Installation or Removal

Installation

Warning

EventHorizon is self-signed (NOT signed by Microsoft). As such, EventHorizon requires that you disable secure boot and turn on test signing mode in order to use it. Do not use this in a production environment.

1. Download the EventHorizon.msi installer from the releases tab
2. Run the following command on the machine you intend to install EventHorizon on and reboot it

bcdedit /set testsigning on

3. Run the installer as an account with administrative privileges
   • Choose C:\Program Files\EventHorizon\ (the default location) for the installation - I intend on making other locations possible in the future, but as of now EventHorizon will not work in other locations

To verify that the service was correctly installed, run the following commands:

Get-Service EventHorizon
Get-Service EventHorizonELAM

Both services should be running!

Now that EventHorizon is installed, you need to configure it to collect the telemetry you want and provide relevant detection rules.

If your installation failed, please check out the troubleshooting section of the wiki!

If:

1. The troubleshooting section of the wiki doesn't work
2. There isn't an issue open with the same problem
3. Googling the issue doesn't help

Then feel free to open an issue!

Removal

Because EventHorizon is packaged as a .msi file, you can easily uninstall it from Windows settings!

1. Go to the Windows search bar and enter Add or Remove Programs and select the option that appears
2. Scroll through the menu or use the search bar to find the EventHorizon entry
3. Click on the 3 dots on the EventHorizon entry
4. Click Uninstall
5. Reboot to finish removal