WinCollect overview

How does WinCollect Work?

WinCollect uses the Windows Event Log API to gather events, and then WinCollect sends the events to QRadar.

WinCollect managed deployment

In a managed deployment, WinCollect is designed to work with up to 500 Windows agents per Console and managed host. For example, if you have a deployment with a Console, an Event Processor, and an Event Collector, each can support up to 500 Windows agents, for a total of 1,500. If you want to monitor more than 500 Windows agents per Console or managed host, use the stand-alone WinCollect deployment.

For more information, see Stand-alone WinCollect Installations.

The managed WinCollect deployment has the following capabilities:

• Central management from the QRadar Console or managed host.
• Automatic local log source creation at the time of installation.
• Event storage to ensure that no events are dropped.
• Collects forwarded events from Microsoft Subscriptions.
• Filters events by using XPath queries or exclusion filters.
• Supports virtual machine installations.
• Console can send software updates to remote WinCollect agents without you reinstalling agents in your network.
• Forwards events on a set schedule (Store and Forward)

WinCollect stand-alone deployment

If you need to collect Windows events from more than 500 agents, use the stand-alone WinCollect deployment. A stand-alone deployment is a Windows host in unmanaged mode with WinCollect software installed. The Windows host can either gather information from itself, the local host, and, or remote Windows hosts. Remote hosts don't have the WinCollect software installed. The Windows host with WinCollect software installed polls the remote hosts, and then sends event information to QRadar. To save time when you configure more than 500 Windows agents, you can use a solution such as IBM Endpoint Manager. Automation can help you manage stand-alone instances.

You can also deploy stand-alone WinCollect to consolidate event data on one Windows host, where WinCollect collects events to send to QRadar.

Stand-alone WinCollect mode has the following capabilities:

• You can configure each WinCollect agent by using the WinCollect Configuration Console.
• You can update WinCollect software with the software update installer.
• Event storage to ensure that no events are dropped.
• Collects forwarded events from Microsoft Subscriptions.
• Filters events by using XPath queries or exclusion filters.
• Supports virtual machine installations.
• Send events to QRadar using TLS Syslog.
• Automatically create a local log source at the time of agent installation.

Capabilities of managed and stand-alone WinCollect deployments

Review the following table to understand which capabilities are available when using managed or stand-alone WinCollect agents.

Setting up a managed WinCollect deployment

For a managed deployment, follow these steps:

1. Understand the prerequisites for managed WinCollect, which ports to use, what hardware is required, how to upgrade. For more information, see Installation prerequisites for WinCollect.
2. Install the WinCollect application on the QRadar console. For more information, see Installing and upgrading the WinCollect application on QRadar appliances.
3. Create an authentication token so that the managed WinCollect agents can exchange data with QRadar appliances. For more information, see Creating an authentication token for WinCollect agents.
4. Configure a forwarding destination host for the log source data. For more information, see Adding a destination.
5. Install managed WinCollect agents on the Windows hosts. For more information, see one of the following options:
   • Installing the WinCollect agent on a Windows host
   • Installing a WinCollect agent from the command prompt, or
   • Manually adding a WinCollect agent
6. If you want to configure forwarded events or event subscriptions, see Windows event subscriptions for WinCollect agents.
7. If you want to use the legacy Log Source UI to bulk add log sources that will be remotely polled by a single WinCollect agent, see Bulk log sources for remote event collection.
8. Tune your WinCollect log sources. For more information, see the Event Rate Tuning Profile parameter in Windows log source parameters.
9. If you want a managed WinCollect agent to send events to multiple QRadar destinations in case one fails, see Adding multiple destinations to WinCollect agents.

Setting up a stand-alone WinCollect deployment

For a stand-alone deployment, follow these steps:

1. Understand the prerequisites for stand-alone WinCollect, which ports to use, what hardware is required, how to upgrade. For more information, see Installation prerequisites for WinCollect.
2. Install stand-alone WinCollect agents on the Windows hosts. For more information, see Installing the WinCollect agent on a Windows host.
3. If you want to add new log sources to your agent or modify existing log sources, install the WinCollect stand-alone configuration console. For more information, see Installing the configuration console or Silently installing, upgrading, and uninstalling WinCollect software.
4. Configure the destination where the Windows hosts send Windows events. For more information, see Adding a destination to the WinCollect Configuration Console.
5. If you want to use the stand-alone WinCollect agent to collect events from other devices using remote polling, create a credential in the WinCollect stand-alone configuration console, so that WinCollect can log in to the remote devices. For more information, see Creating a WinCollect credential.
6. If you want to add additional log sources to the stand-alone WinCollect agent, do so using the WinCollect stand-alone configuration console. For more information, see Adding a device to the WinCollect Configuration Console.