Thanks Rich, great link. It looks like this link is used when you want to run kibana on windows as a standalone, elasticsearch on windows and sysmon.

The thing is that I am using security onion where kibana, logstash and elasticsearch are installed on my VM. In this particular case, I am using sysmon to send data to logstash (on the VM) which then sends it to elasticsearch which sends it to kibana.

I do get data that looks like it is comming from sysmon, but the module in kibana shows windows_eventlogs. I just wonder if the name of the module sysmon has been replaced with the module name windows_eventlogs, or, is windows_eventlogs comming from somewhere else in windows?

thanks for your the link, very interesting.

thanks for the replies. I forgot to add the access IP address:

iqworks 20230425 - do not comment out setup.kibana

setup.kibana:

Kibana Host

Scheme and port can be left out and will be set to the default (http and 5601)

In case you specify and additional path, the scheme is required: http://localhost:5601/path

IPv6 addresses should always be defined as: https://[2001:db8::1]:5601

host: "292.168.1.216:5601"

sorry, that is not the complete message, dont know what happened. This is the important part:

*host: "292.168.1.216:5601"*

  iqworks 20230425 - do not comment out setup.kibana
setup.kibana:
 
  Kibana Host
  Scheme and port can be left out and will be set to the default (http and 5601)
    In case you specify and additional path, the scheme is required: http://localhost:5601/path
    IPv6 addresses should always be defined as: https://[2001:db8::1]:5601
    *host: "292.168.1.216:5601"*