Kaspersky Next XDR Expert

Configuring the Windows Event Collector service

The Windows Event Collector server can independently connect to devices and gather data on events of any severity.

To configure the receipt of event data by the Windows Event Collector server:

1. On the event source server, open the Run window by pressing Win+R.
2. In the opened window, type services.msc and click OK.

   The Services window opens.

3. In the list of services, find and start the Windows Event Collector service.
4. Open the Event Viewer snap-in by doing the following:
   1. Open the Run window by pressing the key combination Win+R.
   2. In the opened window, type eventvwr and click OK.
5. Go to the Subscriptions section and click Create Subscription in the Actions pane.
6. In the opened Subscription Properties window, specify the name and description of the subscription, and define the following settings:
   1. In the Destination log field, select Forwarded events from the list.
   2. In the Subscription type and source computers section, click the Select computers button.
   3. In the opened Computers window, click the Add domain computer button.

      The Select computer window opens.

   4. In the Enter the object names to select (examples) field, list the names of the devices from which you want to receive event information. Click OK.
   5. In the Computers window, check the list of devices from which the Windows Event Collector server will gather event data and click OK.
   6. In the Subscription properties window, in the Collected events field, click the Select events button.
   7. In the opened Request filter window, specify how often and which data about events on devices you want to receive.
   8. If necessary, in the <All event codes> field, list the codes of the events whose information you want to receive or do not want to receive. Click OK.
7. If you want to use a special account to view event data, do the following:
   1. In the Subscription properties window, click the Advanced button.
   2. In the opened Advanced subscription settings window, in the user account settings, select Specific user.
   3. Click the User and password button and enter the account credentials of the selected user.

Configuration of the Event Collector Service is complete.

To verify that the configuration is correct and event data is being received by the Windows Event Collector server:

In the Event Viewer snap-in, go to Event Viewer (Local) → Windows logs → Forwarded events.