BLUE TEAM / SIEM / HOME LAB ยท OCTOBER 2026

Validating Windows Event Collection with Wazuh

A hands-on lab to trace a controlled Windows event from the endpoint into Wazuh archives, enable Filebeat archive shipping, and verify the event is searchable in the indexer.

7 min read Wazuh / Windows EventChannel Filebeat / Indexer

Goal

I wanted to verify more than whether an endpoint appeared as connected. The goal was to generate a known Windows Application event, trace it through the SIEM pipeline, and prove that the raw event could be searched in the indexer.

Lab environment

  • Wazuh 4.14.8 single-node deployment running in Docker Desktop with WSL2.
  • Windows endpoint monitored by the Sathish-Windows-Lab agent (ID 001).
  • Wazuh manager, Filebeat, Wazuh Indexer, and dashboard.

Generate a controlled test event

I used Windows eventcreate to write an informational event into the Application log. The unique marker made it straightforward to distinguish the test record from unrelated telemetry.

eventcreate /T INFORMATION /ID 100 /L APPLICATION /SO MDRLab /D "MDR-LAB-002 controlled telemetry test"

I then verified the record locally and confirmed that the Wazuh manager received it in its JSON archive. The event was parsed by the windows_eventchannel decoder and associated with agent 001.

Troubleshoot the archive pipeline

The first issue was in Filebeat's Wazuh module configuration: alerts shipping was enabled, but the archives fileset was disabled. That explained why raw events were present on the manager but the archive index was not available for searching.

filebeat.modules:
  - module: wazuh
    alerts:
      enabled: true
    archives:
      enabled: true

I backed up the configuration, enabled the archives fileset in the persistent Docker named volume, validated the configuration with filebeat test config, and restarted the Filebeat process under its supervisor. The Filebeat log then reported that both alerts and archives were enabled.

Verify the indexed event

The Wazuh Indexer created the daily archive index wazuh-archives-4.x-2026.10.11. Searching by the marker returned the controlled event. A provider-specific query returned one matching record with these fields:

  • Provider: MDRLab
  • Windows event ID: 100
  • Channel: Application
  • Agent: Sathish-Windows-Lab / 001
  • Decoder: windows_eventchannel
  • Event time: 2026-10-11T19:29:13.998Z

The broad marker query returned two documents because the search also matched an agent-started record. Filtering by the provider isolated the exact test event.

What this demonstrated

  • Windows Application event collection from an active Wazuh agent.
  • Tracing a record through manager-side JSON archives.
  • Diagnosing a disabled Filebeat archives fileset.
  • Validating configuration and confirming the raw event is searchable in the indexer.
IMPORTANT SCOPE NOTE
This was a controlled home-lab telemetry test. It validates the collection and indexing path for this event; it is not a production SOC incident or proof that every future event will be indexed.

Lessons and next steps

Configuration changes need to be made in persistent sources, not just inside a running container. I also documented the storage implications of broad raw-event logging: logall_json can retain more telemetry than alert-only collection, so retention and lab cleanup matter. The next step is to repeat the test after container recreation and document persistence, then run a separate safe detection exercise and record its rule ID and triage evidence.

Back to Blog