Sysmon (System Monitor) is a Windows system service that monitors and logs system activity of the Windows event log. It tracks process creations, network connections, and changes to file creation time.
Before you begin, you’ll need:
Winlogbeat 7 installed.
Download the Logz.io public certificate
Logz.io public certificate
on your machine.
Configure Windows applications as an input
If you’re working with the default configuration file, clear the contents and start with a fresh file. (The location may be
C:\Program Files\Winlogbeat\winlogbeat.yml, depending on where you installed it.)
Paste this code block:
File Content: winlogbeat.event_logs: - name: Microsoft-windows-sysmon/Operational ignore_older: 72h fields: logzio_codec: json token: <<LOG-SHIPPING-TOKEN>> type: wineventlog fields_under_root: true processors: - rename: fields: - from: "agent" to: "beat_agent" ignore_missing: true - rename: fields: - from: "log.file.path" to: "source" ignore_missing: true - rename: fields: - from: "log" to: "log_information" ignore_missing: true output.logstash: hosts: ["<<LISTENER-HOST>>:5015"] ssl: certificate_authorities: ['C:\ProgramData\Winlogbeat\COMODORSADomainValidationSecureServerCA.crt']
Replace the placeholders in the configuration
Still in the same configuration file, replace the placeholders to match your specifics.
<<LOG-SHIPPING-TOKEN>>with the token of the account you want to ship to.
<<LISTENER-HOST>>with your region’s listener host (for example,
listener.logz.io). For more information on finding your account’s region, see Account region.
One last validation - make sure Logz.io is the only output and appears only once. If the file has other outputs, remove them.
Open PowerShell as an admin and run this command:
Check Logz.io for your logs
Give your logs some time to get from your system to ours, and then open Kibana.
If you still don’t see your logs, see log shipping troubleshooting.