A step-by-step guide on connecting a Windows endpoint to Wazuh. Learn how to add a Windows agent and collect logs.

In the previous guide, I deployed the Wazuh SIEM platform on Kali Linux using Docker. The platform is now operational and ready to receive security events from endpoint systems.

In this article, I extend the SOC lab by installing the Windows agent and connecting it to the Wazuh server.

Agents allow Wazuh to collect security telemetry (logs) from endpoints such as operating systems, applications, and system logs.

Using the agent, the Wazuh server can monitor events such as:

• Authentication activity
• File integrity changes
• Malware detection events
• System configuration changes
• Suspicious behavior on endpoints
• And more…

By the end of this guide, the Windows machine will begin sending logs to the Wazuh platform, allowing the SIEM to detect and analyze potential security events. If you haven’t set up a Windows VM yet, you can set that up using my previous guide 👇