IBM QRadar WinCollect

7.3

WinCollect User Guide V7.3.1

IBM



Note

Before you use this information and the product that it supports, read the information in “Notices” on

page 99.

What's new in WinCollect............................................................................................................................ 4

MSEVEN6 protocol....................................................................................................................................... 5

Communication between WinCollect agents and QRadar.......................................................................... 8

Enabling remote log management on Windows....................................................................................9

Hardware and software requirements for the WinCollect host................................................................10

Prerequisites for upgrading WinCollect agents in a managed deployment............................................. 12

Stand-alone WinCollect Installations....................................................................................................... 19

WinCollect Conguration Console overview........................................................................................20

Installing the conguration console.................................................................................................... 21

Silently installing, upgrading, and uninstalling WinCollect software..................................................21

Setting an XPath parameter during automated installation................................................................22

Installing the WinCollect agent on a Windows host................................................................................. 23

Installing a WinCollect agent from the command prompt....................................................................... 27

Uninstalling a WinCollect agent from the command prompt................................................................... 32

Uninstalling a WinCollect agent from the Control Panel...........................................................................33

Conguring stand-alone WinCollect agents with the Conguration Console.......................................... 41

Creating a WinCollect credential..........................................................................................................41

Adding a destination to the WinCollect Conguration Console.......................................................... 41

Conguring a destination with TLS in the WinCollect Conguration Console.................................... 42

Adding a device to the WinCollect Conguration Console.................................................................. 42

Sending encrypted events to QRadar.................................................................................................. 43

Increasing UDP payload size................................................................................................................43

Include milliseconds in Event Log timestamp.....................................................................................44

Collecting local Windows logs..............................................................................................................44

Collecting remote Windows logs..........................................................................................................44

Windows event subscriptions for WinCollect agents.......................................................................... 53

Windows event logs................................................................................................................................... 57

Windows event log ltering..................................................................................................................57

Windows log source parameters......................................................................................................... 58

Applications and Services logs............................................................................................................ 64

Microsoft DHCP log source........................................................................................................................ 67

Microsoft Exchange Server log source...................................................................................................... 68

DNS debug conguration...........................................................................................................................69

Enabling DNS debugging on Windows Server..................................................................................... 70

Microsoft SQL log source........................................................................................................................... 79

NetApp Data ONTAP log source................................................................................................................ 81

Conguring a TLS log source..................................................................................................................... 82

Creating a TLS log source destination for managed agents................................................................86

Adding a log source to a WinCollect agent................................................................................................87

Bulk log sources for remote event collection............................................................................................87

Adding log sources in bulk for remote collection................................................................................ 88

Common problems.................................................................................................................................... 91

Replacing the default certicate in QRadar generates invalid PEM errors.........................................92

InfoX debug logs.................................................................................................................................. 96

WinCollect not supported by Data Synchronization app.......................................................................... 97

Trademarks.............................................................................................................................................. 100

About this WinCollect User Guide

This documentation provides you with information that you need to install and congure WinCollect

agents, and retrieve events from Windows-based event sources. WinCollect is supported by IBM

QRadar

access the IBM Knowledge Center

(http://www.ibm.com/support/knowledgecenter/SS42VS/welcome).

For information about how to access more technical documentation in the QRadar products library, see

QRadar Support – Assistance 101 (https://ibm.biz/qradarsupport).

For information about contacting customer support, see QRadar Support – Assistance 101 (https://

ibm.biz/qradarsupport).

IT system security involves protecting systems and information through prevention, detection and

response to improper access from within and outside your enterprise. Improper access can result in

THAT ANY SYSTEMS, PRODUCTS OR SERVICES ARE IMMUNE FROM, OR WILL MAKE YOUR ENTERPRISE

IMMUNE FROM, THE MALICIOUS OR ILLEGAL CONDUCT OF ANY PARTY.

©

WinCollect is a Syslog event forwarder that administrators can use to forward events from Windows logs

to QRadar. WinCollect can collect events from systems locally or be congured to remotely poll other

Windows systems for events.

WinCollect is one of many solutions for Windows event collection. For more information about alternatives

to WinCollect, see the IBM Security QRadar DSM Conguration Guide.

agent that is installed on the Windows hosts that you want to monitor. The Windows host can either

gather information from itself, the local host, and, or remote Windows hosts. Remote hosts don't have

the WinCollect software installed. The Windows host with WinCollect software installed polls the remote

hosts, and then sends event information to QRadar.

