In a standard setup, an Event Processor handles three main tasks: Receiving data from collectors. Running the Rules Engine to detect threats.
You can add multiple Data Nodes to a single Event or Flow Processor. This allows you to scale storage into the petabyte range without needing to purchase additional, more expensive processing licenses. qradar data node
When a new Data Node is joined to an existing processor, QRadar can automatically rebalance existing data across the new disks to ensure uniform performance. In a standard setup, an Event Processor handles
While Data Nodes are primarily for scaling, they help ensure that primary processors do not run out of disk space, which would otherwise cause the system to stop receiving new logs (dropping data). Key Benefits of Deployment In a standard setup