Hello all,we are in the process of deploying QRadar.I am stuck at a point whether to use a wincollect for log collection from windows devices. we have 2 data centres with dc and DR setup. I am planning to put wincollect in DR only as DC has an EP in HA confoguration. Is it a viable option?Also, will there be any log discrepancy if logs are collected by MSRPC in one location and through wincollect at another location. Can someone please suggest.
Thanks
Biswa
Thanks
Biswa