WinCollect 7

Administrators can use WinCollect to capture Windows-based events for QRadar SIEM administrators.

Expert Blogs

Watch the Latest WinCollect Open Mic

During this session we talk WinCollect overall, tools, notifications, troubleshooting tips, and round table your questions as they come in from the live audience for the webcast. The panelists for this session include the QRadar Development and Support teams.

Still Experiencing an Issue?

To receive help on a WinCollect issue, ensure that you include the following information:


Collect logs from your WinCollect agent experiencing an issue.


Collect logs from your QRadar Console.


Open a case with QRadar Support.


Describe your issue and any troubleshooting steps you attempted.


If possible, describe any recent administrator actions, such as a configuration restore or upgrade.


Ensure that your case includes contact information, such as your email or phone number.

IBM prides itself on delivering world class software support with highly skilled, customer-focused people. QRadar Support is available 24×7 for all high severity issues. For QRadar resources, technical help, guidance, and information, see our QRadar Support 101 pages.

Contact Support

Find your regional support contact