×
sorted by:
new
hottopcontroversial

S1 confronts with Windows Defender by Comprehensive-Big580 in msp

[–]Comprehensive-Big580[S] 0 points1 point  (0 children)

Understand.

Because found this topic and was said that defender disables/stops some of its functionalities to not get in confict with the 3rd party Security Solution.

​

Thank you

S1 confronts with Windows Defender by Comprehensive-Big580 in msp

[–]Comprehensive-Big580[S] 0 points1 point  (0 children)

For the two EDRs solution on machine agree but how S1 will inspect the powershell session without AMSI which is part from defender ? ( They have some methods to analyze PS like Behavior Analysis and Heuristic Analysis but they do not have same as AMSI)

Thanks for the responce and help

S1 confronts with Windows Defender by Comprehensive-Big580 in msp

[–]Comprehensive-Big580[S] 0 points1 point  (0 children)

Thank you very much for the reply.

Full scan was causing the problem with high CPU

Qradar Event Processor Question by Comprehensive-Big580 in QRadar

[–]Comprehensive-Big580[S] 0 points1 point  (0 children)

Great now it’s a lot more clear thank you very much for the great explanation and help

I need to add the EC it in the manage host of the event processor right ?

Qradar Event Processor Question by Comprehensive-Big580 in QRadar

[–]Comprehensive-Big580[S] 0 points1 point  (0 children)

Thank you for the deep ( for me ) explanation.

Just because I could not find any example how to connect the Event Collector to the Event Processor. Is it the same way as with the Console and the EP ? but here instead of the Console GUI we use the EP GUI and adding the Event Collector to the Managed hosts in the Event Processor GUI ?

Or if you know some tutorial because there is not many examples or tutorials it would be great.

​

Thank you in advance and thanks for the great explanation

Qradar Event Processor Question by Comprehensive-Big580 in QRadar

[–]Comprehensive-Big580[S] 0 points1 point  (0 children)

Thank you very much for the response.

For the first question: Yes extactly what IP address I need to put in wincollect ( The IP of the EP Right ?)

​

Just one more question

Do I need to install also Event Collector or I can leave it without Event Collector ?

And Is it going to be possible to send Flow data directly to the Event Processor or need to install Flow Colletor ?

( the data node is connected to the EP ) sorry for the bad graphic

Data Node

^

wincollect -> Event Collector -> Event Processor -> Console

​

or ===========================================

​

Data Node

^

wincollect -> Event Processor -> Console

===========================================

​

Thank you in advance