Juniper Secure Analytics

Transcription

1 Juniper Secure Analytics WinCollect User Guide Release Published:

2 Juniper Networks, Inc North Mathilda Avenue Sunnyvale, California USA All rights reserved. Juniper Networks, Junos, Steel-Belted Radius, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. The Juniper Networks Logo, the Junos logo, and JunosE are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Juniper Secure Analytics WinCollect User Guide All rights reserved. The information in this document is current as of the date on the title page. YEAR 2000 NOTICE Juniper Networks hardware and software products are Year 2000 compliant. Junos OS has no known time-related limitations through the year However, the NTP application is known to have some difficulty in the year END USER LICENSE AGREEMENT The Juniper Networks product that is the subject of this technical documentation consists of (or is intended for use with) Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ( EULA ) posted at By downloading, installing or using such software, you agree to the terms and conditions of that EULA. ii

3 Table of Contents About the Documentation vii Documentation and Release Notes vii Documentation Conventions vii Documentation Feedback ix Requesting Technical Support x Self-Help Online Tools and Resources x Opening a Case with JTAC x Part 1 WinCollect User Guide Chapter 1 What is New in WinCollect New and Changed Features in WinCollect for Release Distributed WinCollect Deployments Performance Improvements bit Installations Communication Management Port Change Automatic Log Source Creation Updated Installation Process Agent Installations on Windows XP Systems Heart Beats are no Longer Updated in the JSA User Interface Stand-alone Installations Chapter 2 WinCollect Overview Understanding WinCollect Overview Distributed WinCollect Agent Installation Process Chapter 3 Installation Prerequisites for WinCollect Prerequisites for WinCollect Installation Distribution Options for WinCollect Agents System Performance and Deployment Strategies Communication Between WinCollect Agents and JSA Event Collector WinCollect Agent Communication to JSA Console and Event Collectors WinCollect Agents Remotely Polling Windows Event Sources Hardware and Software Requirements for the WinCollect Host WinCollect Agent Installations and Events Per Second Prerequisites for Upgrading WinCollect Agents WinCollect and JSA Software Versions Checking the Installed Version of the WinCollect Agent Checking Minimum WinCollect Versions Before Upgrade Installations iii

4 WinCollect User Guide Chapter 4 WinCollect Installations Installing the WinCollect Agent RPM on JSA Appliances Creating an Authentication Token for WinCollect Agents Installing the WinCollect Agent on a WinCollect Host Installing a WinCollect Agent from the Command Prompt Manually Installing a WinCollect Agent Update Chapter 5 Configuring WinCollect Agents After Installation Manually Adding a WinCollect Agent Deleting a WinCollect Agent WinCollect Destinations Adding a Destination Deleting a Destination from WinCollect Scheduling Event Forwarding and Event Storage for WinCollect Agent Configuration Options for Systems with Restricted Policies for Domain Controller Credentials Local Installations with no Remote Polling Configuring Access to the Registry for Remote Polling Windows Event Subscriptions for WinCollect Agents Chapter 6 Log Sources for WinCollect Agents Common WinCollect Log Source Parameters Adding a Log Source to a WinCollect Agent Microsoft DHCP Log Source Configuration Options Microsoft IAS Log Source Configuration Options Microsoft ISA Log Configuration Options File Forwarder Log Source Configuration Options Microsoft SQL Server Log Source Configuration Options XPath Log Source Configuration Options XPath Queries Adding Multiple Log Sources Chapter 7 XPath Queries Enabling Remote Log Management on Windows Enabling Remote Log Management on Windows Enabling Remote Log Management on Windows 2008R Creating a Custom View XPath Log Source Configuration Options XPath Query Examples Part 2 Index Index iv

5 List of Tables About the Documentation vii Table 1: Notice Icons viii Table 2: Text and Syntax Conventions viii Part 1 WinCollect User Guide Chapter 3 Installation Prerequisites for WinCollect Table 3: Port Usage for WinCollect Remote Polling Table 4: Hardware Requirements for WinCollect Table 5: Software Requirements Table 6: EPS Rates in a Test Environment Chapter 4 WinCollect Installations Table 7: Add Authorized Services parameters Table 8: WinCollect Installation Wizard Parameters Table 9: Silent Installation Options for WinCollect Agents Table 10: Log Source Creation Options Chapter 5 Configuring WinCollect Agents After Installation Table 11: WinCollect Agent Parameters Table 12: Destination Parameters Chapter 6 Log Sources for WinCollect Agents Table 13: Common WinCollect Log Source Parameters Table 14: Microsoft DHCP Protocol Parameters Table 15: Microsoft IAS Protocol Parameters Table 16: WinCollect Microsoft DHCP Protocol Parameters Table 17: File Forwarder Protocol Parameters Table 18: Microsoft SQL Server Protocol Parameters Table 19: Microsoft SQL Server Protocol Parameters Table 20: Event IDs Used in Credential Logon Example Table 21: Event IDs Used in Database Example Chapter 7 XPath Queries Table 22: Microsoft SQL Server Protocol Parameters Table 23: Event IDs Used in Credential Logon Example Table 24: Event IDs Used in Database Example v

