close
keyboard_arrow_left
Table of Contents
- play_arrow What's New in WinCollect
- play_arrow WinCollect Overview
- play_arrow Installation Prerequisites for WinCollect
- play_arrow WinCollect installations
- WinCollect installations
- Installing and Upgrading the WinCollect Application on JSA Appliances
- Creating an Authentication Token for WinCollect Agents
- Adding Multiple Destinations to WinCollect Agents
- Migrating WinCollect Agents After a JSA Hardware Upgrade
- Stand-alone WinCollect Installations
- WinCollect Configuration Console Overview
- Installing the Configuration Console
- Silently Installing, Upgrading, and Uninstalling WinCollect Software
- Setting an XPath Parameter During Automated Installation
- Migrating from Adaptive Log Exporter to WinCollect
- Installing the WinCollect Agent on a Windows Host
- Installing a WinCollect Agent from the Command Prompt
- Uninstalling a WinCollect Agent from the Command Prompt
- Uninstalling a WinCollect Agent from the Control Panel
- play_arrow Log Sources for WinCollect Agents
- Log Sources for WinCollect Agents
- Windows Event Logs
- Microsoft DHCP Log Source Configuration Options
- Microsoft Exchange Server Log Source Configuration Options
- DNS Debug Log Source Configuration Options
- Collecting DNS Analytic Logs by Using XPath
- File Forwarder Log Source Configuration Options
- Microsoft IAS Log Source Configuration Options
- WinCollect Microsoft IIS Log Source Configuration Options
- Microsoft ISA Log Configuration Options
- Juniper Steel-Belted Radius Log Source Configuration Options
- Microsoft SQL Server Log Source Configuration Options
- NetApp Data ONTAP Configuration Options
- Configuring a TLS Log Source
- Adding a Log Source to a WinCollect Agent
- Bulk Log Sources for Remote Event Collection
- play_arrow Troubleshooting WinCollect Deployment Issues
- Troubleshooting WinCollect Deployment Issues
- Common Problems
- Replacing the Default Certificate in JSA Generates Invalid PEM Errors
- The Statistics Subsystem
- Event ID 1003 Splits the Message in JSA
- WinCollect Files are Not Restored During a Configuration Restore
- Windows 10 (1803) Cannot Read the Security Bookmark File
- Resolving Log Source Error After WinCollect Update
- WinCollect Log File
list Table of Contents
Sending Encrypted Events to JSA
date_range
27-Mar-21
In JSA, configure a Universal DSM that uses the TLS Syslog protocol. For more information, see the Configuring DSMs Guide.
The uDSM opens a port and provides the certificate that is necessary for communicating by using TLS. If you delete the uDSM, TLS communication stops.
Configure a log source in stand-alone deployments of WinCollect to send encrypted events to JSA with TLS syslog. TLS Syslog is only supported in managed WinCollect deployments in JSA 7.3.1 and later.
- Use SSH to log in to JSA as the root user.
- Copy the certificate, including
-----BEGIN CERTIFICATE-----and-----END CERTIFICATE-----from /opt/qradar/conf/trusted_certificates/syslog-tls.cert to a temporary location. You will paste this certificate into the WinCollect Configuration Console. - In the WinCollect Configuration Console, expand Destinations, and click Add Destination.
- In the New Destination Name box, add a name for the destination and then click OK.
- Select the new destination and enter the IP address of the target JSA appliance in the Hostname field.
- Type 6514 in the Port field.
- Type the events per second (EPS) rate for your deployment in the Throttle field.
- Paste the certificate that you copied from JSA into the Certificate field.
- Click Deploy Changes under Actions.
