Documentation Center
AlienVault® USM Anywhere™

Using the Windows Event Collector Sensor App

  Role Availability   Read-Only   Analyst   Manager

With Windows Event Collector (WEC), you can get events from remote computers and store them in a local event log on a collector computer. For events forwarded from a remote computer (client), this functions through a subscription that receives and stores these events.

USM Anywhere provides the Windows Event Collector sensor app, which you can use to set up event collection through a deployed sensor. You configure the Windows machines (clients) to forward the logs to the USM Anywhere Sensor, which works as the collector.

Setup for the Windows Event Collector sensor app requires the following

  • A Windows Server 2008 (or newer) host

    This is the host that you use to set up Windows Event Forwarding to the Windows Event Collector running on the USM Anywhere Sensor.

  • PowerShell 3.0 or newer (required to use the certificate installer script)
  • A USM Anywhere Sensor with a private, static IP address, deployed in the same network as the Windows Server and the client systems that forward logs to the sensor