Winglogbeat Firewall Rule

[aboundinginterest]

I am installing winlogbeat to ship logs to security onion, but it looks like sdo so-allow is not longer a command.

I also am checking firewall underneath the configuration in the management console but don't see a log stash option.

What group name does it fall under? Did anything else change for shipping winlogbeat logs?

[dougburks]

Are you using Security Onion 2.4? If so, then you should be using Elastic Agent instead of Winlogbeat:
https://docs.securityonion.net/en/2.4/elastic-agent.html