Skip to main content

Sysmon (System Monitor) via Winlogbeat

Sysmon (System Monitor) is a Windows system service that monitors and logs system activity of the Windows event log. It tracks process creations, network connections, and changes to file creation time.

Before you begin, you'll need:

Download the public certificate

Download the public certificate to C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt on your machine.

Configure Windows applications as an input

If you're working with the default configuration file, clear the content and start with a fresh file. (The location may be C:\ProgramData\Elastic\Beats\winlogbeat\winlogbeat.yml or C:\Program Files\Winlogbeat\winlogbeat.yml, depending on where you installed it.)

Paste this code block:

File Content:
- name: Microsoft-windows-sysmon/Operational
ignore_older: 72h
logzio_codec: json
type: wineventlog
fields_under_root: true
- rename:
- from: "agent"
to: "beat_agent"
ignore_missing: true
- rename:
- from: "log.file.path"
to: "source"
ignore_missing: true
- rename:
- from: "log"
to: "log_information"
ignore_missing: true
hosts: ["<<LISTENER-HOST>>:5015"]
certificate_authorities: ['C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt']

Replace the placeholders to match your specifics. (They are indicated by the double angle brackets << >>):

  • Replace <<LOG-SHIPPING-TOKEN>> with the token of the account you want to ship to.

  • Replace <<LISTENER-HOST>> with the host for your region. For example, if your account is hosted on AWS US East, or if hosted on Azure West Europe.


One last validation - make sure is the only output and appears only once. If the file has other outputs, remove them.

Restart Winlogbeat

Open PowerShell as an admin and run this command:

Restart-Service winlogbeat

Check for your logs

Give your logs some time to get from your system to ours, and then open Open Search Dashboards.

If you still don't see your logs, see Filebeat troubleshooting.