All WinCollect agents communicate with the QRadar Console and Event Collectors to forward events to

QRadar and request updated information. Managed WinCollect agents also request and receive updated

code and conguration changes. You must ensure rewalls that are between the QRadar Event Collectors

and your WinCollect agents allow trafc on the following ports:

Port 8413

This port is used for managing the WinCollect agents to request and receive code and conguration

updates. Trafc is always initiated from the WinCollect agent, and is sent over TCP. Communication is

encrypted by using the QRadar Console's public key and the ConfigurationServer.PEM le on the

agent.

Create a bidirectional rule to allow communication from the WinCollect agent to QRadar on port 8413.

agent.

WinCollect agents that remotely poll other Windows operating systems require extra ports to be open.

These ports need to be open on the WinCollect agent computer and the computer(s) that are remotely

polled, but not on your QRadar appliances. The following table describes the ports that are used.

Table 2. Port usage for WinCollect remote polling

Port Protocol Usage

135 TCP Microsoft Endpoint Mapper

137 UDP NetBIOS name service

Table 4. Comparison of tested WinCollect environments (local polling) (continued)

Prole Type OS RAM Cores Avg EPS RAM used Avg CPU

Medium

VM Windows

250 endpoints or less: 293 MB

500 endpoints or less: 609 MB

Processor Intel Core i3 or equivalent

Available processor resources Approximately 20%, depending on CPU, EPS, and

number of endpoints polled.

Disk space

100 MB for software, plus up to 100 MB for les.

Up to 6 GB might be needed if you store events to

disk.

Note: WinCollect CPU and memory loads depend on several factors, including the number of events per

Device

Count

Table 7. Comparison of tested WinCollect environments (remote polling) (continued)

Prole Type OS RAM Cores Endpoints

polled

Device

count

High

Device

count

Windows Server 2016 (including Core)

Windows 10

Distribution One WinCollect agent for each Windows host.

Required user role permissions for installation

Administrator, or local administrator

Administrative permissions are not needed for

remote collection.

Important:

WinCollect is not supported on versions of Windows that are designated end-of-life by

Microsoft. After the software is beyond the Extended Support End Date, the product might still

Prerequisites for upgrading WinCollect agents in a managed

deployment

Before you upgrade WinCollect agents, ensure that your software meets the version requirements.

The version of the installed WinCollect depends on the version of QRadar that you are running.

Table 9. Software version matrix

QRadar Version Minimum WinCollect Version RPM Minimum Version

QRadar V7.3.x WinCollect 7.2.5 AGENT-

QRadar V7.5.x WinCollect 7.2.5 AGENT-

WINCOLLECT-7.3-20161123160

813.noarch

You install WinCollect agents in an environment that is managed by IBM QRadar, or as a stand-alone

agent, or a combination of both.

Managed WinCollect installations

To use managed WinCollect, you must download and install a WinCollect Agent SF Bundle on your QRadar

console, create an authentication token, and then install a managed WinCollect agent on each Windows

host that you want to collect events from. You can also install the managed WinCollect agent on a

Windows host that you want to use to remotely collect events from other Windows hosts.

Note: Stand-alone WinCollect, the type of deployment used by IBM QRadar on Cloud, does not require

you to download and install a WinCollect Agent SFS Bundle on your QRadar console, nor does it require

you to create a WinCollect authentication token.

Important: WinCollect does not support cloning virtual machines (VMs) that have agents installed that

be upgraded to newer versions of WinCollect by installing the newer version of SFS Bundle on the QRadar

console.

Important:

• For information about upgrading WinCollect versions v7.0 through v7.2.2, see www.ibm.com/support

(http://www-01.ibm.com/support/docview.wss?uid=swg21698127).

• If WinCollect v7.2.6 or newer is installed on the QRadar Console, and then you upgrade QRadar

from v7.2.8 to v7.3.0 or newer, the version of WinCollect on QRadar reverts to v7.2.5. The managed

WinCollect agents that are running on your Windows hosts remain at their current version and continue

to send events to QRadar using their existing conguration information. However, they no longer receive

updates, and restarts required services. No events are lost when you update your WinCollect agent

because events are buffered to disk. Event collection forwarding continues when the WinCollect service

on the Windows host restarts.

