winlogbeat.yml

cloud.id: "${CLOUD_ID}"
cloud.auth: "elastic:${CLOUD_AUTH}"

winlogbeat.event_logs:
  - name: Application
    ignore_older: 72h

  - name: System

  - name: Security
    processors:
      - script:
          lang: javascript
          id: security
          file: ${path.home}/module/security/config/winlogbeat-security.js

  - name: Microsoft-Windows-Sysmon/Operational
    processors:
      - script:
          lang: javascript
          id: sysmon
          file: ${path.home}/module/sysmon/config/winlogbeat-sysmon.js

setup.template.settings:
  index.number_of_shards: 1
  index.number_of_replicas: 1

processors:
  - add_host_metadata:
      netinfo.enabled: true
  - add_cloud_metadata: ~

output.elasticsearch:
  hosts: ["localhost:9200"]
  pipeline: windows_geo_mitre


xpack.monitoring.enabled: true