How to send windows logs to LogRhythm DP using Microsoft Sysmon?

Question

I want to transfer windows logs to LogRhythm SIEM, but I can't use logRhythm agent because it uses the PORT 445 which I don't want to open. I want to use Microsoft Sysmon. How to use it and which PORT it will use and is it secure?

I'm expecting a secure way to send Win Logs to LogRhythm SIEM

• Mathias R. Jessen: Sysmon is a system monitoring agent, not a log forwarding component
• Younes: so how to send logs collected by Sysmon to LogRhythm?
• Mathias R. Jessen: Optimal solution depends on why you won't give LogRhytm access to fetch the events over RPC. What are you trying to defend against?
• Younes: It's in the organisation's policies. Is there a way to transfer windows logs securely to logRhythm without using the port 445?
• Mathias R. Jessen: my own preference would be to use Windows' built-in event forwarding to centralize the events on a single box and the have LogRhythm collect them from that one box - then you only need a policy exception for 1 box instead of all of them :)