IBM QRadar

IBM QRadar

Join this online topic group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.


#Security
#QRadar
#SecuringhybridcloudandAI
 View Only

  • 1.  Rule for Microsoft events via Wincollect

    Posted 01/07/24 04:11 PM

    Hello, I have Wincollect agent sending me Microsoft events from Windows server to Qradar. It's sending following types of event, security, system, application. In case the Qradar stops receiving any single one of these windows log types, I would like to have rule which will create offense to let me know. Any idea how to do it? Thank you.



    ------------------------------
    tysa
    ------------------------------


  • 2.  RE: Rule for Microsoft events via Wincollect

    Posted 01/08/24 05:15 AM

    Hi

    there are two default rules regarding "Device Stopped Sending Events" alerting about this problem with timers for 30 minutes and 60 minutes which can be adjusted to your needs. Man dicusssions inside this forum about different aspects of this problem. Excellent answer by Jonathan on how to identify those devices automatically https://community.ibm.com/community/user/security/discussion/stopped-sending-events-not-working-correctly#bm3cb0d3ed-6b90-4f47-94c6-0185dfbb7fd1



    ------------------------------
    [Karl] [Jaeger] [Business Partner]
    [QRadar Specialist]
    [pro4bizz]
    [Karlsruhe] [Germany]
    [4972190981722]
    ------------------------------



  • 3.  RE: Rule for Microsoft events via Wincollect

    Posted 01/10/24 02:30 PM

    Hi Karl, thank you for your reply. I will look into it.

    Regards

    Tomas



    ------------------------------
    tysa
    ------------------------------

    Original Message