Kibana showing windows_eventlog but not a sysmon module

[iqworks]

Hi, I finally got windows data into security onion. But I dont see sysmon categories?

But I do show windows_events?

are windows_events the same as sysmon maybe? not sure.

thanks for any suggestions or advice

[dougburks]

On your Windows host, did you install sysmon and configure winlogbeat to pick up the sysmon log?
https://docs.securityonion.net/en/2.3/sysmon.html
https://docs.securityonion.net/en/2.3/beats.html#winlogbeat

[iqworks]

HI Doug thanks for the links! I will review them. I am back on my other project right now, but will be back in a couple weeks.

[iqworks]

Hi Doug, I finally see SYSMON in kibana !!!! Those two links above where very helpful. I had to make my VM standalone and I think I needed to enter the host in setup.kibana.
Thanks very much