Understanding WinCollect
The WinCollect agent can provide centralized log management, highly customized log collection, and security monitoring for all Windows machines. WinCollect can also help us to collect logs from machines by polling logs.
WinCollect can be installed on a Windows machine, and it can even remotely poll events from other Windows machines in a network. These polled events can then be sent to QRadar. Typically, on Windows machines, the types of logs present are application logs, security logs, system logs, custom logs, and so on. It completely depends on the role of the Windows machine. If it is configured as a web server, then there is another category of logs added, called Internet Information Service (IIS) logs. So, depending on the services configured and running on a Windows machine, different types of logs can be collected by the WinCollect agent. WinCollect has pre-configured settings to collect Windows data and forward it to QRadar.
The WinCollect agent...
