Connect Windows Endpoints (Winlogbeat)

If your Windows fleet does not run the Splunk Universal Forwarder, use Winlogbeat as the shipper instead of the Splunk UF. Sysmon remains the collector; Winlogbeat reads the same Sysmon channel and ships to the appliance's Kafka listener on TCP 29092.

%%{init: {"theme":"base","themeVariables":{"fontFamily":"Roboto, Helvetica, Arial, sans-serif","fontSize":"15px","lineColor":"#8B6DB8","clusterBkg":"#FAF7FE","clusterBorder":"#D9C9F0","edgeLabelBackground":"#FFFFFF"},"flowchart":{"curve":"basis","nodeSpacing":50,"rankSpacing":80,"padding":16}}}%%
flowchart LR
    subgraph EP[" Windows endpoint "]
        direction LR
        SM["<b>Sysmon</b><br><small>collector</small>"]
        EVT[("Windows event log<br><small>Sysmon/Operational</small>")]
        WB["<b>Winlogbeat</b><br><small>shipper</small>"]
        SM -- "writes events" --> EVT
        EVT -- "read by" --> WB
    end
    K[["<b>App Node</b><br><small>Kafka listener</small>"]]
    WB -- "sysmon-logs · TCP 29092" --> K

    classDef collector fill:#E8F1FC,stroke:#3B82C4,stroke-width:2px,color:#12324F
    classDef store fill:#FFF6E5,stroke:#D9922B,stroke-width:2px,color:#4A3208
    classDef shipper fill:#EFE6FB,stroke:#7A3FBF,stroke-width:2px,color:#2D0A6B
    classDef sink fill:#E4DAF6,stroke:#5B1FA8,stroke-width:3px,color:#2D0A6B
    class SM collector
    class EVT store
    class WB shipper
    class K sink

One shipper per host

Run either Winlogbeat or the Splunk UF on a given endpoint, never both — each ships the same Sysmon channel, and running both duplicates every event in the detection pipeline.

Run all of the commands below in an Administrator PowerShell session on the endpoint.

---

Step 1 — Install Sysmon (the collector)

Identical to the Splunk UF path — follow Step 1 of Connect Windows Endpoints, then return here.

---

Step 2 — Install and configure Winlogbeat

Download Winlogbeat

cd C:\
Invoke-WebRequest -Uri "https://artifacts.elastic.co/downloads/beats/winlogbeat/winlogbeat-8.17.0-windows-x86_64.zip" -OutFile winlogbeat.zip
Expand-Archive -Path winlogbeat.zip -DestinationPath "C:\Program Files"
Rename-Item "C:\Program Files\winlogbeat-8.17.0-windows-x86_64" "C:\Program Files\Winlogbeat"

Configure Winlogbeat

Replace C:\Program Files\Winlogbeat\winlogbeat.yml with the baseline Logster ships — winlogbeat.yml — then set the Kafka hosts value to your appliance's EXTERNAL_KAFKA_LAN_HOST.

Note

This configuration targets the appliance's plaintext Kafka listener on port 29092. If you deployed Logster on OpenShift, use winlogbeat-openshift.yml instead — it ships to the Kafka bootstrap route on port 443 over TLS, with certificate validation disabled. See B6 — Ship endpoint logs to Logster.

The full file, for reference:

# ======================== Winlogbeat Configuration ============================

winlogbeat.event_logs:
  - name: Microsoft-Windows-Sysmon/Operational
    processors:
      - add_fields:
          target: host
          fields:
            name: ${COMPUTERNAME}

# ======================== Processors ==========================================

processors:
  - add_host_metadata:
      when.not.contains.tags: forwarded
  - add_fields:
      target: ''
      fields:
        host.hostname: ${COMPUTERNAME}

# ======================== Outputs =============================================

# Disable Elasticsearch output
output.elasticsearch:
  enabled: false

# Enable Kafka output
output.kafka:
  enabled: true
  hosts: ["<app-node>:29092"]   # <-- set to your App Node's EXTERNAL_KAFKA_LAN_HOST IP
  topic: "sysmon-logs"
  partition.round_robin:
    reachable_only: true
  required_acks: 1
  compression: gzip
  codec.json:
    pretty: false
    escape_html: false

# ======================== Logging =============================================

logging.level: info
logging.to_files: true
logging.files:
  path: C:\Program Files\Winlogbeat\logs
  name: winlogbeat
  keepfiles: 7
  permissions: 0640

Install and start the service

cd "C:\Program Files\Winlogbeat"
powershell -ExecutionPolicy Bypass -File .\install-service-winlogbeat.ps1
Start-Service winlogbeat
Get-Service winlogbeat

Get-Service winlogbeat should report Running. Within a minute or two the endpoint appears on the Logster Console (http://<app-node>:5001).

---

Endpoint not appearing on the console?

• Confirm Sysmon is running on the endpoint and writing to its Microsoft-Windows-Sysmon/Operational log.
• Confirm exactly one shipper is installed and running (winlogbeat or SplunkForwarder, not both).
• Confirm the endpoint can reach <EXTERNAL_KAFKA_LAN_HOST>:29092, and check the Winlogbeat logs at C:\Program Files\Winlogbeat\logs for output errors.
• Check firewalls between the endpoint and the appliance.