This is an excerpt from the Q1 Labs blog, written by Michael Applebaum, Director of Product Marketing at Q1 Labs. Connect with Michael on Twitter; follow @ma08.
Do you ever feel like you’re playing the role of Goldilocks
at work? You know the scenario – you’re trying to solve a problem and every solution feels too hot or too cold, too big or too small. You can’t get administrative privileges to implement it, it requires an agent and you can’t install one, the firewall blocks it, or it’s just too expensive.
Windows event collection for SIEM and log management fits right into this category. Windows is pervasive in IT environments, but collecting Windows events can pose challenges for any product that doesn’t run on Windows.
Fortunately, Q1 Labs has been addressing this for years, and with the release of QRadar 7.1,we are offering customers more flexibility than ever to use a wide range of collection API’s, agents, third party tools and QRadar capabilities – seamlessly integrated and centrally controlled.
Because QRadar is deployed by thousands of customers running diverse IT environments, we’re constantly innovating in Windows event collection, to provide choices that meet your needs. As part of QRadar 7.1, we are pleased to introduce WinCollect, an additional, versatile and scalable QRadar capability for Windows event collection. WinCollect joins existing collection mechanisms, including Q1 Labs’ own ALE solution, third-party approaches (Snare, Adiscon EventReporter, syslog-ng), and native Windows Server capabilities (WMI and Windows event forwarding). With this release, QRadar offers the broadest Windows event collection techniques of any security intelligence product. Most importantly, regardless of which ones you use, the event information looks the same and triggers rules in exactly the same way, for seamless integration and consistent operation.
With more options, QRadar can better meet the needs of different areas of your environment – even if you want to combine collection mechanisms, and even when your requirements change over time.
Click here to read the full post on the Q1 Labs blog. Get more security news by following @IBMSecurity and @Q1Labs on Twitter.