6 WinCollect User Guide vi

7 About the Documentation Documentation and Release Notes Documentation and Release Notes on page vii Documentation Conventions on page vii Documentation Feedback on page ix Requesting Technical Support on page x Documentation Conventions To obtain the most current version of all Juniper Networks technical documentation, see the product documentation page on the Juniper Networks website at If the information in the latest release notes differs from the information in the documentation, follow the product Release Notes. Juniper Networks Books publishes books by Juniper Networks engineers and subject matter experts. These books go beyond the technical documentation to explore the nuances of network architecture, deployment, and administration. The current list can be viewed at Table 1 on page viii defines notice icons used in this guide. vii

8 WinCollect User Guide Table 1: Notice Icons Icon Meaning Description Informational note Indicates important features or instructions. Caution Indicates a situation that might result in loss of data or hardware damage. Warning Alerts you to the risk of personal injury or death. Laser warning Alerts you to the risk of personal injury from a laser. Tip Indicates helpful information. Best practice Alerts you to a recommended use or implementation. Table 2: Text and Syntax Conventions Table 2 on page viii defines the text and syntax conventions used in this guide. Convention Description Examples Bold text like this Represents text that you type. To enter configuration mode, type the configure command: user@host> configure Fixed-width text like this Italic text like this Represents output that appears on the terminal screen. Introduces or emphasizes important new terms. Identifies guide names. Identifies RFC and Internet draft titles. user@host> show chassis alarms No alarms currently active A policy term is a named structure that defines match conditions and actions. Junos OS CLI User Guide RFC 1997, BGP Communities Attribute Italic text like this Represents variables (options for which you substitute a value) in commands or configuration statements. Configure the machine s domain name: [edit] root@# set system domain-name domain-name viii

9 About the Documentation Table 2: Text and Syntax Conventions (continued) Convention Description Examples Text like this Represents names of configuration statements, commands, files, and directories; configuration hierarchy levels; or labels on routing platform components. To configure a stub area, include the stub statement at the [edit protocols ospf area area-id] hierarchy level. The console port is labeled CONSOLE. < > (angle brackets) Encloses optional keywords or variables. stub <default-metric metric>; (pipe symbol) Indicates a choice between the mutually exclusive keywords or variables on either side of the symbol. The set of choices is often enclosed in parentheses for clarity. broadcast multicast (string1 string2 string3) # (pound sign) Indicates a comment specified on the same line as the configuration statement to which it applies. rsvp { # Required for dynamic MPLS only [ ] (square brackets) Encloses a variable for which you can substitute one or more values. community name members [ community-ids ] Indention and braces ( { } ) ; (semicolon) Identifies a level in the configuration hierarchy. Identifies a leaf statement at a configuration hierarchy level. [edit] routing-options { static { route default { nexthop address; retain; } } } GUI Conventions Bold text like this Represents graphical user interface (GUI) items you click or select. In the Logical Interfaces box, select All Interfaces. To cancel the configuration, click Cancel. > (bold right angle bracket) Separates levels in a hierarchy of menu selections. In the configuration editor hierarchy, select Protocols>Ospf. Documentation Feedback We encourage you to provide feedback, comments, and suggestions so that we can improve the documentation. You can provide feedback by using either of the following methods: Online feedback rating system On any page at the Juniper Networks Technical Documentation site at simply click the stars to rate the content, and use the pop-up form to provide us with information about your experience. Alternately, you can use the online feedback form at ix

10 WinCollect User Guide Send your comments to Include the document or topic name, URL or page number, and software version (if applicable). Requesting Technical Support Technical product support is available through the Juniper Networks Technical Assistance Center (JTAC). If you are a customer with an active J-Care or JNASC support contract, or are covered under warranty, and need post-sales technical support, you can access our tools and resources online or open a case with JTAC. JTAC policies For a complete understanding of our JTAC procedures and policies, review the JTAC User Guide located at Product warranties For product warranty information, visit JTAC hours of operation The JTAC centers have resources available 24 hours a day, 7 days a week, 365 days a year. Self-Help Online Tools and Resources For quick and easy problem resolution, Juniper Networks has designed an online self-service portal called the Customer Support Center (CSC) that provides you with the following features: Find CSC offerings: Search for known bugs: Find product documentation: Find solutions and answer questions using our Knowledge Base: Download the latest versions of software and review release notes: Search technical bulletins for relevant hardware and software notifications: Join and participate in the Juniper Networks Community Forum: Open a case online in the CSC Case Management tool: To verify service entitlement by product serial number, use our Serial Number Entitlement (SNE) Tool: Opening a Case with JTAC You can open a case with JTAC on the Web or by telephone. Use the Case Management tool in the CSC at Call JTAC ( toll-free in the USA, Canada, and Mexico). x

