Windows log collection

Hello all,we are in the process of deploying QRadar.I am stuck at a point whether to use a wincollect for log collection from windows devices. we have 2 data centres with dc and DR setup. I am planning to put wincollect in DR only as DC has an EP in HA confoguration. Is it a viable option?Also, will there be any log discrepancy if logs are collected by MSRPC in one location and through wincollect at another location. Can someone please suggest.


  • No Related Posts

Leave a Reply