Configure Juniper Networks Steel-Belted Radius to forward Windows events to QRadar

You can forward Windows events to IBM® QRadar® by using WinCollect.

To forward Windows events by using WinCollect, install WinCollect agent on a Windows host. Download the WinCollect agent setup file from the IBM Support website ( Add a Juniper Steel-Belted Radius log source and assign it to the WinCollect agent.

The following table describes the parameters that require specific values for the WinCollect log source parameters.
Table 1. Juniper Steel-Belted Radius WinCollect Juniper SBR log source parameters
Parameter Value
Log Source type Juniper Steel-Belted Radius
Protocol Configuration WinCollect Juniper SBR
Log Source Identifier The IP address or host name of the Windows device from which you want to collect Windows events. The log source identifier must be unique for the log source type.
Local System

Select the Local System check box to disable the remote collection of events for the log source. The log source uses local system credentials to collect and forward logs to QRadar.

You need to configure the Domain, Username, and Password parameters if remote collection is required.

Polling Interval The interval, in milliseconds, between times when WinCollect polls for new events.
Enable Active Directory Lookups Do not select the check box.
WinCollectAgent Select your WinCollect agent from the list.
Target Internal Destination Use any managed host with an event processor component as an internal destination.

For more information about WinCollect log source parameters, see the Common WinCollect log source parameters documentation (