11 About the Documentation For international or direct-dial options in countries without toll-free numbers, see xi

12 WinCollect User Guide xii

13 PART 1 WinCollect User Guide What is New in WinCollect on page 3 WinCollect Overview on page 5 Installation Prerequisites for WinCollect on page 9 WinCollect Installations on page 17 Configuring WinCollect Agents After Installation on page 27 Log Sources for WinCollect Agents on page 35 XPath Queries on page 53 1

14 WinCollect User Guide 2

15 CHAPTER 1 What is New in WinCollect New and Changed Features in WinCollect for Release on page 3 New and Changed Features in WinCollect for Release WinCollect includes updates, such as automatic log source creation, 64-bit installations, performance improvements, and stand-alone installations. Distributed WinCollect Deployments Using a distributed deployment, you can configure WinCollect agents to communicate with an Event Collector. The Event Collector then sends the data to your Juniper Secure Analytics (JSA) console. You can manage your distributed deployment by using the JSA user interface. To use this feature, your JSA system must be updated to r or later. Performance Improvements There are many performance improvements, including significant increases to EPS rates for tuned agents, both for local and remote collection. There are also improvements to the agent logging and statistical information. 64-bit Installations For new installations, depending on your Windows operating system bit version, you can download a 32-bit or 64-bit WinCollect agent installer. If you are upgrading, when you install the WinCollect agent RPM, the installer automatically detects the operating system bit version. Communication Management Port Change WinCollect now uses port 8413 for management communication. Automatic Log Source Creation When you install the WinCollect agent on a WinCollect host, you can now configure the agent to automatically create a log source in JSA. This log source is created when the agent first registers with JSA. This log source collects the configured windows event log types from the Windows Server where the agent was installed. This feature eliminates the need to set up a local log source for each agent that is installed. Your JSA system must be updated to r or later. 3

16 WinCollect User Guide Updated Installation Process When you install the WinCollect RPM, it now includes all of the WinCollect plug-ins. You can configure the WinCollect agent installation to automatically create and tune a JSA log source. You can also set the syslog status server, which is useful if you set up a stand-alone installation. Agent Installations on Windows XP Systems You can now install the WinCollect agent on Windows XP. Heart Beats are no Longer Updated in the JSA User Interface Heartbeats are supported as a syslog message and the JSA user interface for WinCollect agents is not updated. You see new syslog messages for heartbeats that you did not see in previous releases. Stand-alone Installations WinCollect agents can be installed in stand-alone mode. You can use an endpoint management or software distribution product to manage the installation of your stand-alone WinCollect agents. For more information about how to install stand-alone WinCollect agents, contact Juniper Customer Support. Before you upgrade WinCollect agents, ensure that your software meets the version requirements. For more information, see Prerequisites for Upgrading WinCollect Agents on page 14. Related Documentation Understanding WinCollect Overview on page 5 Prerequisites for WinCollect Installation on page 9 4

17 CHAPTER 2 WinCollect Overview Understanding WinCollect Overview Understanding WinCollect Overview on page 5 WinCollect is an agent that collects Windows-based events from local or remote Windows-based systems and sends them to Juniper Secure Analytics (JSA). WinCollect is an application that collects events by running as a service on a Windows system. The WinCollect agent can also collect events from other Windows servers where the agent is not installed. WinCollect is centrally managed from the JSA user interface. Each WinCollect agent that is deployed in your network can collect and forward events to JSA console or Event Collector by using syslog. Figure 1 on page 5 shows two WinCollect agents, each communicating directly with the JSA console. Figure 1: Deployment of Multiple WinCollect Agents that Communicate with the JSA Console 5

18 WinCollect User Guide Figure 2 on page 6 shows three WinCollect agents. The agents collect events from Windows Servers and then forward the events to an Event Collector. Two of the WinCollect agents forward events to the same Event Collector. JSA console centrally manages the events from the Event Collectors. Figure 2: Deployment of Multiple WinCollect Agents that Communicate with Multiple Event Collectors Distributed WinCollect Agent Installation Process You can configure multiple WinCollect agents to communicate with an Event Collector that then sends the data to your JSA console. To install a distributed WinCollect agent deployment: 1. Install the WinCollect agent RPM on your JSA console. 2. Create an authorization token for your WinCollect agents. 3. Create destinations for WinCollect events in your deployment. 4. Install the WinCollect agent on your WinCollect hosts and set the Configuration console as the IP of your Event Collector. 5. Wait for JSA to automatically discover your WinCollect agents. Open ports are required for data communication between WinCollect agents and the JSA host, and between WinCollect agents and the hosts that they remotely poll. For more information, see Communication Between WinCollect Agents and JSA Event Collector on page 11. 6

