Click here for the most updated version of this documentation.
Blumira’s modern cloud SIEM platform integrates with WinLogBeat to detect cybersecurity threats and provide actionable response to remediate when a threat is detected.
WinLogBeat is a log shipper by Elastic that is primarly recommended by Blumira for WEF log collection on your main WEF server that logs are being forward to. However, it can also be used as an alternative to NXLog if there are issues with NXLog.
Get your free account with Blumira and secure your Microsoft 365 environment in minutes. No credit card required.
Use the Blumira integration with Winlogbeat to stream Windows event logs to Blumira for automated threat detection and actionable response. Winlogbeat is a log shipper that is primarily recommended for Windows event forwarding (WEF) from the main server where your Windows event logs are being collected. It can be used as an alternative to NXLog if you experience issues when using NXLog, but Poshim/NXLog is the preferred method of shipping Windows logs to Blumira.
Important: Do not use Poshim/NXLog and Winlogbeat together on the same system.
#======================= Winlogbeat specific options ========================== winlogbeat.event_logs: - name: ForwardedEvents ignore_older: 24h - name: Application ignore_older: 72h - name: Security - name: System #================================ General ===================================== # The name of the shipper that publishes the network data. It can be used to group # all the transactions sent by a single shipper in the web interface. name: <ip_of_host> #----------------------------- Logstash output -------------------------------- output.logstash: # The Logstash hosts hosts: ["<ip_of_your_sensor>:5044"]
cd "C:\Program Files\winlogbeat"
Powershell.exe -ExecutionPolicy Unrestricted -File install-service-winlogbeat.ps1
Status Name DisplayName ——– ——– —————– Stopped winlogbeat winlogbeat
Note: During troubleshooting, Blumira Support may need the contents from C:\ProgramData\winlogbeat\logs to determine if there are any communication issues.