Important: If you reinstall QRadar on your Console, you must delete this le on any existing WinCollect

agent installations before WinCollect can function properly: Program Files/IBM/WinCollect/

config/ConfigurationServer.PEM

1. Download the WinCollect Agent SFS Bundle installation le from the IBM website:

(http://

5. To change to the /storetmp directory, type the following command: cd /storetmp

6. To mount the SFS le, type the following command: mount -t squashfs -o loop

<Installer_file_name.sfs> /media/updates

Example: mount -t squashfs -o loop

730_QRadar_wincollectupdate-7.3.0-24.sfs /media/updates

7. To run the WinCollect installer, type the following command and then follow the prompts: /media/

updates/installer

Note: To proceed with the WinCollect Agent update you must restart services on QRadar to apply

protocol updates. The following message is displayed:

services are restarted, and the user interface is available.

Note: During installation, the following message is displayed:

• In the QRadar admin settings, click Advanced > Deploy Full Conguration.

• In the QRadar admin settings, click Advanced > Restart Event Collection Services.

10. To unmount the SFS le from the Console, type the following command: umount /media/updates

11. Verify that WinCollect agents are congured to accept remote updates:

a) Log in to QRadar.

b) On the navigation menu, click Data Sources.

c) Click the WinCollect icon.

Managed WinCollect agents with automatic updates enabled are updated and restarted. The amount of

6. Click Create Service.

Table 12. WinCollect Managed agent setup type installation wizard parameters

Parameter Description

Table 12. WinCollect Managed agent setup type installation wizard parameters (continued)

Parameter Description

Event Rate Tuning Prole Select the tuning prole:

• High Event Rate Server: 1250/1875

send status messages to any QRadar Console or

Table 13. WinCollect stand-alone setup type installation wizard parameters (continued)

Parameter Description

Destination Name Identies where WinCollect events are sent.

Hostname / IP The host name or IP address for the destination.

Event Rate Tuning Prole Select the tuning prole:

• High Event Rate Server: 1250/1875

For more information, see

IBM Support (http://www-01.ibm.com/support/

docview.wss?uid=swg21672193).

Default Status Server Address The IP address Destination where status

deployment. Set the value to Disabled to send

only a heartbeat without status messages. Set

the value to None if you don't want to send a

heartbeat or status messages.

For QRadar on Cloud deployments, use the Data

Heartbeat Interval (msecs) The frequency that heartbeat status messages

are sent. In WinCollect 7.2.8, it is displayed in

milliseconds. In WinCollect 7.2.9 and later, it is

displayed in minutes.

Table 13. WinCollect stand-alone setup type installation wizard parameters (continued)

Parameter Description

Log Monitor Socket Type Protocol to be used to send heartbeat and status

Installing a WinCollect agent from the command prompt

For unattended installations, you can install the WinCollect agent from the command prompt. Use the

silent installation option to deploy WinCollect agents simultaneously to multiple remote systems.

The WinCollect installer uses the following command options:

Table 14. Silent installation options for WinCollect agents

Option Valid entries and description

/qn Runs the WinCollect agent installation in silent

mode.

INSTALLDIR The installation location for WinCollect.

QRadar to authorize the managed agent.

Example:

AUTH_TOKEN=af111ff6-4f30-11eb-11fb-1f

c1 17711111

FULLCONSOLEADDRESS=host_address

The IP address, host name, or FQDN of the

QRadar Console, Event processor, or Event

Collector that manages the agent.

Examples:

• FULLCONSOLEADDRESS=192.0.2.0

Table 14. Silent installation options for WinCollect agents (continued)

Option Valid entries and description

HOSTNAME=host name

HOSTNAME=%COMPUTERNAME%

The IP address or host name of the WinCollect

agent host cannot contain the "at" sign, @.

STATUSSERVER An alternative destination to send WinCollect

send status messages to any QRadar Console or

any Event Processor or Event Collector in your

deployment. Set the value to Disabled to send

only a heartbeat without status messages. Set

the value to None if you don't want to send a

heartbeat or status messages.

Ensure that each parameter uses the format:

Parameter_Name=value.

The parameters are separated with ampersands,

&.

Your QRadar system must be updated to V7.2.1

Patch 1 or later.

LOG_MONITOR_SOCKET_TYPE=TCP This parameter sets the protocol that is used by

heartbeat and status messages to be sent by

Note: This option is only available in stand-alone

WinCollect deployments. Availability for managed

Table 14. Silent installation options for WinCollect agents (continued)

Option Valid entries and description

Component1.Destination.Name The destination name is an alphanumeric value

a QRadar appliance capable of receiving event

data, such as an Event Processor, Event Collector,

or QRadar Console.

