WMI Agent (Windows)

The WMI Agent forwards Windows security events from on-premise or cloud hosts to your SIEM.

How it works:
1. A PowerShell script runs on the Windows host
2. It subscribes to WMI event classes (logon failures, process creates, service changes)
3. On each event it POSTs JSON to your SIEM webhook endpoint

Setup:
1. Security → Integrations → WMI Agent
2. Copy the installer script — your webhook URL and secret are pre-filled
3. Run on the Windows host as Administrator:
Set-ExecutionPolicy RemoteSigned -Scope CurrentUser
./turtini-siem-agent.ps1

The agent runs as a background scheduled task and survives reboots.
To remove: run the script with -Uninstall

Collected event types: logon/logoff, failed auth, privilege use, process creates, service state changes.