Beats Global Config

This subsection contains settings which affect the global behavior of Beats Agents.

If your agents Event Sources config option is set to Inherited from Beats Global Config, it will inherit Event Sources option from this menu.

If your agent does not have a filter set explicitly, it will automatically retrieve the filter settings from this menu.

Available options:

Validate server certificate: agent will validate LM certificate

Make sure that your machine endpoints trust the LM web certificate – otherwise,\ enabling this option will cause agents to drop connection with LM. This certificate can be found in System > SSL settings > SSL Certificates.
Agent auto update: whenever there is a new Logmanager Orchestrator version available, with this option enabled, it will automatically be distributed

Only packages with self-update will work with this option.
Event sources:
- All event sources: pull all Windows Events (Event Viewer > Windows Logs folder and Event Viewer > Application and Services Logs folder)
  
  Choosing this option will make the agent send every event generated on the endpoint. Consider applying a filter to limit the amount of collected events.
- System event sources: pull only System Events (Event Viewer > Windows Logs folder only)
Filter – winlogbeat/filebeat: select a user-defined filter from a drop-down list. Filters are described in chapter Beats Filters. This filter will be applied to all winlogbeat/filebeat agents.

If you set both this filter and a global filter, they both get applied.

There is also the button Download Logmanager Orchestrator installation package. Click it to download the latest version of Logmanager Orchestrator.