Configure Winlogbeat

Before you begin, you’ll need: Winlogbeat 7 or Winlogbeat 6

Configure Windows Defender audit permissions

In the Windows taskbar search box, type “gpedit” and click Edit group policy. You’ll see the Local Group Policy Editor.

Local Group Policy Editor

In the left pane, select Windows Settings > Security Settings > Local Policies > Audit Policy. In the right pane, open Audit object access.

Audit object access Properties

Select Success and Failure, and click OK.

Back in the Windows taskbar search box, type “regedit” and click Registry Editor.

Windows Registry Editor

In the search bar at the top of the window, paste “Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender”.

In the left pane, right-click the Windows Defender folder, then click Permissions... to show Permissions for Windows Defender. Click Advanced to show Advanced Security Settings for Windows Defender.

Advanced Security Settings for Windows Defender

In the Auditing tab, click Add to show the Auditing Entry for Windows Defender dialog.

Click Select a principal to show the Select User or Group dialog.

Select User or Group

Type “Administrators” in the text box and click Check Names.

Now click OK to exit all those dialogs you just opened. 😬

Download the Logz.io certificate

Download the Logz.io public certificate to your machine.

We’ll place the certificate in C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt for this example.

Configure Windows input

If you’re working with the default configuration file, (C:\Program Files\Winlogbeat\winlogbeat.yml) clear the contents and start with a fresh file.

Paste this code block.

Replace <<SHIPPING-TOKEN>> with the token of the account you want to ship to.

winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h
  - name: System
  - name: Microsoft-Windows-Sysmon/Operational
  - name: Microsoft-Windows-Windows Defender/Operational
  - name: Microsoft-Windows-Windows Firewall With Advanced Security/Firewall

fields:
  logzio_codec: json
  token: <<SHIPPING-TOKEN>>
  type: wineventlog
fields_under_root: true

If you’re running Winlogbeat 7, paste this code block. Otherwise, you can leave it out.

# ... For Winlogbeat 7 only ...
processors:
  - rename:
      fields:
      - from: "agent"
        to: "beat_agent"
      ignore_missing: true
  - rename:
      fields:
      - from: "log.file.path"
        to: "source"
      ignore_missing: true
  - rename:
      fields:
      - from: "log"
        to: "log_information"
      ignore_missing: true
Add Logz.io as an output

If Logz.io isn’t the output, set it now.

Winlogbeat can have one output only, so remove any other output entries.

Replace <<LISTENER-HOST>> with your region’s listener host (for example, listener.logz.io). For more information on finding your account’s region, see Account region.

output.logstash:
  hosts: ["<<LISTENER-HOST>>:5015"]
  ssl:
    certificate_authorities: ['C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt']
Restart Winlogbeat

Open PowerShell as an admin and run this command:

Restart-Service winlogbeat
Check Logz.io for your logs

Give your logs some time to get from your system to ours, and then open Kibana.

If you still don’t see your logs, see log shipping troubleshooting.