Configuring WinCollect 10 to collect Microsoft security events

date_range 28-Jun-22

arrow_backward

arrow_forward

If you use the Installing WinCollect 10 using the Advanced installer option to install your agent, you can run an update script to configure the agent.

Download or copy the wincollect-10.0.x.x64.exe file to your computer.
Copy the update script code that is displayed in this topic and paste it into a text editor.
Replace the value for the Address parameter ("YourStatusServerIP") with the IP address of an appliance in your JSA deployment.
Replace the Destination Address parameter ("YourQRadarApplianceIP") with the IP address of an appliance in your JSA deployment.

Note:
If you are using an All-In-One appliance, the Destination Address can be the same IP address as the Address parameter.
Save the file as update_localmsevents.xml.
Run the wincollect-10.0.x.x64.exe installer as an admin user.
On the Welcome to the WinCollect 10 Setup Wizard window, click Next and accept the terms in the license agreement.
Enter your Company Information, then click Next.
On the Custom Setup window, specify an alternative path to install and choose any additional components you need to install.
Click Next.
On the Configuration Options window, select Specify a configuration script file to execute immediately after the Agent is installed.
Click Browse to locate your update_localmsevents.xml file and click Next.

Tip:
The Ready to Install window displays the command that you can use to apply the same configuration on another agent.
Click Install to finish the installation.
If you are prompted to allow the app to install from an unknown publisher, click Yes.

On the Completing the WinCollect 10 Setup Wizard page, click Finish.

Copy the following code and save the file as update_localmsevents.xml:

content_copy zoom_out_map
<?xml version="1.0" encoding="UTF-8"?>
<WinCollectScript version="10.0.1" >
<Update objPath="AgentCore/StatusServer" >
<Parameter name="Address" value="YourStatusServer" />
<Parameter name="Enabled" value="true" />
</Update>
<Update objPath="Destinations" >
<Destination Name="QRadar" Address="YourDestinationServer" Enabled="true" />
</Update>
<Update objPath="ROOT" >
<LocalSources Name="Local" Type="MSEVEN6" Enabled="true">
<Source Channel="Application" />
<Source Channel="System" />
<Source Channel="Security" />
<Target Destination="QRadar" />
</LocalSources>
</Update>
</WinCollectScript>

arrow_backward PREVIOUS Configuration scripts

NEXT arrow_forward Agent configuration update script use cases

Juniper Secure Analytics WinCollect 10 User Guide

Configuring WinCollect 10 to collect Microsoft security events

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry