Interested in an agent capable of processing the Windows Forwarded Events log and format the logs so they appear to come from the original host? Look no further!
The Snare Enterprise Agent for Windows for WEC is a new agent with the same features and functions as the Snare Enterprise Agent for Windows but also will allow event logs collected by the Windows operating system on Microsoft WEC configured systems, only to be forwarded to a remote audit event collection facility or SIEM, such as Snare Central. It is only licensed to run on server versions of the Microsoft Windows platforms.
The Snare WEC agent has a modified objective that includes an additional checkbox to collect from the Windows ‘Forwarded Events’ custom event log, which is used to collect logs using the Microsoft event log subscription process and uses WinRM to poll the remote hosts to collect the event logs.
- A short video on Snare WEC agent and Windows Event Forwarding.
Available from version 5.0.2, for further information contact your Snare Sales representative for an evaluation license.