Installing Win Collect MANAGED on QRadar Community Edition QRadar Commmunity Edition has already the Microsoft Windows DSM installed, so sylog imports should already work for unmanaged agents. To setup WinCollect 7.2.8 P2 you will need to have QR_CE 7.3.1 iso at hand and the downloaded WinCollect sfs file plus the WinCollect Agent for Windows. * QRadarCE7_3_1.GA.iso * 730_QRadar_wincollectupdate-728.145.P2.sfs * wincollect-7.2.8-145.x64.exe or * wincollect-7.2.8-145.x86.exe * Make sure the following directories exist: mkdir /media/cdrom mkdir /media/updates mount -o loop /root/qradarce7_3_1.ga.iso /media/cdrom mount /root/730_qradar_wincollectupdate-728.145.p2.sfs /media/updates * As the Community Edition does not support patch updates or installs, you will need to install the packages manually: cd /media/updates/repo First do: rpm -iv AGENT-WINCOLLECT-7.3-20181212142622.noarch.rpm Then do: rpm -iv PROTOCOL-WinCollectConfigServer-7.3-20181212142622.noarch.rpm rpm -iv PROTOCOL-WinCollectWindowsEventLog-7.3-20181212142622.noarch.rpm The other packages are optional: PROTOCOL-WinCollectFileForwarder-7.3-20181212142622.noarch.rpm PROTOCOL-WinCollectJuniperSBR-7.3-20181212142622.noarch.rpm PROTOCOL-WinCollectMicrosoftDHCP-7.3-20181212142622.noarch.rpm PROTOCOL-WinCollectMicrosoftDNS-7.3-20181212142622.noarch.rpm PROTOCOL-WinCollectMicrosoftExchange-7.3-20181212142622.noarch.rpm PROTOCOL-WinCollectMicrosoftIAS-7.3-20181212142622.noarch.rpm PROTOCOL-WinCollectMicrosoftIIS-7.3-20181212142622.noarch.rpm PROTOCOL-WinCollectMicrosoftISA-7.3-20181212142622.noarch.rpm PROTOCOL-WinCollectMicrosoftSQL-7.3-20181212142622.noarch.rpm PROTOCOL-WinCollectNetAppDataONTAP-7.3-20181212142622.noarch.rpm cd /media/cdrom/post/dsmrpms rpm -iv DSM-WinCollect-7.3-20160908133313.noarch.rpm rpm -iv DSM-MicrosoftWindows-7.3-20170803132814.noarch.rpm * Run a full deploy and restart hostcontext and tomcat services From the QR Admin Tab run a Deploy Full Configuration service hostcontext restart service tomcat restart
* Now install WinCollect as described in the documentation: - Create an Authorized Service Token, save the token to a text file - Define a WinCollect Destination - Click on WinCollect --> Destination --> Add, Note the exact name - Install the Wincollect Agent on your Windowes host: Enter the Token and for the Configuration server name enter the IP, Enter the Wincollect destination name as noted and enable LogSource creation. The Agent will be discovered. You must make sure that the Local Service is able to read event logs and the remote registry. Otherwise it is highjly recommended to create a functional user (eg. WinCollct) which has the privileges to read Windws Event Logs and the Remote Registry! After the LogSouce is auto created a deploy changes is required. And if you need help to install QR CE on CabntoS 7.5 the following gives some hints: Installation of QRadar CE 7.3.1 on CentOS 7.5 For QRadar CE 7.3.1 the version of CentOS is required. In the repositories there are newer packages than the QR CE edition requires. Installation steps: * Get CentOS 7.5 (version 7.5.1804 recommended) * install minimal system, define Network with internet access, your localisation and keyborad and root password and create a personal user to login. * Disable SELINUX and maybe also ipv6 in /etc/selinux/conf set SELINUX=disabled You might also want to disable IP v6 in /etc/sysctl.conf set net.ipv6.conf.all.disable_ipv6 = 1 * Set the yum repositories to version CentOS 7.5.1804 In the files under /etc/yum.repos.d disable all entries: Set all the following entries in each and every file to ( Alternatively you might delete all files or move them out of this directory. ) Create a file, it it not aready exists: /etc/yum.repos.d/centos-vault.repo
with the following contents: # CentOS Vault contains rpms from older releases in the CentOS-7 # tree. # C7.5.1804 [C7.5.1804-base] name=centos-7.5.1804 - Base baseurl=http://vault.centos.org/7.5.1804/os/$basearch/ enabled=1 [C7.5.1804-updates] name=centos-7.5.1804 - Updates baseurl=http://vault.centos.org/7.5.1804/updates/$basearch/ [C7.5.1804-extras] name=centos-7.5.1804 - Extras baseurl=http://vault.centos.org/7.5.1804/extras/$basearch/ [C7.5.1804-centosplus] name=centos-7.5.1804 - CentOSPlus baseurl=http://vault.centos.org/7.5.1804/centosplus/$basearch/ [C7.5.1804-fasttrack] name=centos-7.5.1804 - CentOSPlus baseurl=http://vault.centos.org/7.5.1804/fasttrack/$basearch/ * yum repolist * yum install screen * Follow the instruction in the QR CE install ducument. Copy the QR_CE iso image to the installed system, for example using scp: scp <vm host ip>:/tmp/qradarce7_3_1.ga.iso /root/qradarce7_3_1.ga.iso mkdir /media/updates mount -o loop /root/qradarce7_3_1.ga.iso /media/updates /media/updates/installer After successful installtio you need to set a password with /opt/qradar/support/changepassswd.sh -a service tomcat restart You may now login in the WebConsole!