WinCollect installations

You install WinCollect agents in an environment that is managed by IBM® QRadar®, or as a stand-alone agent, or a combination of both.

Managed WinCollect installations
To use managed WinCollect, you must download and install a WinCollect Agent SF Bundle on your QRadar console, create an authentication token, and then install a managed WinCollect agent on each Windows host that you want to collect events from. You can also install the managed WinCollect agent on a Windows host that you want to use to remotely collect events from other Windows hosts.
Stand-alone WinCollect Installations
A stand-alone deployment is a Windows host in unmanaged mode with WinCollect software installed. The Windows host can either gather information from itself, the local host, and, or remote Windows hosts. Remote hosts don't have the WinCollect software installed. The Windows host with WinCollect software installed polls the remote hosts, and then sends event information to IBM QRadar.
Installing the WinCollect agent on a Windows host
Install the WinCollect agent on each Windows host that you want to use for local or remote collection in your network environment.
Installing a WinCollect agent from the command prompt
For unattended installations, you can install the WinCollect agent from the command prompt. Use the silent installation option to deploy WinCollect agents simultaneously to multiple remote systems.
Uninstalling a WinCollect agent from the command prompt
You can uninstall the WinCollect agent from the command prompt.
Uninstalling a WinCollect agent from the Control Panel
You can uninstall the WinCollect agent from the Microsoft Windows Control Panel.