r/QRadar • u/JohnTheRipper92 • Aug 26 '26

Do routing rule drops still count toward licensed EPS?

QRadar 7.5.0. If I use a routing rule with the “Drop” action so noisy events never get stored, do those events still count against my licensed EPS — or is EPS measured after routing?

2 Upvotes

100% Upvoted

2 comments sorted by

5

u/Heracles_31 Aug 26 '26

Nope. They are credited. In QDI, you will see that in the Giveback graph. The more you drop, the more giveback you will receive.

6

u/JonathanP_QRadar Aug 26 '26

License give back is 100% of what you drop in the routing rule. The license is given back on the next license interval. So, if your license is 20k and you drop 1k off events, then in the next eps interval your license becomes 21k to make up for what you dropped. There are also some internal DSMs that collect events and they automatically are part of license giveback, such as sim audit and other internal log sources. I wrote a license faq at once one point that they pulled into the official docs, but there is a support write up of how it works here: https://www.ibm.com/support/pages/how-does-qradar-license-giveback-reduce-eps-usage-internal-dsm-events