Which item is an internal flow source?

Question

Options

• AIPFIX
• BNetflow
• CJFLOW/SFLOW
• DQRadar Flow Collector

• A
  4% (1)
• B
  8% (2)
• C
  17% (4)
• D
  71% (17)

Explanation

QRadar Flow Collector (D) is an internal flow source because it is a native component within the QRadar architecture itself - it captures and processes flow data directly on QRadar appliances or virtual instances without relying on external protocols. Options A, B, and C - IPFIX, NetFlow, and JFlow/sFlow - are all external flow sources: they are industry-standard protocols used by third-party network devices (routers, switches, etc.) that export flow records to QRadar, meaning the data originates outside the QRadar system. The distinction is not about the protocol format, but about where the flow generation happens - internally within QRadar's own components versus externally from network infrastructure devices.

Memory tip: Think "internal = inside the QRadar box." If it has "QRadar" in the name (QRadar Flow Collector, QRadar Network Insights), it's internal. If it's a vendor-neutral acronym or protocol (NetFlow, IPFIX, sFlow), it's external - data flowing into QRadar from the outside.

No community discussion yet for this question.