only type of license that exists is for the capacity. All the licenses are added to the console, and it creates a license pool. From the license pool, a QRadar administrator can distribute the license capacity to processors.

Note that licenses are applied to processors and not to collectors. This is because even though data is collected by a collector, it is processed and stored by a processor. If you have a license of 30,000 EPS and the number of EPS received on the collector is more than 30,000, events can be buffered, parsed, and then sent to the processor where they are stored. There is a limit to the number of events that can be buffered. If the number of EPS is consistently more than the license threshold, the administrator will see a License Threshold warning...