Can you collect Sysmon data from computer B and send it to computer A?

[iqworks]

Hi, I have two laptops. I have security onion installed on laptop A. I can see Sysmon data from that laptop in Kibana. I am wondering if I could install Sysmon and winlogbeat on laptop B and send that data to laptop A to see that data in Kibana?

thx

[dougburks]

Yes. From https://docs.securityonion.net/en/2.3/introduction.html (emphasis added):
In the diagram below, we see Security Onion in a traditional enterprise network with a firewall, workstations, and servers. You can use Security Onion to monitor north/south traffic to detect an adversary entering an environment, establishing command-and-control (C2), or perhaps data exfiltration. You’ll probably also want to monitor east/west traffic to detect lateral movement. As more and more of our network traffic becomes encrypted, it’s important to fill in those blind spots with additional visibility in the form of endpoint telemetry. Security Onion can consume logs from your servers and workstations so that you can then hunt across all of your network and host logs at the same time.

[iqworks]

thanks doug, will give this a try and will let you know my progress.