Managed WinCollect installations

To use managed WinCollect, you must download and install a WinCollect Agent SF Bundle on your QRadar® console, create an authentication token, and then install a managed WinCollect agent on each Windows host that you want to collect events from. You can also install the managed WinCollect agent on a Windows host that you want to use to remotely collect events from other Windows hosts.

Note: Stand-alone WinCollect, the type of deployment used by IBM® QRadar on Cloud, does not require you to download and install a WinCollect Agent SFS Bundle on your QRadar console, nor does it require you to create a WinCollect authentication token.

Important: WinCollect does not support cloning virtual machines (VMs) that have agents installed that are registered in QRadar.