Release of WinCollect stand-alone agent V10.1.1

About WinCollect V10.1.1

WinCollect 10.1.1 is available for stand-alone only deployments.

New features:

• Added support for mutual TLS (mTLS) authentication between WinCollect standalone agent and the QRadar destination.
• Added support for secondary destinations to be any protocol (e.g. UDP, TCP, TLS, mTLS).

Bug fixes and improvements including the following:

• Fixed an issue where an incorrect conversion of certificate occurs when disabling or enabling destination (APAR IJ42319).
• Fixed an issue with TLS hostname verification.
• Fixed an issue where the agent caches PEM files that are removed from the config until the service is restarted.
• Fixed an issue where the agent incorrectly detects the encrypted client key as unencrypted.
• Fixed an issue where the agent does not properly detect new content in a file when Windows incorrectly reports the size as zero.
• Upgraded versions of third party libraries.
• Removed support for TLS v1 and v1.1.

• Windows® Server 2022 (including Core)
• Windows® Server 2019 (including Core)
• Windows® Server 2016 (including Core)
• Windows® Server 2012 (including Core)
• Windows® 10 (most recent)
  
  NOTE: WinCollect is not supported on versions of Windows® that moved to End Of Support by Microsoft®. After software is used beyond the Extended Support End Date, the product might still function as expected; however, IBM® does not make code or vulnerability fixes to resolve WinCollect issues for older operating systems. For more information, see the WinCollect 10 documentation.

IBM® Statement for WinCollect supported versions
Supported software versions for IBM® WinCollect are the latest version (n) and latest minus one (n-1). Therefore, the two newest versions of WinCollect are the versions that QRadar® support suggests with any support tickets (cases) that are opened. To prevent issues, it is important that you, as an administrator, keep WinCollect deployments updated when new versions are posted to IBM® Fix Central. For questions related to this statement, ask in the WinCollect forum: http://ibm.biz/wincollectforums.
 

Prerequisites for the WinCollect V10.1.1 upgrade

Installation prerequisites

WinCollect 10.0.1 and WinCollect V7.3.0 or greater agents that are in stand-alone mode can be upgraded to WinCollect V10.1.1.

QRadar® version prerequisites
WinCollect V10.1.1 supports QRadar® V7.3.3 or later.

WinCollect version prerequisites

WinCollect V7.3.0 stand-alone is the minimum version required to upgrade to QRadar® V10.x (any patch level).

WinCollect upgrade procedure

For information about installing or upgrading WinCollect 10, see IBM Documentation.

WinCollect Agent update links for 64-bit and 32-bit downloads:

• Download files for QRadar 7.5
  Full URL: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.5.0&platform=All&function=fixId&fixids=7.5.0-QRADAR-AGENT-wincollect-10.1.1-30.x86.msi,7.5.0-QRADAR-AGENT-wincollect-10.1.1-30.x64.msi&includeSupersedes=0&source=fc
• Download files for QRadar 7.4
  Full URL: https://www.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%20Security&product=ibm/Other+software/IBM+Security+QRadar+SIEM&release=7.4.0&platform=All&function=fixId&fixids=7.4.0-QRADAR-AGENT-wincollect-10.1.1-30.x86.msi,7.4.0-QRADAR-AGENT-wincollect-10.1.1-30.x64.msi&includeSupersedes=0&source=fc

For more information about stand-alone mode, see IBM Documentation.