We've come to the end of this course, but we can do so much more with Winlogbeat.
For example, do you want to know how to configure a Kafka output?
What about enabling Kerberos support?
Well, the official documentation covers those subjects, and more.
Now, if you happen to be using Sysinternals Sysmon in your environment,
then you will benefit from using the Sysmon module
that comes installed with Winlogbeat.
The Sysmon module provides transformations and data
normalization using the Elastic Common Schema.
Additionally, suppose you want to filter or enhance your data.
In that case,
you can use one of several Winlogbeat processors, like the add_fields
processor that allows you to do as the name describes and add additional
fields to your data right before it's ingested into Elasticsearch. This last
resource covers an area near and dear to my heart,
the security surrounding the configuration of Winlogbeat. I
covered the keystore in this course; however,
there are other vital areas to consider.
The Elastic documentation covers securing Winlogbeat using some best
practices and includes specific areas like API access,
user management, and securing communications within the Elastic
Stack. Each resource I mentioned has an associated hyperlink,
and I've also included a reference document containing all links
in the course resources.
I hope you enjoyed this course.
If you have any questions about the content, please
let me know in the course comments.
Thanks for watching the Detecting Anomalies and Events with Winlog beat