Important: In managed deployments, the

destination must be an "internal destination," and

the name must exist in the QRadar user interface

before the installation. Otherwise, the log source

conguration parameters are discarded and no

log sources are automatically created.

Internal Destination

Managed hosts with an event processor

Component1.Dest.Hostname

The IP address or host name where you send

WinCollect events.

Component1.Dest.Port

The port that WinCollect uses when it

communicates with the destination.

Component1.Dest.Protocol

(Stand alone deployments only)

TCP or UDP

Component1.Dest.MaxPayloadSize

Maximum payload size sent to the destination

(Default values are 1020 UDP and 32000 TCP).

Component1.Log.Security Required, True or False

The Windows Security log contains events that

The Windows System logs can contain

information about device changes, device drivers,

system changes, events, and operations provided

The Windows Application logs contain events that

are triggered by software applications instead

of the operating system. The logs can contain

errors, information, and warning events.

Table 14. Silent installation options for WinCollect agents (continued)

Option Valid entries and description

Component1.Log.DNS+Server Required, True or False

The Windows File Replication Service log

Component1.Log.Directory+Service Required, True or False

The Windows Directory Service log contains

events that are written by the active directory.

Component1.RemoteMachinePollInterval The polling interval that determines the number

host.

The minimum polling interval is 300 milliseconds.

The default is 3000 milliseconds or 3 seconds.

Component1.EventRateTuningProfile

(Managed deployments only)

Select one of the following tuning proles:

• Default+(Endpoint)

• Typical+Server

docview.wss?uid=swg21672193).

Component1.MaxLogsToProcessPerPass

Not required.

Important: Use this parameter to

improve performance for event collection,

however, this parameter can also increase

processor usage. For more information, see

IBM Support (http://www-01.ibm.com/support/

docview.wss?uid=swg21672193).

Table 14. Silent installation options for WinCollect agents (continued)

Option Valid entries and description

Component1.MinLogsToProcessPerPass

Not required.

Example:

Important: You can use this parameter to

Adding a destination

To assign where WinCollect agents in your deployment forward their events, you can create destinations

for your WinCollect deployment.

Adding a secondary destination

You can add a secondary destination to receive events from your WinCollect agents if the primary

destination fails.

Deleting a destination from WinCollect

You can choose a custom identier as the source for the events. All events collected by the Agent are

grouped together with this identier.

Transport Layer Security (TLS) certicate.

1. Under Devices, right-click the device type that matches the device you want to add and select Add

4. In the New Destination Name box, add a name for the destination and then click OK.

5. Select the new destination and enter the IP address of the target QRadar appliance in the Hostname

6. Type 6514 in the Port eld.

7. Type the events per second (EPS) rate for your deployment in the Throttle eld.

8. Paste the certicate that you copied from QRadar into the Certicate eld.

9. Click Deploy Changes under Actions.

You can increase the payload size for UDP syslog destinations in the Agent Conguration le.

2. Add the following parameter to the UDPSendStage module:

In a stand-alone WinCollect deployment, you can include milliseconds in the timestamp for Event Logs.

Note: This option is only compatible in a stand-alone WinCollect deployment that uses the MSEVEN6

protocol. It is not supported by the MSEVEN protocol

The TimeGenerated and TimeWritten payload elds in the Event Logs use seconds by default. You can

set the Timestamp Properties to use milliseconds in the Microsoft Windows Event Log Properties node

of the WinCollect Conguration Console.

Important: This is an Agent-level change that is set for all log sources.

Alternatively, you can change the property as part of the command line installation, using this

parameter: &Component1.TimestampFormat=Milliseconds. You can also use a template to change

1. Install the WinCollect Conguration Console on the host on which that you want to collect windows

2. Create a destination for the QRadar instance where you want to send WinCollect information. See

3. Congure the local Microsoft event log device that is monitored. See “Adding a device to the

4. Click Deploy Changes under Actions.

This use case scenario describes the settings that are required in the WinCollect Conguration Console to

(www.ibm.com/support/xcentral).

2. Create a credential to use when you log in to remote hosts. See “Creating a WinCollect credential” on

3. Create the QRadar destination where Windows events are sent. See “Adding a destination to the

With templating, you can change the Agent conguration without making manual or scripted edits to the

AgentConfig.xml le.

When you copy a template to the WinCollect patch directory, the Agent replaces the existing conguration

with the contents of the template. Before the Agent applies the changes from the template, it makes a

• tmplt_DeviceWindowsLog.xml

• tmplt_PayloadRouter.xml

Note: These templates are examples only. All Agent conguration service modules are supported, so that

you can create your own templates.

