Skip to main content

How to install Winlogbeat on Windows

This guide will walk you through installing the Winlogbeat agent on Windows, for use with our SIEM service.

Alan Butcher avatar
Written by Alan Butcher
Updated over 3 weeks ago

Before you get started

Before beginning the integration, you will need to deploy a log collector within the same network as the devices you're deploying Winlogbeat to.

To initiate the collector deployment process, please reach out to our Technical Support team, who'll provide you with a deployment pack that includes all the software and scripts needed to configure this. This pack will also contain a folder called winlogbeat, which is needed to complete the steps included in this guide.

If you already have a log collector deployed, please follow the steps outlined below.

Installing Winlogbeat

  1. Extract the winlogbeat folder from the deployment pack to a location on your Windows server

  2. Open a PowerShell prompt as an administrator

  3. In PowerShell, navigate to the winlogbeat folder and run the following command to start the installation: .\winlogbeat-install.ps1

  4. If script execution is disabled on your system, run the command below to change the execution policy and allow the script to run: Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process

  5. Winlogbeat will then be downloaded, installed and configured.

Confirming log flow

Once the above steps are complete, your device will now ship logs to our SIEM platform via your collector. You can confirm logs are successfully reaching our SIEM by either.

  1. Navigating to the Log Search feature in Defense.com by browsing to SIEM > Log Search and then filtering the logs by type:"winlogbeat"

  2. Reaching out to our Technical Support team, who'll be able to check and confirm this for you

And that's it! You've successfully installed Winlogbeat🎉

Did this answer your question?