Release of WinCollect stand-alone agent V10.1.14

About WinCollect V10.1.14

WinCollect 10.1.14 is available for stand-alone only deployments.

Important: Beginning in V10.1.4, WinCollect now uses a virtual account to increase application security. If you are upgrading from 10.1.3 or lower, refer to the 10.1.4 release notes for upgrade instructions.

• Fixed an issue where forwarded events can fail to send events to destinations during unexpected restarts. (Known Issue: DT421272)
• Fixed an issue where WinCollect Multiline File Forwarder pattern matching does not work as expected. (Known Issue: DT421270)
• Fixed an issue where the installer fails to uninstall in instances where then directory is moved/deleted/inaccessible resulting in a generic 1603 error. (Known Issue: DT424126)
• Fixed an issue where the agent can crash when a system has two target destinations and the secondary (fallback) destination of destination 2 is destination 1. (Known Issue: DT424128)
• Fixed an issue where the WinCollect service might go in restart loop without producing a minidump, when processing Windows events as XML, if a node exceeds 12,000 characters. (Known Issue: DT426020)
• Fixed an issue where Xpaths incorrectly converts reserved characters that are not part of the actual query, resulting in an XML error. (Known Issue: DT423713)
• Fixed an issue where the installer defaults to first connected drive in systems with non standard drive order resulting in 1603 error.
• Fixed an issue where the installation should not proceed when non elevated user launches the installer.
• Fixed a security vulnerability with the CSRF token.
• Updated OpenSSL third-party library to version 3.2.4.
• Updated Curl third-party library to version 8.12.1.
• Updated other third-party libraries used by the WinCollect console.

• Windows® Server 2022 (including Core)
• Windows® Server 2019 (including Core)
• Windows® Server 2016 (including Core)
• Windows® 10 (most recent)
• Windows® 11 (most recent)
   

IBM® Statement for WinCollect supported versions
Supported software versions for IBM® WinCollect are the latest version (n) and the latest minus one (n-1). Therefore, the two newest versions of WinCollect are the versions that QRadar® support suggests with any support tickets (cases) that are opened. To prevent issues, it is important that you, as an administrator, keep WinCollect deployments updated when new versions are posted to IBM® Fix Central. For questions related to this statement, ask in the WinCollect forum: http://ibm.biz/wincollectforums.
 

Prerequisites for the WinCollect V10.1.14 upgrade

Installation prerequisites

WinCollect 10.0.1 and WinCollect V7.3.0 or greater agents that are in stand-alone mode can be upgraded to WinCollect V10.1.14.

QRadar® version prerequisites
WinCollect V10.1.14 supports QRadar® V7.5.0 or later.

WinCollect version prerequisites

WinCollect V7.3.0 stand-alone is the minimum version required to upgrade to QRadar® V10.x (any patch level).

WinCollect upgrade procedure

For more information about installing or upgrading WinCollect 10, see IBM Documentation.

WinCollect Agent update links for 64-bit and 32-bit downloads:

• Download files for QRadar 7.5
  Full URL: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.5.0&platform=Linux&function=fixId&fixids=7.5.0-QRADAR-AGENT_x86_WINCOLLECT-10.1.14-2.msi,7.5.0-QRADAR-AGENT_x64_WINCOLLECT-10.1.14-2.msi&includeSupersedes=0&source=fc

For more information about stand-alone mode, see IBM Documentation.