How to Install Wazuh Agent on Windows + Windows Event Logs | Wazuh Tutorial Series

Learn how to install Wazuh Agent on Windows and start ingesting Windows Event Logs into Wazuh step by step. In this Wazuh Tutorial Series (covering the new Wazuh 5.x version) video, I’ll show you how to deploy the Wazuh Agent on a Windows machine, verify that the endpoint is connected correctly, and start collecting useful Windows security telemetry. Installing the Wazuh Agent is only the beginning. The real value comes from making sure your Windows endpoint is actually sending the logs you need into Wazuh. In this tutorial, you’ll learn how to: Install the Wazuh Agent on Windows Deploy and connect a Windows endpoint to your Wazuh server Verify that the Wazuh Agent is communicating correctly Start ingesting Windows Event Logs Enable process creation auditing Ingest Windows Event ID 4688 into Wazuh Monitor process execution on your Windows endpoint Start ingesting Microsoft Defender logs Verify that your Windows security logs are reaching Wazuh If you’re building a cybersecurity lab, learning Wazuh, working with SIEM technology, or simply want better visibility into what is happening on your Windows machines, this tutorial will take you beyond a basic Wazuh Agent installation. One of the key parts of the video is configuring Windows process creation logging using Event ID 4688. This allows you to see when processes are created on the endpoint, giving you much more useful visibility for security monitoring, threat detection, investigations, and blue-team analysis. We’ll also look at ingesting Microsoft Defender logs so that security events generated by Defender can be collected and analyzed inside Wazuh. This video is part of my *Wazuh Tutorial Series*. If you haven’t watched the previous video, where I show you how to install Wazuh using VirtualBox, I recommend starting there before continuing with this tutorial. ▶️ Previous video:    • How to Install Wazuh 5 on VirtualBox (Full...   📥 FREE RESOURCE: FREE Cybersecurity Career Guide PDF here: https://zerodave-security.kit.com/cyb... If you’re following the full Wazuh Tutorial Series, subscribe so you don’t miss the next part. In upcoming videos, we’ll continue building on this environment and explore more ways to collect, analyze, and use security telemetry inside Wazuh. Chapters: 00:00 - Intro 00:40 - Requirements 01:22 - Install the Wazuh Agent on Windows 04:05 - How to Ingest EventID 4688 in Wazuh 06:30 - How to Ingest Windows Defender Logs in Wazuh #Wazuh #CyberSecurity #WindowsSecurity #SIEM #defender #WindowsEventLogs #MicrosoftDefender --- Follow me: Website: https://zerodave.com LinkedIn:   / zerodave   GitHub: https://github.com/zerodavesec