Alerts are delayed in being ingested into the Carbon Black Cloud app in the QRadar console.
When using the Built-in data input method, delays between the incoming data intervals can signify memory overload on the container. A combination of high bursts of alerts for extended periods and low physical memory on the app container can cause a memory overload. The app's memory is limited to 10% of the system's physical memory, and this can cause delays in alert and general data processing. Consider using the Data Forwarder input.
