Defense.com

Winlogbeat is an agent which collects Windows Event Logs and sends them to our SIEM platform for analysis. This software differs from the log collector we asked you to configure.

During your SIEM onboarding, our Platform Engineering team will send you a deployment pack containing all of the software you need for us to start collecting your logs. This pack will contain a folder called winlogbeat, which is what you'll need for this guide.

If you haven't already done so, copy the Winlogbeat folder from the deployment pack to the Desktop on your Windows device.

<a href="https://docs.microsoft.com/en-us/powershell/scripting/windows-powershell/starting-windows-powershell?view=powershell-7.2#with-administrative-privileges-run-as-administrator" rel="nofollow noopener noreferrer" target="_blank">Open a PowerShell prompt as an administrator</a>

In PowerShell navigate to the Winlogbeat folder and run the following command to start the installation:

Note: if script execution is disabled on your system, run the below command to change the execution policy and allow the script to run:

Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process

Follow the onscreen prompt to enter your collector's IP address. 

Winlogbeat will be downloaded. installed and configured.

___________________________________________________________

That's it! 🎉 Winlogbeat should start forwarding logs to your collector, please contact us to verify if we're receiving your logs.

1. If you haven't already done so, copy the Winlogbeat folder from the deployment pack to the Desktop on your Windows device.
 
2. <a href="https://docs.microsoft.com/en-us/powershell/scripting/windows-powershell/starting-windows-powershell?view=powershell-7.2#with-administrative-privileges-run-as-administrator" rel="nofollow noopener noreferrer" target="_blank">Open a PowerShell prompt as an administrator</a>
 
3. In PowerShell navigate to the Winlogbeat folder and run the following command to start the installation:
 
 .\winlogbeat-install.ps1
 
 Note: if script execution is disabled on your system, run the below command to change the execution policy and allow the script to run:
 
 Set-ExecutionPolicy -ExecutionPolicy Bypass -Scope Process
 
4. Follow the onscreen prompt to enter your collector's IP address. 
 
 
 
5. Winlogbeat will be downloaded. installed and configured.
 
 
 
6. The winlogbeat service will start.
 
 ___________________________________________________________
 
 That's it! 🎉 Winlogbeat should start forwarding logs to your collector, please contact us to verify if we're receiving your logs.

This guide will walk you through installing the winlogbeat agent on Windows, for use with our SIEM service.

Installation