Difference between collecting logs with winlogbeat and wazuh

Enviro

Hi,
How can I modify wazuha to collect me, a specific event id?
I noticed that winlogbeat collects me all events from eventlog while wazuh collects me only selected ones.

Where should I change the configuration if I want to add collecting a new event id, on the server - wazuh manager or locally on the agent?

SzymonC

Hi,

I'm not sure if I understand your question fully, but let me try to answer to best of my knowledge. Please feel free to correct me if it you'll still have doubts or further questions.

Wazuh in itself isn't a solution for Log Management, but for scenario-based security monitoring. This means that Wazuh while might read the data and even analyze it, it doesn't store exact copy of that data in the system. Data monitored by Wazuh goes through something called Decoders and later through Rules. After that, the data you see in Wazuh is just a result of analysis.

For exactly that reason Energy Logserver supports multiple of agents, including beats agents. Beats agents are used for Log Management monitoring, meaning they literally copy data from source system (Windows in your case) and sends that copy to Energy Logserver. Then after ELS receives that data, it goes through parser normalization, enrichment and other tasks, before being finally saved in the database and view by the user in UI. 🙂

I hope that clarified the different purposes of those two agents a little. If not, I'll be happy to help you with next questions.