The following use cases are examples of how you can use templates to change Agent congurations.

You want to change the heartbeat interval from 5 minutes to 1 hour on all deployed systems. Previously,

this required manual or scripted changes to the agentconfig.xml le and a WinCollect service restart.

With templates, you can change this interval by performing the following steps.

4. Move the service_AgentCore.xml le to the \IBM\WinCollect\patch directory.

Note: %ALLUSERSPROFILE% is an environment variable. The default value is C:\ProgramData. You

want to change this value to C:\WinCollect\Data.

2. Move the le to the \IBM\WinCollect\patch directory.

You want to send Syslog data to QRadar over TCP rather than UDP. You must specify this option in the

Destination Manager.

1. Locate the tmplt_DestinationManager.xml template in the \IBM \WinCollect\templates

Conguration options for systems with restricted policies for

domain controller credentials

Users with appropriate remote access permissions might be able to collect events from remote systems

without using domain administrator credentials. Depending on what information you collect, the user

might need extra permissions. For example, a user might need to collect Security event logs remotely.

Therefore, the user that is congured in the QRadar log source must have remote access to the Security

event log from the server where the Agent is installed.

Restriction:

congurations might not be possible.

Remote collection inside or across a Windows domain might require domain administrator credentials to

ensure that events can be collected. If your corporate policies restrict the use of domain administrator

credentials, you might need to complete more conguration steps for your WinCollect deployment.

The following permissions and credentials are required for service accounts to access remote polling log

sources that WinCollect supports.

Permissions

Log Sources

The service account needs to be able to access the

folder that the log le is in and open the le.

A WinCollect agent can collect and forward events from the local system, or remotely poll a number of

Windows-based log sources and operating systems for their events.

If the log sources contain similar congurations, you can simultaneously add multiple, or bulk add log

sources. A change to an individually added log source updates only the individual log source. A change

• German

• Italian

• Japanese

• Korean

• Portuguese

• Russian

• Spanish

You can congure the WinCollect agent to ignore or to include specic events collected from the Windows

event log. You can limit the total EPS (events per second) that are sent to the QRadar Console by using the

• Security

• System

• Application

• DNS Server

• File Replication Service

specied in the Polling Interval eld expires.

For the exclusion lter, the agent examines all of the events retrieved from the Event Collection API and

ignores events that match the exclusions dened by the administrator (either by Windows Event ID or by

the events to either the QRadar Console or the Event Collector appliance. However, for the inclusion lter,

the agents pulls events that matches the Event IDs specied by the administrator and forward those

which the agent pulls from the Security, System, Application and DNS logs. These pre-dened security

Tip: The Forwarded Events lter requires you to identify the source or channel, with the eventIDs that you

wish to lter in parentheses. Use semicolons as delimiters. For example:

In this example, event IDs from 200 to 256, 4097 and 34 are ltered for the channel Application, event ID

Log Source Identier

The IP address or hostname of a remote Windows

operating system from which you want to collect

Windows-based events. The log source identier

must be unique for the log source type.

Used to poll events from remote sources.

Local System

Disables remote collection of events for the log

source.

The log source uses local system credentials to

Optional

The domain that includes the Windows-based log

source.

The following examples use the correct syntax:

LAB1, server1.mydomain.com The following

syntax is incorrect: \\mydomain.com

Table 19. Common WinCollect log source parameters (continued)

Parameter Description

Event Rate Tuning Prole For the default polling interval of 3000 ms,

• Typical Server: 166-250 EPS

• High Event Rate Server: 416-625 EPS

For a polling interval of 1000 ms the approximate

• Default (Endpoint): 100-150 EPS

• Typical Server: 500-750 EPS

WinCollect polls for new events.

log source for another product.

Event Log Poll Protocol The protocol that QRadar uses to communicate

Table 19. Common WinCollect log source parameters (continued)

Parameter Description

Log Filter Type

You can also congure WinCollect agents to ignore

events globally by ID code or log source.

are excluded, source and ID exclusions use the

Source= eld and the EventIDCode= eld of the

Windows event payload. Separate multiple sources

by using a semi-colon.

Example: Exclusion lters can use commas and

hyphens to lter single EventIDs or ranges, such as

4609, 4616, 6400-6405.

forward security logs to QRadar.

Security Log Filter Type

To ignore specic events ID collected from the

Windows event log, select Exclusion Filter.