close

keyboard_arrow_left

Table of Contents Expand all

play_arrow WinCollect 10 Overview
- play_arrow WinCollect 10 overview
  - What's new in WinCollect 10
  - Performance comparison between WinCollect versions
play_arrow Installing WinCollect 10
- play_arrow Installing WinCollect 10
play_arrow Uninstalling WinCollect 10
- play_arrow Uninstalling WinCollect 10
play_arrow WinCollect 10 Stand-alone Console
- play_arrow WinCollect 10 stand-alone console
  - play_arrow Opening the WinCollect 10 stand-alone console
    - Editing a source
    - Adding a destination
  - play_arrow WinCollect 10 stand-alone configuration
    - play_arrow Agent Core
      - Enabling statistics messages
    - play_arrow Credentials
      - Adding a user account
    - Configuring a local source
    - Configuring a remote source
    - play_arrow Destinations
  - play_arrow Agent settings
  - Service status
  - Log Viewer
  - Top Sources
  - Applying pending changes
  - play_arrow Create a source in the Source wizard
    - Creating a local source
    - Creating a remote source
play_arrow Configuration Scripts
- play_arrow Configuration scripts
  - Configuring WinCollect 10 to collect Microsoft security events
  - play_arrow Agent configuration update script use cases
play_arrow WinCollect Sources
- play_arrow WinCollect Sources
play_arrow Advanced Settings
- play_arrow Advanced settings
play_arrow The WinCollect 10 Statistics File
- The WinCollect 10 statistics file
play_arrow WinCollect Terminology
- WinCollect terminology

list Table of Contents

English

keyboard_arrow_right

EVTX Forwarder advanced settings

date_range 28-Jun-22

arrow_backward

arrow_forward

You can use the following advanced settings to fine tune EVTX Forwarder sources.

Parameter Default value Description

Identifier Override hostname/IP You can override the device identifier for this source.

Filename pattern *.evtx Only files that match this pattern are considered; this is an OS file filter.

Agent Device Type WindowsLog The AgentDevice field in the payload header.

Tuning Profile

Automatic Tuning
Low Event Rate
Medium Event Rate
High Event Rate
Max Event Rate
Manual Tuning

Automatic tuning	Determines how to poll for events automatically and adjusts itself over time
Low event rate	Less than 1 event per minute, poll every 10 minutes, 100 events at a time.
Medium event rate	Less than 10 events per second, poll every 30 seconds, 200 events at a time.
High event rate	Less than 500 events per second, poll every 3 seconds, 2000 events at a time.
Max event rate	More than 500 events per second, poll continuously, 5000 events at a time.
Manual Tuning	Manually set the polling interval, events per pass, and batch size.

Manual Tuning

Polling Interval

The length of time (milliseconds) between polls.

Events per pass

Maximum events to collect at each polling interval.

Events per batch

Number of events to fetch per call to the source.

Event Levels

Critical
Error
Warning
Information
Verbose
Always

Include Critical events (level 1)
Include Warning events (level 3)
Include Verbose events (level 5)
Include Error events (level 2)
Include Information events (level 4)
Include Always logged events (level 0)

Keywords

Audit Failure
Audit Success
Response Time
Classic

Include keyword 0x10 0000 0000 0000 only for security events
Include keyword 0x20 0000 0000 0000 only for security events
Include keyword 0x01 0000 0000 0000
Include keyword 0x80 0000 0000 0000 for events raised by using the RaiseEvent

Filter enabled Checkbox Turn the filter on or off.

Predefined Filters

No Description

Filter

An Event filter

SID Translation Enabled

Active Directory (AD) lookup Not enabled Turn the conversion of GUIDs into text on or off.

AD DNS domain name

AD domain controller name

Use Event Channel Not enabled Use the event's channel when available, and use Channel as the default.

arrow_backward PREVIOUS Microsoft Windows events advanced settings

NEXT arrow_forward Common file-based plugin advanced settings

Juniper Secure Analytics WinCollect 10 User Guide

EVTX Forwarder advanced settings

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry