Title: ADR sCollector Installation and Configuration

Last Updated: 11 / Aug / 2025

Author: ADR Support

Overview: This article provides a guide on the installation and basic usage of SCollector.

Applies To: This article applies to customers and support engineers.

TABLE OF CONTENTS

• Introduction
• Benefits
• Prerequisites and Installation
  • CCE
    • Logs configuration
    • Netflow Configuration
  • Windows
  • Example Configuration

Introduction

Historically, ADR has utilised NXLog as its collector for Windows logging. A new application has been developed that is more customised to interoperate with the ADR platform. This software is known as "ADR SCollector".

Benefits

• SCollector provides the ability to forward logs and flows (ports 514 and 9995) over a secure connection to the CCE. 
• SCollector can run alongside the ADR EDR agent and send application logs to the EDR server, so that no additional agents are required. 
• SCollector can operate independently of the ADR EDR agent as a standalone software to send Windows logs to the CCE. 

Here is the download link for SCollector-12.1.3-10369.msi

Prerequisites and Installation

CCE

• CCE must support TCP over TLS for security log transmission.
• Must have a valid signed certificate; a self-signed certificate will not work.  
• For more details: Self Signed Certificate and Key Creation in CCE for logs forwarding with TCP over TLS

Enabled scollector from cce-global-config.yml

Installation

• Install the MSI package for SCollector.
• After installation, configure C:\Program Files\Scollector\collector.conf with the following:
  • Windows Event Log IDs (Comma Separated)
  • File-based log paths (Regex is supported)
  • Application tags for log categorisation.
• Please enter the tenant id and CCE ip

# Input Configurations
# Inputs define where logs originate from

input input1 {
    # Receives log data on port 514
    port => 514
    type => syslog
    tenant_id => "XYX2509"
    useUDP = "false"

}

input input2 {
    # Receives flow-related data on port 515
    port => 9995
    type => flow
    tenant_id => "XYX2509 "
    useUDP = "false"

}

input input3 {
    # Collects Windows OS logs for specified event IDs
    type => windows_os
    tenant_id => "XYX2509 "
    eventid => "1, 3, 4, 5, 6, 7, 8, 9, 10, 12, 13, 14, 15, 17, 18,19, 20, 21, 104, 258, 259, 260, 261, 262, 500, 517, 520, 528, 529, 530, 531, 532, 533, 534, 535, 536, 537, 538, 539, 540, 551, 552, 565, 600, 608, 609, 621, 622, 626, 627, 628, 629, 630, 636, 642, 644, 645, 647, 632, 663, 664, 671, 673, 675, 676, 677, 679, 680, 681, 682, 683, 684, 689, 690, 692, 1001, 1006, 1007, 1008, 1015, 1102, 1116, 1117, 1118, 1119, 2003, 2100, 7034, 4624, 4625, 4634, 4647, 4649, 4656, 4657, 4659, 4661, 4663, 4670, 4688, 4697, 4704, 4705, 4717, 4718, 4720, 4722, 4723, 4724, 4725, 4726, 4727, 4728, 4729, 4730, 4731, 4732, 4733, 4734, 4735, 4737, 4738, 4739, 4740, 4741, 4742, 4743, 4744, 4745, 4746, 4747, 4748, 4749, 4750, 4751, 4752, 4753, 4754, 4755, 4756, 4757, 4758, 4759, 4760, 4761, 4762, 4763, 4764, 4767, 4769, 4771, 4772, 4773, 4775, 4776, 4777, 4778, 4779, 4780, 4782, 4783, 4784, 4785, 4786, 4787, 4788, 4789, 4790, 4791, 4793, 4794, 4797, 4798, 4800, 4801, 4802, 4803, 5001, 5004, 5007, 5010, 5012, 5136, 5137, 5140, 5141, 5142, 5143, 5144, 5145, 5376, 5377, 7045, 8003, 8004, 8007, 64004"
    useUDP = "false"

}

input input4 {
    # Collect file input data from a specific folder with various wildcards like * or *.txt etc.
    type => file
    tenant_id => ""
    path => ""
    pattern => ""
    apptag => ""
    useUDP = "false"
}

# Output Configurations
# Outputs define destinations where logs are sent

output output1 {
    module => syslog
    host => 216.66.x.x
    port => 6514
}

output output2 {
    module => syslog
    host => 216.66.x.x
    port => 9995
}

output output3 {
    module => syslog
    host => 216.x.x
    port => 6554
}

# Route Configurations
# Routes define the mapping of input logs to output destinations

route route1 {
    input1 => output1
}

route route2 {
    input2 => output2
}

route route3 {
    input3 => output3
}

route route4 {
    input4 => output1
}