Configure your shippers
Any Beats-protocol sender can point at the deployment's Beats listener over TLS. In the shipper configuration:
output.logstash:
hosts: ["ingest.xdr.example.com:<beats port>"]
ssl.certificate_authorities: ["/etc/xenxdr/ca.crt"]
Use the ingest CA certificate from your deployment bundle. A plaintext listener is available for trusted segments.
What gets normalised
winlogbeat events are mapped from the Windows Event Log structure, including Sysmon and Defender channels, into the canonical schema. filebeat events from system modules are mapped the same way. Custom filebeat inputs arrive with their fields under the fields map and the message in message; write a detection on them as you would on any other source.
Sender identity
Beats senders are identified by the certificate handshake and by the agent.name and host.name fields they send. If you run your own fleet with a shared configuration, set fields.org to the organization identifier so that events land in the right tenant; XenXDR honours it for Beats senders that authenticated with the ingest CA.