In the IBM QRadar architecture, the Event Processor is the core component responsible for processing, correlating, and storing event data. The event data is written to the Ariel database, which resides on the Event Processor appliance. To scale storage capacity and improve search performance, Data Nodes can be attached to an Event Processor. When a Data Node is connected, the event data is distributed and stored across both the Event Processor and the attached Data Node(s), effectively expanding the storage pool for that processor.

A. Event Collectors are responsible for gathering and parsing logs, then forwarding the normalized data to an Event Processor. They do not perform long-term storage in the Ariel database.

B. Data Gateways are primarily used for data collection from various sources, similar to Event Collectors, and do not host the Ariel database for event storage.

D. App Hosts are dedicated managed hosts for running QRadar applications. They are isolated from the core data collection, processing, and storage pipeline and do not store event data.

1. IBM QRadar SIEM Administration Guide (Version 7.5.0): In the section "QRadar components," the role of the Event Processor is defined: "The Event Processor processes events... The event data is stored on the Event Processor." The guide further explains Data Nodes: "When data is written, it is automatically distributed among the Event or Flow Processor and any attached Data Nodes." This directly supports that data is stored on the Event Processor and its attached Data Node.

Source: IBM Documentation, "QRadar components," IBM QRadar SIEM Administration Guide, Version 7.5.0.

2. IBM Security QRadar SIEM Architecture Document: This document outlines the roles of different appliances. It states, "The Event Processor is responsible for processing events and storing them to disk." Regarding Data Nodes, it clarifies, "A Data Node is a managed host that is dedicated to storing event and flow data. Data Nodes are attached to an Event Processor or Flow Processor to increase the data storage capacity of the processor."

Source: IBM Security QRadar SIEM Architecture, Fourth Edition (October 2016), Page 10 ("Event Processor") and Page 12 ("Data Node").

3. IBM QRadar Data Sheet: The official data sheet describes the function of Data Nodes as a way to "add storage and processing capacity on demand" to Event and Flow Processors, confirming their role as a storage extension for the processor.

Source: IBM Security QRadar SIEM Data Sheet, Document Number: TSD03388-USEN-04, Page 3 ("Scale storage and processing with data nodes").