Set up Windows Event Collector as an ingest method
Step 1 - Create a Windows Event Collector ingest token
Why? Ingest tokens authenticate and authorize Windows Event Collector instances to send data to your repository. They control which parsers can be used and what fields can be populated from event data.
Detailed steps:
Sign in to Falcon LogScale, and browse to your repository.
Click Settings, Ingest Tokens.
Click Add token.
Type in a descriptive name (for example, wec-windows-event-logs).
Set the appropriate permissions:
Assign parser to allow automatic parser selection based on event data
Assign fields to enable field creation from event metadata and data
Click Create token to save the token and securely store the generated string - you'll need this when configuring WEC.
Important
The following steps are provided as a general guide to configuring Windows Event Logs for use with LogScale. The following example describes using Windows Event Collector (WEC) to collect and send logs, but other third-party collectors (such as Winlogbeat) might be also be used in your environment. Also as these third-party systems are updated independently, some steps, options, or UI elements may differ between what is shown below, and what you see in your environment.
If you encounter discrepancies, refer to the vendor's official documentation for the most up-to-date instructions.
Step 2 - Configure Windows Event Collector
Why? Proper configuration of WEC ensures that Windows events are collected and forwarded to LogScale.
Detailed steps:
Install and configure WEC on a Windows server:
Use the Windows Event Collector (WEC) service
Configure subscriptions to collect events from remote computers
Configure WEC to forward events to LogScale:
Use the HTTP or HTTPS output plugin
Set ingest token and LogScale endpoint
Step 3 - Test and verify
Why? Testing confirms that WEC is successfully collecting and forwarding Windows events to LogScale.
Detailed steps:
Trigger test events on remote computers:
Use Event Viewer or PowerShell to generate test events
Verify events are received by LogScale
In LogScale, browse to your repository and verify that:
Events are appearing with correct timestamps
Fields are parsed correctly according to your parser
Step 4 - Monitoring and maintenance
Why? Ongoing monitoring ensures the reliability and performance of your WEC ingestion pipeline.
What you should do:
Monitor event receipt and processing rates
Verify event data quality and accuracy
Review and adjust WEC configurations and subscriptions