Hello,

We're forwarding events from a windows machine to qradar through wincollect, the pulling interval is 3000ms and its taking almost 10min for events show up in Qradar console. Is there a way to improve this time?

Regards

You can change the time of the WinCollect poll from 3000ms down if necessary. The protocol section I think also has a pull down for the type of server, light, heavy, etc.

If you use Snare Agents, nx-log, syslog-ng to send it will be instantaneous.