Winlogbeat - Integration Guide

This guide shows you how to forward Windows event logs into the Secure60 platform using Winlogbeat and a Secure60 Collector.

Overview

This guide explains how to collect Windows event logs with Winlogbeat and forward them to a Secure60 Collector that emulates a Logstash endpoint. Because the collector stands in for Logstash, there is no separate Logstash tier to run. If you have any further questions, don’t hesitate to contact Secure60 Support.

Install Winlogbeat

1. (Prerequisite) Install the Secure60 Collector
2. Download and install the Winlogbeat MSI from the official website
3. Modify the winlogbeat.yml configuration file located at: C:\Program Files\Winlogbeat\winlogbeat.yml with the following content:

output.logstash:
   hosts: ["<S60_COLLECTOR_IP_ADDRRESS>:5044"]
   ssl.verification_mode: none

Ensure you replace <S60_COLLECTOR_IP_ADDRESS> with the actual IP address of your Secure60 collector.

Note: ssl.verification_mode: none is required because the Secure60 Collector uses a self-signed certificate. The TLS handshake works, but Winlogbeat rejects untrusted certificates unless verification is disabled.

4. Start the Winlogbeat service

Start-Service winlogbeat

5. To test if Winlogbeat is connected with the collector, use the command:

.\winlogbeat.exe test output

If target machine connection is actively refusing (dial up ERROR), keep trying the command until it says dial up OK. This means Winlogbeat is finally connected with the collector, and logs will start showing up in the portal.

To check the status of Winlogbeat, use the command:

Get-Service winlogbeat

To restart the Winlogbeat service, use the command:

Restart-Service winlogbeat

Troubleshooting Notes

Ensure that:

• The Secure60 Collector is running and listening on port 5044.
• The Windows machine has internet access to reach the collector IP.
• Firewall rules allow inbound traffic on TCP 5044.
• If connection is still actively refusing, replace (ssl.verification_mode: none) with (ssl.enabled: false), then keep trying step 5. What this does is disable SSL in the Winlogbeat configuration file to prevent TLS handshake errors, since the Winlogbeat client requires a valid certificate.

Logs and alerts can be viewed in the Secure60 portal.