Windows Event / Sysmon
The Windows Event / Sysmon connector (windows_event, category edr) pulls Security + Sysmon events via a WEF collector and normalizes each into the AiSOC alert shape, mapping the source severity onto the five-tier ladder (info | low | medium | high | critical).
Setup
- In Connectors -> Add connector, choose Windows Event / Sysmon.
- Fill in the connection fields shown in the wizard (endpoint URL + API token; secrets are stored in the credential vault, never in plaintext).
- Click Test connection to verify credentials, then Save. The in-process scheduler begins polling on the default cadence.
Events flow through ingest (OCSF normalize) -> Kafka -> fusion, where detections fire and alerts are auto-triaged (copilot).
Configuration reference
| Field | Label | Type | Required | Default | Notes |
|---|---|---|---|---|---|
collector_url | Collector spool URL | string | yes | — | — |
api_token | Spool token | secret | yes | — | encrypted at rest |
verify_tls | Verify TLS certificate | boolean | no | True | — |
Credential handling
api_token is encrypted at rest by the credential vault before the row is written, and decrypted only at poll time. The value is never logged and never returned by the API. See credential vault.