Ensure
that the instance that you plan to install can support the flow inspection level that you want to
achieve.
Install the QRadar
components by using the IBM
QRadar SIEM image on Microsoft Azure Marketplace.
You must install a QRadar
Console and a QRadar Network Insights managed host. Other managed
hosts, such as flow processors, are optional. For information about how to install QRadar components on Microsoft Azure, see Configuring a Console on Microsoft
Azure.
The following image shows the traffic flow in a deployment that includes two QRadar Network Insights mirror targets. One QRadar Network Insights instance is used as a flow
source for a Flow
Processor, while the
other instance sends network traffic directly to the QRadar
Console.
Figure 1. Example of a QRadar Network Insights deployment