Configuring a remote source with an update script
You can use an update script to add a remote source group, add a single remote source device, or add multiple remote source devices.
Add a remote source group
You must use the Console UI to first set your credentials. This is the only way that you can create your password hash. For more information, see Adding a user account.
<?xml version="1.0" encoding="UTF-8"?>
<WinCollectScript version="10.0.1" >
<AddTo objPath="Destinations" >
<Destination Name="QRadarEP" Address="qradarep.yourdomain.lab" />
</AddTo>
<AddTo objPath="ROOT" >
<RemoteSources Name="Domain Workstations" />
</AddTo>
<AddTo objPath="RemoteSources(Name=Domain Workstations)" >
<Target Destination="QRadarEP" />
</AddTo>
<AddTo objPath="Security" >
<Credentials Name="wcservice" Domain="yourdomain.lab" Password="(ET1)bMfEpIr2JE20vlAqwDPatw==" UserID="wcservice" />
</AddTo>
<AddTo objPath="RemoteSources(Name=Domain Workstations)" >
<Device Address="ws01.yourdomain.lab" Credentials="wcservice" />
</AddTo>
<AddTo objPath="RemoteSources(Name=Domain Workstations)" >
<Source Channel="Application" Type="MSEVEN6" />
</AddTo>
<AddTo objPath="RemoteSources(Name=Domain Workstations)" >
<Source Channel="System" Type="MSEVEN6" />
</AddTo>
<AddTo objPath="RemoteSources(Name=Domain Workstations)" >
<Source Channel="Security" Type="MSEVEN6" />
</AddTo>
</WinCollectScript>Add a remote source device
This example update script adds a remote source device to collect events from, adds a workstation
that is named ws02.yourdomain.lab, and adds it to the same remote source group
as the previous script, , using the same Domain Workstations credentials,
wcservice.
<?xml version="1.0" encoding="UTF-8"?>
<WinCollectScript version="10.0.1" >
<AddTo objPath="RemoteSources(Name=Domain Workstations)" >
<Device Address="ws02.yourdomain.lab" Credentials="wcservice" />
</AddTo>
</WinCollectScript>The remote source group contains the values for the events to collect and the user account to use for the credentials.
Add multiple remote source devices
If you have several devices that you want to remotely poll to collect event from, you can add
Device Address lines to the previous script for each of the other devices you want
to collect events from.
<?xml version="1.0" encoding="UTF-8"?>
<WinCollectScript version="10.0.1" >
<AddTo objPath="RemoteSources(Name=Domain Workstations)" >
<Device Address="ws03.yourdomain.lab" Credentials="wcservice" />
<Device Address="ws04.yourdomain.lab" Credentials="wcservice" />
<Device Address="ws05.yourdomain.lab" Credentials="wcservice" />
<Device Address="ws06.yourdomain.lab" Credentials="wcservice" />
</AddTo>
</WinCollectScript>This script adds four new remote devices to collect events from.