Depending upon your platform find the setup file below: https://www.elastic.co/downloads/beats/auditbeat Unzip the file, rename it to Auditbeat and copy the unzipped folder to C:\Program Files as below: Auditbeat 2. Open Powershell with Administrator privileges, and type the following: In case of code execution restriction, please check my post here . Once the installation is successful, modify the C:\Program Files\Auditbeat\auditbeat.yml file to establish the connection with Elastic Cloud tenant we created above. Scroll down and un-comment: "cloud-id" to enter the following: cloud.id: " Deployment:Cloud ID " cloud.auth: "username:<password>" I have masked the Cloud ID and password details for my deployment (Deployment-1) Enter the following commands in Powershell to load Kibana dashboards. The setup is ready.. Check on Kibana if the Windows Audit logs are getting populated in Kibana. The logs can be found by clicking on the compass icon in