19 Chapter 2: WinCollect Overview You can install the WinCollect agents on Windows-based hosts in your network. The WinCollect agent collects Windows-based events and sends them to your JSA console or JSA Event Collector. For more information, see Installing the WinCollect Agent on a WinCollect Host on page 19. Related Documentation New and Changed Features in WinCollect for Release on page 3 Prerequisites for WinCollect Installation on page 9 Communication Between WinCollect Agents and JSA Event Collector on page 11 7

20 WinCollect User Guide 8

21 CHAPTER 3 Installation Prerequisites for WinCollect Prerequisites for WinCollect Installation on page 9 Communication Between WinCollect Agents and JSA Event Collector on page 11 Hardware and Software Requirements for the WinCollect Host on page 12 WinCollect Agent Installations and Events Per Second on page 13 Prerequisites for Upgrading WinCollect Agents on page 14 Prerequisites for WinCollect Installation Before you can install WinCollect agents, you must verify that your deployment meets the installation requirements. Distribution Options for WinCollect Agents WinCollect agents can be distributed in a remote collection configuration or installed on the local host. The following WinCollect collection methods are available: local and remote. Local Collection The WinCollect agent collects events only for the host on which it is installed. You can use this collection method on a Windows host that is busy or has limited resources, for example, domain controllers. Figure 3 on page 10 describes the local collection method for WinCollect agents. 9

22 WinCollect User Guide Figure 3: Local Collection for WinCollect Agents Remote Collection The WinCollect agent is installed on a single host and collects events from multiple Windows systems. Use remote collection to easily scale the number of Windows log sources that you can monitor. Figure 4 on page 10 describes the remote collection method for WinCollect agents. Figure 4: Remote Collection for WinCollect Agents System Performance and Deployment Strategies Use the following strategies to reduce the impact to system performance: To reduce the total number of agents, use remote collection where one agent monitors many endpoints. If you update a group of WinCollect agents, do it during off-peak operating hours. Deploy and manage the WinCollect agents in groups of 100 and monitor system performance for issues. 10

23 Chapter 3: Installation Prerequisites for WinCollect Related Documentation New and Changed Features in WinCollect for Release on page 3 Understanding WinCollect Overview on page 5 Communication Between WinCollect Agents and JSA Event Collector on page 11 Communication Between WinCollect Agents and JSA Event Collector Open ports are required for data communication between WinCollect agents and the JSA host, and between WinCollect agents and the hosts that they remotely poll. WinCollect Agent Communication to JSA Console and Event Collectors All WinCollect agents communicate with the JSA console and Event Collectors to forward events to JSA and request updated information. You must ensure firewalls that are between the JSA Event Collectors and your WinCollect agents allow traffic on the following ports: Port 8413 This port is required for managing the WinCollect agents. Port 8413 is used for features such as configuration updates. Traffic is always initiated from the WinCollect agent. This traffic is sent over TCP and communication is encrypted. Port 514 This port is used by the WinCollect agent to forward syslog events to JSA. You can configure WinCollect log sources to provide events by using TCP or UDP. You can decide which transmission protocol is required for each WinCollect log source. Port 514 traffic is always initiated from the WinCollect agent. WinCollect Agents Remotely Polling Windows Event Sources WinCollect agents that remotely poll other Windows operating systems for events that include extra port requirements. Table 3 on page 11 describes the ports that used when WinCollect agents remotely poll for Windows-based events. Table 3: Port Usage for WinCollect Remote Polling Port Protocol Usage 135 TCP Microsoft Endpoint Mapper 137 UDP NetBIOS name service 138 UDP NetBIOS datagram service 139 TCP NetBIOS session service 445 TCP Microsoft Directory Services for file transfers that use Windows share 11

24 WinCollect User Guide Collecting events by polling remote Windows systems uses dynamic RPC. To use dynamic RPC, you must allow inbound traffic to the Windows system that WinCollect attempts to poll for events on port 135. Port 135 is used for Endpoint Mapping by Windows. If you remotely poll any Windows operating system other than the Windows Vista operating system, you might need to allow ports in the range between 1024 and port You can configure Windows to restrict the communication to specific ports for the older versions of Windows Firewall, for example Windows XP. For more information, see your Windows documentation. Related Documentation New and Changed Features in WinCollect for Release on page 3 Understanding WinCollect Overview on page 5 Communication Between WinCollect Agents and JSA Event Collector on page 11 Hardware and Software Requirements for the WinCollect Host Ensure that the Windows-based computer that hosts the WinCollect agent meets the minimum hardware and software requirements. Table 4 on page 12 describes the minimum hardware requirements. Table 4: Hardware Requirements for WinCollect Requirement Description Memory 8 GB 2 GB reserved for the WinCollect agent. Processing Intel Core 2 Duo processor 2.0 GHz Disk space 3 GB of available disk space for software and log files. 6 GB might be required if events are stored on a schedule. Available processor resources 20% Table 5 on page 13 describes the supported software. 12

