IBM Support

QRadar: How to verify which WinCollect agent has no associated log sources

How To


Summary

How do I verify which WinCollect agents are missing associated log sources?

Example Use Case:
A company has more than1500 WinCollect agents deployed and new ones are added every day and old ones removed timely, but a SIEM administrator wants to confirm that all WinCollect agents have associated log sources.

Document Location

Worldwide

[{"Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"ARM Category":[{"code":"a8m0z000000cwtwAAA","label":"WinCollect"}],"ARM Case Number":"TS003862080","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Version(s)"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
01 April 2022

UID

ibm16253267