by Overview When you install the WinCollect Agent you can configure the Agent to collect windows event logs. This can be configured using the gui install...
Continue reading WinCollect – Setting QRadar Destination during Agent Installation
WinCollect 7.2.8 allows you to add Xpath to your cmd line installer for “Stand-Alone” installs only. The first thing you need to do is convert...
Continue reading WinCollect 7.2.8 – Stand-Alone cmd line with Xpath option
WinCollect 7.2.8 allows you to add NSA filtering to your cmd line installer for “Stand-Alone” installs only. You will need 3 parameters per channel you...
Continue reading WinCollect 7.2.8 – Stand-Alone cmd line with NSA Filter Option
Overview Stand-Alone WinCollect 7.2.8 allows you to make changes to the Agent configuration (agentconfig.xml) using “Templates”. Templates essentially allow you to make changes to the...
Continue reading WinCollect 7.2.8 – Stand-Alone change configuration with Templates
Overview This blog is going to show you how to deploy an additional “plugin-in/service” in stand-alone mode without the need to install the patch installer...
Continue reading WinCollect 7.2.8 – Stand-Alone – Add devices without patch installer
Overview The latest release of the QRadar Log Source Management App now provides the functionality to bulk change 1 to many WinCollect log sources. You...
Continue reading Bulk Change WinCollect Log Sources using QRadar Log Source Management App
Overview In WinCollect 7.2.8 we added the ability to set just about any parameter in the cmd line install. In Prior releases only the parameters...
Continue reading WinCollect 7.2.8 – Cmd Line parameters – setting any parameter
Overview To collect DNS Analytic logs using WinCollect perform the following steps: Configure Windows to collect analytic logs Add Xpath to the Agent log source...
Continue reading WinCollect – Collecting DNS Server Analytic Logs
WinCollect 101
by on QRadar Support – WinCollect 101 Administrators can use WinCollect to capture Windows-based events for QRadar SIEM administrators. Use our 101 page to find information, ask...