diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index ecc53958027..0e373c7b588 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -78,6 +78,7 @@ https://github.com/elastic/beats/compare/v8.8.1\...main[Check the HEAD diff]
 - Fix config validation for CEL and HTTPJSON inputs when using password grant authentication and `client.id` or `client.secret` are not present. {pull}38962[38962]
 - Updated Websocket input title to align with existing inputs {pull}39006[39006]
 - [threatintel] MISP splitting fix for empty responses {issue}38739[38739] {pull}38917[38917]
+- Restore netflow input on Windows {pull}39024[39024]
 
 *Heartbeat*
 
diff --git a/x-pack/filebeat/input/default-inputs/inputs_windows.go b/x-pack/filebeat/input/default-inputs/inputs_windows.go
index 361883f39ad..821131c8bc2 100644
--- a/x-pack/filebeat/input/default-inputs/inputs_windows.go
+++ b/x-pack/filebeat/input/default-inputs/inputs_windows.go
@@ -21,6 +21,7 @@ import (
 	"github.com/elastic/beats/v7/x-pack/filebeat/input/http_endpoint"
 	"github.com/elastic/beats/v7/x-pack/filebeat/input/httpjson"
 	"github.com/elastic/beats/v7/x-pack/filebeat/input/lumberjack"
+	"github.com/elastic/beats/v7/x-pack/filebeat/input/netflow"
 	"github.com/elastic/beats/v7/x-pack/filebeat/input/o365audit"
 	"github.com/elastic/beats/v7/x-pack/filebeat/input/shipper"
 	"github.com/elastic/elastic-agent-libs/logp"
@@ -41,5 +42,6 @@ func xpackInputs(info beat.Info, log *logp.Logger, store beater.StateStore) []v2
 		lumberjack.Plugin(),
 		shipper.Plugin(log, store),
 		etw.Plugin(),
+		netflow.Plugin(log),
 	}
 }