25 Chapter 3: Installation Prerequisites for WinCollect Table 5: Software Requirements Requirement Description Operating system Windows Server 2003 Windows Server 2008 Windows Server 2008R2 Windows Server 2012 Windows 7 Windows Vista Windows XP Required user role permissions Administrator Distribution One WinCollect agent for each host. To tune your installation to improve the performance of a single WinCollect agent, contact Juniper Customer Support. Related Documentation New and Changed Features in WinCollect for Release on page 3 Understanding WinCollect Overview on page 5 WinCollect Agent Installations and Events Per Second on page 13 WinCollect Agent Installations and Events Per Second Before you install your WinCollect agents, it is important to understand the number of events that can be collected by a WinCollect agent. The event per second (EPS) rates in the following table represent a test network. This information can help you determine the number of WinCollect agents that you need to install on your network. WinCollect supports default EPS rates and also supports tuning. Tuning can help you to improve the performance of a single WinCollect agent. You can tune local collection as part of the agent installation. Improving the performance of existing installations and remote collection must be done with the help of Juniper Customer Support. Exceeding these EPS rates without tuning can cause you to experience performance issues or event loss, especially on busy systems. Table 6 on page 13 describes the default EPS rate in the test environment. Table 6: EPS Rates in a Test Environment Installation Type Tuning EPS Log Sources Total Events Per Second (EPS) Local Collection Default

26 WinCollect User Guide Table 6: EPS Rates in a Test Environment (continued) Installation Type Tuning EPS Log Sources Total Events Per Second (EPS) Local Collection Tuned Remote Collection Default Remote Collection Tuned varies varies Tuning an agent to increase the EPS rates for remote event collection depends on your network, the number of log sources that you assign to the agent, and the number of events that are generated by each log source. Related Documentation New and Changed Features in WinCollect for Release on page 3 Understanding WinCollect Overview on page 5 Hardware and Software Requirements for the WinCollect Host on page 12 Prerequisites for Upgrading WinCollect Agents on page 14 Prerequisites for Upgrading WinCollect Agents Before you upgrade WinCollect agents, ensure that your software meets the version requirements. WinCollect and JSA Software Versions The version of the installed WinCollect depends on the version of JSA that you are running. If you are running or later, ensure that WINCOLLECT AGENT exe and WINCOLLECT AGENT rpm are installed. If you are running , ensure that AGENT-WINCOLLECT noarch.rpm is installed. Checking the Installed Version of the WinCollect Agent You can check the version of the installed WinCollect agent by using one of the following methods: In JSA, select Help > About Select the Additional Release Information link. You can also use ssh to log in to the JSA console, and run the following command: rpm -qa grep -i AGENT-WINCOLLECT 14

27 Chapter 3: Installation Prerequisites for WinCollect Checking Minimum WinCollect Versions Before Upgrade Installations Before you install the new WinCollect agent, open the WinCollect pane in the Admin tab, and ensure that all WinCollect agents are listed as version If you installed WINCOLLECT AGENT , WINCOLLECT AGENT or AGENT-WINCOLLECT , but one or more agents are still listed as JSA/STRM version , ensure that you wait for the update to be replicated to the agents. The time that you wait depends on what you previously configured for the Configuration Poll Interval in the WinCollect Agent Configuration pane. Related Documentation New and Changed Features in WinCollect for Release on page 3 Understanding WinCollect Overview on page 5 Hardware and Software Requirements for the WinCollect Host on page 12 15

28 WinCollect User Guide 16

29 CHAPTER 4 WinCollect Installations To install WinCollect, you must download and install a WinCollect agent RPM, create an authentication token, and then install a WinCollect agent. Install the WinCollect agent on each Windows-based host from which you want to collect events or on the host that you want to use for remote collection. First-time installations require that you install both the WinCollect agent RPM and the WinCollect agent program (.exe) Upgrades require that you install only the WinCollect agent RPM. If automatic updates are enabled, the WinCollect agent RPM sends updates to all of the WinCollect agents. Installing the WinCollect Agent RPM on JSA Appliances on page 17 Creating an Authentication Token for WinCollect Agents on page 18 Installing the WinCollect Agent on a WinCollect Host on page 19 Installing a WinCollect Agent from the Command Prompt on page 21 Manually Installing a WinCollect Agent Update on page 24 Installing the WinCollect Agent RPM on JSA Appliances To use the JSA user interface to manage a distributed deployment of WinCollect agents, you must install the WinCollect agent RPM on your JSA console. This agent includes the required protocol to enable communication between the JSA system and the managed WinCollect hosts. To install the WinCollect agent RPM on JSA appliances: 1. Download the WinCollect agent RPM file from the Juniper Customer Support website: ( 2. Copy the RPM to your JSA system. 3. Log in to JSA as the root user. 4. Type the following command: rpm -Uvh AGENT-WINCOLLECT-<jsa_version>-<build_number>.noarch.rpm 5. To install the protocol files, type the following command: yum groupinstall wincollect 6. If you are prompted for configuration, type y. 17

