GET /config/event_sources/wincollect/wincollect_destinations

Retrieves a list of WinCollect destinations.

Table 1. GET /config/event_sources/wincollect/wincollect_destinations resource details
MIME Type

application/json

Table 2. GET /config/event_sources/wincollect/wincollect_destinations request parameter details
Parameter Type Optionality Data Type MIME Type Description

Range

header

Optional

String

text/plain

Optional - Use this parameter to restrict the number of elements that are returned in the list to a specified range. The list is indexed starting at zero.

filter

query

Optional

String

text/plain

Optional - This parameter is used to restrict the elements in a list base on the contents of various fields.

fields

query

Optional

String

text/plain

Optional - Use this parameter to specify which fields you would like to get back in the response. Fields that are not named are excluded. Specify subfields in brackets and multiple fields in the same object are separated by commas.

Table 3. GET /config/event_sources/wincollect/wincollect_destinations response codes
HTTP Response Code Unique Code Description

500

1020

An internal server error has occurred.

Response Description

A List of WinCollectAgentDTOs.
  • id - Integer - The ID of the WinCollect destination.
  • name - String - The name of the WinCollect destination.
  • host - String - The IP or hostname of the WinCollect destination. WinCollect agents that use this destination send syslog event data to this host.
  • port - Integer - The listen port of the WinCollect destination. WinCollect agents that use this destination send syslog event data to this port.
  • transport_protocol - Enumeration - The protocol that is used to send event data to this WinCollect destination. Possible values are TCP or UDP.
  • event_rate_throttle - Integer - The events-per-second rate that is used to throttle the event flow to this destination.
  • internal - Boolean - Set to 'true' if the destination corresponds to a QRadar event collector process from this deployment; otherwise, it is set to false if it is any other host.

Response Sample


[
    {
        "event_rate_throttle": 42,
        "host": "String",
        "id": 42,
        "internal": true,
        "name": "String",
        "port": 42,
        "tls_certificate": "String",
        "transport_protocol": "String <one of: UDP, TCP, TLS, UNKNOWN>"
    }
]