The LS component that handles reports, queries, and alerts, is the

NAS is the network-attached storage tier that holds log data on disk and has no role in report generation, query execution, or alert processing.

The D-SRV (Database Server) indexes and stores normalized event data but offloads analytical workloads such as reporting and alerting to the A-SRV.

The A-SRV is the analytical processing layer of the LS architecture, responsible for executing report jobs, processing ad-hoc queries against stored log data, and evaluating alert rules - functions that require dedicated compute separate from collection and storage roles.

The Local Collector is responsible for receiving, normalizing, and forwarding raw log data to the LS and does not perform any analytical or alerting functions.