30 WinCollect User Guide 7. Log in to JSA. 8. On the Admin tab toolbar, select Advanced > Deploy Full Configuration. 9. As the root user, run the following command: service tomcat restart You can install the WinCollect agents on Windows-based hosts in your network. The WinCollect agent collects Windows-based events and sends them to your JSA console or JSA Event Collector. For more information, see Installing the WinCollect Agent on a WinCollect Host on page 19. For non-interactive installations, you can install the WinCollect agent from the command prompt. Use silent installations to deploy WinCollect agents simultaneously to multiple remote systems. The installations use third-party products, remote, or batch installations. For more information, see Installing a WinCollect Agent from the Command Prompt on page 21. Related Documentation New and Changed Features in WinCollect for Release on page 3 Understanding WinCollect Overview on page 5 Hardware and Software Requirements for the WinCollect Host on page 12 Creating an Authentication Token for WinCollect Agents on page 18 Creating an Authentication Token for WinCollect Agents Third-party or external applications that interact with Juniper Secure Analytics (JSA) require an authentication token. Before you install WinCollect agents in your network, you must create an authentication token. This authentication token is required for every WinCollect agent you install. The authentication token allows WinCollect agents to exchange data with JSA appliances. Create one authentication token for all of your WinCollect agents that communicate events with your JSA host. If the authentication token expires, the WinCollect agent cannot receive log source configuration changes. Procedure 1. Click the Admin tab. 2. On the navigation menu, click System Configuration. 3. Click the Authorized Services icon. 4. Click Add Authorized Service. 5. In the Manage Authorized Services window, configure the parameters. Table 7: Add Authorized Services parameters Parameter Description Service Name The name can be up to 255 characters in length, for example, WinCollect Agent. 18

31 Chapter 4: WinCollect Installations Table 7: Add Authorized Services parameters (continued) Parameter Description User Role Administrators can create a user role or assign a default user role to the authorization token. For most configurations, the All user role can be selected. NOTE: The admin user role provides more privileges, which can create a security concern. 6. Click Create Service. 7. Record the token value. Related Documentation New and Changed Features in WinCollect for Release on page 3 Understanding WinCollect Overview on page 5 Hardware and Software Requirements for the WinCollect Host on page 12 Installing the WinCollect Agent RPM on JSA Appliances on page 17 Installing the WinCollect Agent on a WinCollect Host You can install the WinCollect agents on Windows-based hosts in your network. The WinCollect agent collects Windows-based events and sends them to your JSA console or JSA Event Collector. Before you begin When you install the WinCollect agent on a WinCollect host, you can now configure the agent to automatically create a log source in JSA. The log source is created when the agent first registers with JSA. This log source will collect the configured Windows event log types from the Windows server where the agent is installed. This feature eliminates the need to set up a local log source for each agent that is installed. Your JSA system must be updated to r or later. Ensure that the following conditions are met: You created an authentication token for the WinCollect agent. For more information, see Creating an Authentication Token for WinCollect Agents on page 18. Your system meets the hardware and software requirements. For more information, see Hardware and Software Requirements for the WinCollect Host on page 12. The required ports are available to WinCollect agents to communicate with JSA Event Collectors. 19

32 WinCollect User Guide For more information, see Communication Between WinCollect Agents and JSA Event Collector on page 11. If you want to automatically create a log source for this agent, you must know the name of the destination that you want to send your Windows log source to. During the installation, you can configure JSA to automatically create a log source the WinCollect agent host. You must configure a forwarding destination host for the log source data. For more information, see Adding a Destination on page 30. The WinCollect agent sends the Windows event logs to the configured destination. The destination can be the console or an Event Collector. To configure automatic log source creation, your JSA system must be updated to JSA r or later. Procedure To install the WinCollect agent on a WinCollect host: 1. Download the WinCollect agent setup file from the Juniper Customer Support website ( NOTE: If the Services window is open on the Windows host, close it. If the Services window is open, the WinCollect agent installation will fail. 2. Right-click the WinCollect agent installation file and select Run as administrator. 3. Follow the prompts in the installation wizard. Table 8 on page 20 describes the prompts in the installation wizard: Table 8: WinCollect Installation Wizard Parameters Parameter Description Host Identifier Required. You must use a unique identifier for each WinCollect agent you install. The name you type in this field is displayed in the WinCollect agent list of the JSA console. Authentication Token Required. The authentication token that you created in JSA, for example, af111ff6-4f30-11eb- 11fb-1fc Configuration console (host and port) Required for all installations, except stand-alone mode. Leave blank for stand-alone mode installations. The IP address or host name of your JSA console, for example, or myhost This parameter is for the JSA console or Event Collector. To use an Event Collector as your Configuration console, your JSA system must be updated to r or later. Enable Automatic Log Source Creation If this check box is enabled, you must provide information about the log source and the target destination. Log Source Name The name can be up to 255 characters in length. 20

