Distributed deployment

In all-in-one deployment, the heavy lifting work in terms of data processing and storage was done by the Console. Once processors are added, we add more processing power and more storage. This helps the Console to free up resources for other important tasks.

In huge customer deployments where terabytes of data are processed daily, using all-in-one deployment will not suffice. We need more processors to correlate data and store it. Each processor comes with individual storage capacity. For example, for one of the biggest deployments of QRadar, which processes around 2 TB of data on a daily basis, we have 3 Event Processors. These Event Processors are in high availability, which means that for each primary Event Processor, we have a corresponding secondary Event Processor present. Each of these three processors shares the load of correlating the incoming events to that particular processor. So, on average, each event’s average size could be around 500...