IBM QRadar

Hi Konstantinos,

yes this does make sense a lot cause entering better secured servers via stealing workstation credentials via phishing is one of the top gates for breaking in to your company IT infrastructure . QRadar is offering a free agent software which that can be installed using different options. The most effective is using remote log collection from a central windows server who can take control of hundreds of windows workstations. The agent software is completely managed from Qradar . Other options are existing as well. Please start here for details https://www.ibm.com/docs/en/qsip/7.4?topic=agents-windows-event-logs

Regards

Karl

Hi Karl, 

Thank you for the answer!! Much appreciated. 

As I understand the Wincollect is a dedicated PC/Server that collects the logs and sends them to Qradar. 

Is there an agent for the end-user PC to install and send the logs directly to Qradar?

And another option is XPath queries, but that is more System oriented. 

Could the end-user PC be configured to send to Qradar using Syslog?

Thanks and regards, 

Konstantinos

Hi Konstantinos,

WinCollect itself is an agent that you can download from IBM Fix Central or directly from here:

https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.5.0&platform=Linux&function=textSearch&text=wincollect#WINCOLLECT

After downloading, you can install on Windows Server or PC to collect the Local Win Logs of that Server or PC

Another way is to use it to do remote collection of Win Logs from other Servers or PCs

You can choose between the Standalone flavour (Wincollect v7 or v10) or the Managed flavour (Wincollect v7 only)

Both support XPath to send advanced logs like Sysmon

BR,

Hatem Metwally

Hi Hatem, 

Thank you for the answer!! Much appreciated. 

So apart from Wincollect what other options are there for enduser windows machines to send logs to Qradar?

Regards, 

Konstantinos

Please review the documentation at https://www.ibm.com/docs/en/dsm?topic=microsoft-windows-security-event-log - The questions you are asking are answered right there.

Paul