add filebeat sned test logs

README.md

@@ -223,6 +223,23 @@ OLLAMA_MODEL=llama3.1 OLLAMA_TIMEOUT=300 fgai analyze-logs --logs logs/fg_syslog
 
 ## Optional FortiGate Input
 
+## Synthetic Windows Test Input
+
+For testing a Graylog Beats input without a Windows host, generate Windows
+Security-style JSONL events locally, then use Filebeat to ship them over TCP:
+
+```bash
+python scripts/generate_windows_events.py --interval 0.5
+filebeat -e -c examples/filebeat-windows-synthetic.yml
+```
+
+Update the absolute JSONL path and Graylog host in the Filebeat template first.
+Route `stream_hint: Windows` to a dedicated Graylog stream, then enable that
+stream in SignalScope and configure a profile such as entity `user` or
+`source_ip`, categorical `event_id`, `status`, `logon_type`, and numeric fields
+when present. Filebeat uses its Logstash output to communicate with Graylog's
+Beats input on TCP `5044`. [Graylog Beats input documentation](https://go2docs.graylog.org/current/getting_in_log_data/beats_input.html)
+
 For logs, configure FortiGate syslog to write into a local file such as `logs/fg_syslog.jsonl`. The parser supports common key/value syslog lines and JSONL.
 
 For policies, export a FortiOS config backup and pass it to `audit-policies`.