Microsoft Windows Event Log

Our Integration guide was accurate at the time of writing but vendors change things frequently! If you find errors or anything is outdated, let us know by raising a request in the Samurai Help Center and we shall get it updated.

Use this document to install and configure the Winlogbeat agent to send Microsoft Windows Event Logs to Samurai using the Samurai Local Collector deployed in your network.

To complete this Integration you will need to:

1. Ensure the Samurai Logstash Integration is installed on the desired local collector
2. Ensure correct network connectivity
3. Download & install Winlogbeat
4. Configure & Start Winlogbeat

This guide is based on the premise of a single Samurai Local Collector installation with deployment of a single Windows host. Repeat these steps outlined in this guide for each Windows host and site.

Ensure the Samurai Logstash Integration is installed on the desired local collector

Verify in the Samurai Application that the Samurai Logstash Integration is installed on the desired Samurai Local Collector:

1. Login to the Samurai MDR web application.
2. Click Integrations from the main menu.
3. Verify that an integration with Product set to the value Logstash exists on the desired collector. 
4. Note down the IP address of the Samurai Local Collector.  Click on the integration and then on the Collector name - this will take you to the Collector details where you will find the IP address. This will be used later when configuring the Beat-agent. 
   
   If no Logstash integration has been installed, use the following guide to have it installed: Samurai Logstash Integration.

Ensure correct network connectivity

You must ensure the following connectivity requirements are fulfilled:

Download & Install Winlogbeat

Perform the steps outlined in Step 1: Install Winlogbeat as per the vendor documentation.

Configure & Start Winlogbeat

1. Access the Winlogbeat installation folder and open and edit the file winlogbeat.yml.
2. Modify the below template by replacing the section IP_OF_LOCAL_COLLECTOR with the IP address of the Samurai Local Collector running the Samurai Logstash Integration collected in step Ensure the Samurai Logstash Integration is installed on the desired local collector
   

   # ======================== Winlogbeat specific options =========================
   winlogbeat.event_logs:
   - name: Application
   - name: System
   - name: Security
   - name: Microsoft-Windows-Sysmon/Operational
   
   # ------------------------------ Logstash Output -------------------------------
   output.logstash:
   hosts: ["IP_OF_LOCAL_COLLECTOR:5044"]

    Default recommendation is to ingest logs from Application, System, Security and Sysmon (if used and installed). Optionally, if you want to ingest other event logs, follow the vendor guidelines to find the correct event log names to use and modify the template accordingly.
   
   
3. Replace the default configuration of winlogbeat.yml with the modified template and save the file.
4. Perform the steps outlined in Step 5: Start Winlogbeat as per the vendor documentation to start the service.

 The section about authorized to publish events can be ignored.