Winlogbeat Cannot Edit winlogbeat.example.yml

[Ryan8bit]

How do I edit winlogbeat.example.yml? I am trying to follow https://www.youtube.com/watch?v=Xz-7oDrZdQY
I am trying to run winlogbeat. How do I run winlogbeat?

[cm-ops]

Are you also following https://docs.securityonion.net/en/latest/beats.html#winlogbeat?

[InfosecGoon]

If you're having difficulty editing the winlogbeat.example.yml file to make winlogbeat.yml, the issue may be permissions-related; you need to be running the editor as an Administrator user to edit those files. Try running Wordpad as an Administrator, then open the files from inside the editor.

[Ryan8bit]

Where do I put the winlogbeat.yml file to actually use that file when I start the elastic winlogbeat oss service?

[Ryan8bit]

The VMnet8 IP address?

[InfosecGoon]

You're trying to send the Winlogbeat traffic to the Logstash container on your Security Onion server, so you would want to put the IP address of the Security Onion management interface into the Logstash output configuration in winlogbeat.yml.

[Ryan8bit]

How do I find out the IP address of the Security Onion management interface?

[Ryan8bit]

Is this the IP address using to log into the Security Onion Console?

[Ryan8bit]

Thanks both of you for your help!
The IP address used to log into the Security Onion Console is the correct ip address (the IP address of the Security Onion Management Node).