I was wondering if Parent-Client datasources can be used for SIEM collector 11 datasources?
Under my receiver I would create a parent datasource called WINDOWS_COLLECTOR_EVENTLOG with the following settings:
The design would be to add all servers under WINDOWS_COLLECTOR_EVENTLOG, and if there server has multiple roles it will be added as well to for example parent data source WINDOWS_COLLECTOR_DHCP, this to catch if there's multiple types of datasources from 1 host. Our SIEM consultant told us that we could use non-routable IP addresses for parent data sources, so that's how we're currently setting up things..
Then at the clients tab I would like to add multiple servers, but to test I started with 1 data source:
for reference, the config on the server itself for the collector:
When it is added like this it's not working. When I work without the fictional IP on the parent (so just add it as a plain data source) it does work. What am I doing wrong to add collector sources as a client data source?
I tried leaving the host blank in the parent source but that also doesn't seem to help.Can I work only with parent client if this server does all the event collecton for all servers?
Re: Parent-Client datasources via SIEM Collector 11
I think you want the Parent / Client relationship instead of the Parent / Child. The Parent / Child set up still takes up against your overall allowed number of data sources on the Event Receiver, while the Parent / Client does not.
The way I have set up my environments is as such:
Parent: Logcollection-wmi (using the WMI / MEF parent data source profile)
Clients: All of my wmi logs from all of my hosts report here. Example below.