My first foray into the Security SIEM seems is going to be with the prodigal ELK stack. Keeping the discussion later, w.r.t. the pros, cons and features of ELK, let's dive into our first implementation (integration of Windows Server with ELK) For testing purpose, I have created a 14 day free trial that ELK offers. Go to https://elastic.co Select Try Free Scroll down to find ElasticSearch and Click Launch on Elastic Cloud. It should ask for email details which needs to be verified. Create a Deployment. My deployment details are as below: Elasticsearch Deployment Click on the deployment to check the Cloud ID . Save this somewhere as this will be very crucial to direct traffic from endpoints to this Cloud Tenant Now, once the Cloud tenant is ready, let us install Winlogbeat on our Windows server to send Windows event logs to Kibana (ELK's GUI) Winlogbeat installation Download Winlogbeat from https://www.elastic.co/products/beats/winlogbeat Extract the contents of the zip file to