ok I finally bit the bullet and installed Security Onion. Is it possible to make a simple change to each deployed Fleet agent to get it to talk to Security Onion, or do I have to re-install the agents? On one hand it looks like I can add the enrol secret to the new Server and adjust the FQDN (maybe), on the other hand I haven’t found the .plist that might make this possible…

I am not too sure about Security Onion related stuff probably @defensivedepth can shed some light there..but the plist is usually in

Library/LaunchDaemons/com.fleetdm.orbit.plist

Security Onion uses Kolide Launcher, not FleetDM Orbit, so that plist won't work. @Adam Connor Best thing to do is post on the Security Onion discussions --> SecurityOnion.net/Discuss

thanks will do- it’s ‘only’ a 60mb package, but in my day, before electricity…

yep, I hear ya