Destinations

Destinations are any IBM® QRadar® appliance in your deployment where you want to send your event data. You can send syslog event data using UDP, TCP, or TLS protocols.

Adding a destination
If you install the WinCollect 10 agent by using the Quick Installation option, a destination that is called QRadar is created during the installation. You can also add new destinations.
Deleting a destination
If you are no longer using an IBM QRadar destination, you can delete it from the Destinations list.
Testing a destination
You can test the WinCollect 10 agent's connection to a destination by using the Test Connection button.
Adding a secondary destination
You can add a secondary destination to receive events from your WinCollect agents if the primary destination fails.
Send events to multiple destinations
If you want WinCollect 10 to send events simultaneously to two separate IBM QRadar deployments, you must duplicate your source group.
Configure a TLS destination
To configure a destination that uses the TLS protocol on a WinCollect 10 stand-alone agent, you can use one of the following two methods.
Configuring a mTLS destination
To configure a destination by using mutual TLS authentication (mTLS), select the mTLS protocol from the drop-down list in the add destination wizard.
Configuring a TLS log source
To encrypt events and send to QRadar, you must configure a log source with a TLS Syslog protocol to establish communication with QRadar on port 6514.

Parent topic: WinCollect 10 stand-alone configuration