33 Chapter 4: WinCollect Installations Table 8: WinCollect Installation Wizard Parameters (continued) Parameter Description Log Source Identifier Required if the Enable Automatic Log Source Creation checkbox is selected. Identifies the remote device that the WinCollect agent polls. StatusServer The address of the machine to which the status events are sent. If no value is provides, the Configuration Server is used. If both values are empty, no status messages are sent. Event Logs The Window event logs that you want the log source to collect and send to JSA. Target Destination Required if Automatic Log Source Creation is enabled. The WinCollect destination must be configured in JSA before you continue entering information in the installation wizard. Machine poll interval (msec) The polling interval that determines the number of milliseconds between queries to the Windows host. Use a polling interval of 3500 when the WinCollect agent collects events from computers that have a low event per second rate, for example, collecting from 50 remote computers that provide 20 events per second or less. Use a polling interval of 1000 when the WinCollect agent collects events from a few remote computers that have a high event per second rate, for example, collecting from 10 remote computers that provide 100 events per second or less. The minimum polling interval is 100 milliseconds (.1 seconds). The default is 3000 milliseconds or 3 seconds. Minimum number of logs to process per pass Contact Juniper Customer Support before change these values. Maximum number of logs to process per pass Contact Juniper Customer Support before you change these values. Related tasks: If you delete your WinCollect agent, you can manually add it back. To reconnect to an existing WinCollect agent, the host name must exactly match the host name that you used before you deleted the agent. For more information, see Manually Adding a WinCollect Agent on page 27. Related Documentation New and Changed Features in WinCollect for Release on page 3 Understanding WinCollect Overview on page 5 Hardware and Software Requirements for the WinCollect Host on page 12 Installing the WinCollect Agent RPM on JSA Appliances on page 17 Installing a WinCollect Agent from the Command Prompt For non-interactive installations, you can install the WinCollect agent from the command prompt. Use silent installations to deploy WinCollect agents simultaneously to multiple remote systems. The installations use third-party products, remote, or batch installations. 21

34 WinCollect User Guide About this task Table 9 on page 22 describes the WinCollect installer command options. Table 9: Silent Installation Options for WinCollect Agents Option Description /qn Runs the WinCollect agent installation in silent mode. INSTALLDIR The name of the installation directory cannot contain spaces. Use quotation marks, ", to enclose the directory, for example, NSTALLDIR= C:\IBM\WinCollect\ AUTHTOKEN=token Authorizes the WinCollect service, for example, AUTH_TOKEN=af111ff6-4f30-11eb- 11fb-1fc HOSTNAME=host name The IP address or host name of the WinCollect agent host cannot contain the "at" FULLCONSOLEADRESS=host_address The IP address or host name of your JSA console or Event Collector, for example, FULLCONSOLEADRESS= Your JSA system must be updated to r or later. LOG_SOURCE_AUTO_CREATION If you enable this option, you must configure the log source parameters. Requires that your JSA system is updated to r or later. STATUSSERVER Optional. Specifies the server where the status messages from the agent are sent. Example: STATUSSERVER=" " STATUSSERVER="%COMPUTERNAME%" LOG_SOURCE_AUTO_CREATION_ PARAMETERS Ensure that each parameter uses the format: Parameter_Name=value. The parameters are separated with ampersands, &. Your JSA system must be updated to r or later. Table 10: Log Source Creation Options Option Description Component1.AgentDevice Required. Must be DeviceWindowsLog. Component1.Action Required. Must becreate. Component1.LogSourceName Not required. The name of the log source that is created. The default is 22

35 Chapter 4: WinCollect Installations Table 10: Log Source Creation Options (continued) Option Description Component1.LogSourceIdentifier Required. Must be the IP or host name of the system that the agent is installed on. Component1.Destination.Name Required if Component1.Destination.Id is not set. Component1.CoalesceEvents Not required. True or False. For more information, see the Log Sources User Guide. Component1.StoreEventPayload Not required. True or False. For more information, see the Log Sources User Guide. Component1.Encoding Not required. The default character encoding is UTF-8. Component1.Log.Application Required Component1.Log.Security Required Component1.Log.System Required Component1.Log.DNS+Server Required Component1.Log.Directory+Service Required Component1.Log.File+Replication+Service Required Procedure To install a WinCollect agent from the command prompt: 1. Download the WinCollect agent setup file from the Juniper Customer Support website ( 2. From the desktop, select Start > Run, type cmd, and click OK. 3. Ensure that the Services window is closed on the Windows host, otherwise the WinCollect agent installation will fail. 4. Type the following command: AGENT-WinCollect <build>-setup.exe /s /v"/qn INSTALLDIR=< C:\IBM\WinCollect"> AUTHTOKEN=<token> FULLCONSOLEADRESS=<host_address> HOSTNAME=<hostname> LOG_SOURCE_AUTO_CREATION=<true false> LOG_SOURCE_AUTO_CREATION_PARAMETERS=< parameters > The following example shows an installation where the log source is automatically created. 23

