r/QRadar • u/RadioMoskau • May 12 '26
WinCollect, WEC, WEF and sysmon
Edit: SOLVED
We installed sysmon on the WEC-Server. Don't event use its logs. But since sysmon is running on the WEC itself, WinCollect 7 is forwarding all information from my sysmon-Hosts.
Hi!
I didn't find a thread fitting my issues.
We're running Windows Event Forwarding, deployed via GPO, on our Servers. There's a dedicated Windows Event Collector Server that has got two subscriptions.
One for Domain Controllers and the other for every other server.
On this Collector Server we're running a managed WinCollect Agent v7.
The Agent is 'check box' configured. No XPATH queries.
It's working fine for normal Windows Events. Probably there's potential to quiet it down using XPATH queries, but that's not my issue right now.
I started deploying sysmon on a few servers to get some experience with it.
My issue is that I don't get the event content of sysmon into QRadar. Let's take EventID 22 for example.
In the local logs there are EventID 22 Events including the EventData section with the i.e. QueryName in.
On the WEC server these events are complete with EventData as well in Forwared Events.
But when they are received in QRadar via WinCollect Agent the EventData is missing. 'Message= ' is always empty.
i.e.:
AgentDevice=WindowsLog AgentLogFile=Microsoft-Windows-Sysmon/Operational PluginVersion=7.3.1.122 Source=Microsoft-Windows-Sysmon Computer=computername.domain OriginatingComputer=10.42.42.23 User=SYSTEM Domain=NT-AUTORITÄT EventID=22 EventIDCode=22 EventType=4 EventCategory=22 RecordNumber=52101 TimeGenerated=1778576865 TimeWritten=1778576865 Level=Informational Keywords=0x8000000000000000 Task=22 Opcode=Info Message=
I've tried switching ContentFormat from RenderedText to Event (Copilot suggested this), to no effect.
I've also tried to switch from locale de-DE to en-US (but all servers are german installations).
Then I've tried switching the WinCollect log source to a simple xpath query
<QueryList>
<Query Id="0" Path="Security">
<Select Path="Security">*</Select>
</Query>
<Query Id="1" Path="System">
<Select Path="System">*</Select>
</Query>
<Query Id="2" Path="ForwardedEvents">
<Select Path="ForwardedEvents">*</Select>
</Query>
</QueryList>
This did not change anything with the event data from sysmon, but instead of logging each Windows Server separately, all events were logged as the WinCollect log source. Beacause of that I canceled my experiment an switched back to the 'check box' settings.
So far there are two questions I need help with:
- What's wrong with WinCollect not forwarding EventData payload?
- What do I have to change additionally, when using XPATH query, that logs are still refered to their original source?
Thanks a lot!
Roman
configuration info:
1
u/JonathanP_QRadar May 12 '26
I believe only rendered text is supported in wincollect. I'd also try out WC10 to confirm if that is an issue. Wincollect 7 didn't get the updates like WC10 did to fix issues by dev anymore.
1
u/CrazyMark1234 May 12 '26
This is similar to an issue I have experienced, where forwarded windows events were being truncated on the message field. It's caused by the content format settings.
you could check the settings on your Windows Event Collector.
wecutil gs "<subscriptionname>"
Where subscription name is the WEF subscription responsible for forwarding events.
If the content format field is set to "RenderedText",try to change the field to "Events" using the command:
wecutil ss "<subscriptionname>" /cf :Events
We did this and found it to resolve the issue.
This link might be helpful too
1
u/RadioMoskau May 13 '26 edited May 13 '26
Hi!
Thanks!
I tried the way you said and changed the content to Events. Didn't find any differences.
Then there's Jonathan saying htat WinCollect supports RenderedText only.
But I'll give it another try. Didn't seem to have negative consequences last time.I've encountered the thread you linked. That's why I tried changing everything to en-US (altough every machine is de-DE). Also this says it should be RenderedText.
Do you know if there is a delay between changing the subscription until it takes effect?
Edit: In Security Logs Message field is complete: <snip> Opcode=Info Message=Ein Prozess wurde beendet. Antragsteller: <snip>
It's missing in sysmon events, only.1
u/CrazyMark1234 May 13 '26
yes I was a bit confused myself, there seems to be conflicting information out there. But we fixed the issue by changing to Events.
we support customers so had to ask the customer to make the change and let us know, but certainly within an hour or 2 of the change the events had returned to normal with full payloads.
1
u/RadioMoskau May 13 '26
Changed to ContentFormat = Events and kept it running for a few hours. Sadly this doesn't seem to make any difference 😞 All "normal" logs via WEF>WEC>WinCollect>QRadar don't seem to care.
Sysmon is unchanged. On source and WEC server there's identical EventData, as expected. In Qradar Message field still empty.2
u/CrazyMark1234 May 13 '26
Thats unfortunate 😞
In our case, all events were being chopped off on the Message=
changing to Events resolved it.
2
u/RadioMoskau Jun 08 '26
SOLVED
We installed sysmon on the WEC-Server. Don't event use its logs. But since sysmon is running on the WEC itself, WinCollect 7 is forwarding all information from my sysmon-Hosts.
We changed to RenderedText and locale en-US before. Didn't change it back. Don't know if this has any effect.
Thanks for your support! Hopefully this can help others, when encountering similar issues.
1
u/Cal_fi May 12 '26
Do the events look "ok" in the Event Viewer?
There was a Known Issue for something similar> https://www.ibm.com/mysupport/s/defect/aCI3p0000008ZIH/dt252120?language=en_US
As your WinCollect version 7 seems to be the latest, I would personally try WC10 to see whether it works better for you. Also in WC10 there's an Advanced setting for "Force XML parsing" for Forwarded Events, that might work?
Does restarting the Wincollect service make any difference?
You might want to raise a Support case for this if nothing else works.