Greetings Rico: Most of the work is done on the server side in /var/ossec/etc/ ossec.conf
On the Windows side, in the ossec folder, also modify the ossec.conf there for what log files you want to monitor and options. Be sure to stop and start the agent on the Windows side for the changes to be effective. Thank you.