36 WinCollect User Guide AGENT-WinCollect-<version>-setup.exe /s /v"/qn INSTALLDIR="C:\IBM\WinCollect" AUTHTOKEN=eb59386c-e098-49b8-ba40-6fb46bfe7d1 FULLCONSOLEADDRESS= :8413 HOSTNAME=my_host LOG_SOURCE_AUTO_CREATION_ENABLED=True LOG_SOURCE_AUTO_CREATION_PARAMETERS= ""Component1.AgentDevice= DeviceWindowsLog&Component1.Action=create&Component1.LogSourceName= LSN2&Component1.LogSourceIdentifier= >&Component1.Destination.Name=Dest1&Component1.CoalesceEvents= True&Component1.StoreEventPayload=True&Component1. Encoding=UTF-8&Component1.Log.Application=True&Component1.Log.Security= True&Component1.Log.System=True&Component1.Log.DNS+Server= False&Component1.Log.Directory+Service= False&Component1.Log.FileReplication+Service=False""" The following example shows an installation where automatic log creation is not used: AGENT-WinCollect-<version>-setup.exe /s /v"/qn INSTALLDIR="C:\IBM\WinCollect" AUTHTOKEN=eb59386c-e098-49b8-ba40-6fb46bfe7d1 FULLCONSOLEADDRESS= HOSTNAME=my_host 5. Press Enter. Related tasks: If you delete your WinCollect agent, you can manually add it back. To reconnect to an existing WinCollect agent, the host name must exactly match the host name that you used before you deleted the agent. For more information, see Manually Adding a WinCollect Agent on page 27. Related Documentation New and Changed Features in WinCollect for Release on page 3 Understanding WinCollect Overview on page 5 Hardware and Software Requirements for the WinCollect Host on page 12 Installing the WinCollect Agent on a WinCollect Host on page 19 Manually Installing a WinCollect Agent Update When you install an agent update RPM file, the JSA host can automatically update all WinCollect agents that are enabled to receive automatic updates. When enabled, WinCollect agents request updated configurations from the JSA host based on the configuration polling interval. If new WinCollect agent files are available for download, the agent downloads and installs updates and restarts required services. No events are lost when you update your WinCollect agent because events are buffered to disk. Event collection forwarding continues when the WinCollect service starts. After you update an agent to WinCollect x, the agent remains configured to communicate with the JSA host until you manually update the agent configuration to communicate with the target Event Collector. Procedure 24

37 Chapter 4: WinCollect Installations To install manually a WinCollect agent update: 1. Download the WinCollect agent setup file from the Juniper Customer Support website ( 2. Log in to JSA as the root user. 3. Go to the directory where you downloaded WinCollect agent RPM file and type the following command: rpm -Uvh filename Example: rpm -Uvh AGENT-WinCollect-version.noarch.rpm 4. To install the WinCollect protocol files, type the following command: yum groupinstall wincollect 5. If you are prompted for configuration, type y. 6. Log in to JSA. 7. On the Admin tab toolbar, select Deploy Full Configuration. 8. As root user, run the following command: service tomcat restart 9. On the navigation menu, click Data Sources. 10. Click the WinCollect icon. 11. Click Agents. 12. Select the WinCollect agent that you want to update in your deployment. 13. If the agent is disabled, click Enable/Disable Automatic Updates. Results WinCollect agents that are enabled for automatic updates are updated and restarted. The amount of time it takes an agent to update depends on the configuration polling interval for the WinCollect agent. Related Documentation New and Changed Features in WinCollect for Release on page 3 Understanding WinCollect Overview on page 5 Hardware and Software Requirements for the WinCollect Host on page 12 Installing the WinCollect Agent on a WinCollect Host on page 19 Installing a WinCollect Agent from the Command Prompt on page 21 25

38 WinCollect User Guide 26

39 CHAPTER 5 Configuring WinCollect Agents After Installation After you install a WinCollect deployment, you manage your deployment by using the Juniper Secure Analytics (JSA). You can manage your WinCollect agents, destinations, and schedules. You can also manage configuration options for systems with restricted policies. The WinCollect agent is responsible for communicating with the individual log sources, parsing events, and forwarding the event information to JSA by using syslog. After you install the WinCollect agent on your Windows host, wait for JSA to automatically discover the WinCollect agent. The automatic discovery process typically takes a few minutes to complete. NOTE: The registration request to the JSA host might be blocked by firewalls in your network. Manually Adding a WinCollect Agent Manually Adding a WinCollect Agent on page 27 Deleting a WinCollect Agent on page 29 WinCollect Destinations on page 30 Configuration Options for Systems with Restricted Policies for Domain Controller Credentials on page 32 If you delete your WinCollect agent, you can manually add it back. To reconnect to an existing WinCollect agent, the host name must exactly match the host name that you used before you deleted the agent. When you delete a WinCollect agent, the Juniper Secure Analytics (JSA) console removes the agent from the agent list and disables all of the log sources that are managed by the deleted WinCollect agent. 27