3 Replies Latest reply on Dec 4, 2013 3:49 PM by rth67

    Add multiple systems with Host ID and ePO


      I am managing the SIEM collector with ePO. I have a number of DNS servers where I would like to get the DNS logs and the normal Windows events. I understand that I will have to use host IDs. How would I configure a host ID on a number of systems without having to change the host ID on each individual system? There are 100+ systems I will need to do this to.



        • 1. Re: Add multiple systems with Host ID and ePO

          A couple of options for you:


          1. Use the SIEM Collector Agent to collect both the Windows Events and DNS Logs. In this scenario, you will need to specify in your ePO SIEM Collector Agent Policy to use Host ID's, and supply an ID for Windows Events (WMI maybe) as well as in the File Tailing section, supply a Host ID for your DNS Logs (DNS maybe). On the Event Receiver, you will need to put the "SERVERNAME-HOSTID" as the Host Name, you will need two Data Sources (SERVER-WMI and SERVER-DNS).


          2. Setup Windows Events to be collected normally via WMI, and use the SIEM Collector Agent to only collect the DNS Logs, you still have to setup the File Tail with a Host ID.


          If you have 100+ systems, the thing to note is that you will need multiple ePO Policies if these systems report to different Event Receivers, you can duplicate the policy once created, and just modify the name of the policy and the Receiver IP to send the data to.

          • 2. Re: Add multiple systems with Host ID and ePO

            Are you saying that I when it comes time to put 100+ systems all at once, I can literally put "SERVERNAME-DNS" in?

            • 3. Re: Add multiple systems with Host ID and ePO



              You would need to create individual data sources using the format of "SERVERNAME-DNS" or enable the "Auto Learn" and "Auto Add" functions on the Receiver if you do not want to manually create the unique data sources.


              Manually adding the Data Sources would allow you to set them up in a Parent/Child relationship if you wanted, rather than having them all at the top level of data sources on your receiver.