How do I download WinCollect?

Download the WinCollect Agent .exe file from the IBM® Support website (http://www.ibm.com/support). Right-click the WinCollect Agent .exe file and select Run as administrator….Select the tuning profile:

1. Default (Endpoint): 100/150.
2. Typical Server: 500/750.
3. High Event Rate Server: 1250/1875.

What is QRadar WinCollect?

WinCollect is a Syslog event forwarder that administrators can use to forward events from Windows logs to QRadar®. WinCollect can collect events from systems locally or be configured to remotely poll other Windows systems for events. WinCollect is one of many solutions for Windows event collection.

What is the latest version of WinCollect?

Prerequisites for the WinCollect V7. 3.1 p1 upgrade

Console’s WinCollect version	Upgrades to WinCollect V7.3.1 p1
WinCollect V7.2.2	No, requires the WinCollect 7.2.2-2 SFS file to be installed first.
WinCollect V7.2.2-1	No, requires the WinCollect 7.2.2-2 SFS file to be installed first.
WinCollect V7.2.2-2	Yes

How do I install managed WinCollect agent?

To use managed WinCollect, you must download and install a WinCollect Agent SF Bundle on your QRadar® console, create an authentication token, and then install a managed WinCollect agent on each Windows host that you want to collect events from.

How do I upgrade WinCollect agent?

1. Step 1: Verify QRadar Versions and Required Ports.
2. Step 2: Removing WinCollect Agents from the QRadar User Interface.
3. Step 3: Uninstalling the WinCollect Agent on the Windows host.
4. Step 4: Upgrading the QRadar Console to the latest WinCollect version.
5. Step 5: Installing the WinCollect Agent EXE on the Windows host.

What is WinCollect configuration console?

In stand-alone deployments, which are also called unmanaged deployments, use the WinCollect Configuration Console to manage your WinCollect deployment. Use the WinCollect Configuration Console to add devices that you want WinCollect to collect agents from, and add the JSA destination where you want to send events.

What is managed WinCollect?

A managed WinCollect deployment has a QRadar appliance that shares information with the WinCollect agent that is installed on the Windows hosts that you want to monitor. The Windows host can either gather information from itself, the local host, and, or remote Windows hosts.

How do I know if QRadar is installed?

To verify the installation:

1. Make sure that the “KL_Verification_Tool” log source is added to QRadar and routing rules are set in such a way that events from “KL_Verification_Tool” are sent to Feed Service.
2. Open QRadar Console and select the Log Activity tab.
3. Add a filter:

How do I integrate Windows Server with QRadar?

To enable communication between your Windows host and IBM QRadar over MSRPC, configure the Remote Procedure Calls (RPC) settings on the Windows host for the Microsoft Remote Procedure Calls (MSRPC) protocol. Use the MSRPC test tool to check the connection between the IBM QRadarappliance and a Windows host.

How do I connect to QRadar?

Go to Settings > Connections > QRadar Proxy, and select the deployment that you want to connect to. Specify the QRadar Management IP address or hostname and port for the data source or a supported QRadar app. Administrators: If you want to use the QRadar SIEM dashboards yourself, enter your QRadar authentication token.

How do I find QRadar version?

It is currently only possible to see the major version for all systems from the UI under Admin > System Configuration > System and License Management in the Version column. You can see the version, patch, and interim fix versions in the UI under Help > About.

How is QRadar licensed?

The Q1PD team can provide copies of QRadar licenses, generate licenses for new customers, issue Event per Second (EPS) or Flow per Minute (FPM) license increases, or provide activation keys for QRadar systems at version prior to 7.3. 0 to an end user or an IBM sales representative.

Is QRadar Community Edition free?

About QRadar Community Edition Community Edition is a fully-featured free version of QRadar that is low memory, low EPS, and includes a perpetual license. This version is limited to 50 events per second and 5,000 network flows a minute, supports apps, but is based on a smaller footprint for non-enterprise use.

What is QRadar App host?

An App Host is a managed host that is dedicated to running apps. App Hosts provide extra storage, memory, and CPU resources for your apps without impacting the processing capacity of your QRadar® Console.

How do I update my QRadar?

Click Help > About to check your current version of QRadar. To determine if you can upgrade to a version of QRadar, go to QRadar Software 101 (https:// www.ibm.com/community/qradar/home/software/) and check the release notes of the version you want to upgrade to.

How do I upgrade my QRadar DSM?

To configure QRadar for getting latest updates:

1. In QRadar Console, select Admin > Auto-Update.
2. On the Basic tab, in the Configuration Updates section, select Auto Integrate in the Update Type drop-down list.
3. In the DSM, Scanner, Protocol Updates section, select the Auto Install update type.
4. Click Save.

What version of QRadar does wincollect support?

WinCollect V7.3.1 p1 supports QRadar® V7.3.3 or later. WinCollect V7.2.5 is the minimum version required to upgrade to QRadar® V7.3.x (any patch level).

How do I install the wincollect SFS file on QRadar?

This SFS file is only installed on the QRadar Console. There is no need to install the WinCollect SFS on non-Console appliances. Copy the fix pack to the /tmp directory on the QRadar Console. If space in the /tmp directory is limited, copy the SFS to another location that has sufficient space, such as /root or /storetmp for QRadar 7.3.0 Consoles.

What are the supported software versions for IBM wincollect?

Administrators should be aware that supported software versions for IBM WinCollect is the Latest version (n) and latest minus one (n-1). This means that the two newest versions of WinCollect are the versions that QRadar Support will recommend with any support tickets (cases) that are opened.

What information do I need to configure QRadar to collect logs?

The IP address or host name of your QRadar Console, Event Collector, or Event processor. For example, 192.0.2.0 or myhost. If this check box is selected, you must provide information about the log source and the target destination. The name can be a maximum of 255 characters. Identifies the device that the WinCollect agent polls.