Title
#kolide
t

Travis

09/15/2021, 11:26 PM
Is there a way to get the kolide_decorations into the standard decorations field for log export? Or SEIM only sees the decorators but not the kolide_decorations. I can see if the SIEM (panther) can update their parser but since its built for standard OS_Query they may not want to change it
terracatta

terracatta

09/16/2021, 3:17 PM
Hi @Travis, so the reason we split them up is we felt wrong polluting the standard area osquery decorators would live, but in practice do you think (beyond your use-case) that is actually not a big deal? Or is there a way for us to structure it within the decorators key with prepending things with a special string to keep that obvious separation? Would love your thoughts, I just don't want to break other folks' assumptions about the log output.
t

Travis

09/16/2021, 4:21 PM
I think its more of enriching the standard decorators rather than polluting 🙂
terracatta

terracatta

09/16/2021, 4:22 PM
Ok! I think that perspective actually helps us make a decision. I'm going to chat with the team, but if we can make this happen we will, otherwise we will let you know.
t

Travis

09/16/2021, 4:22 PM
A sort of namespace for the kolide decorators would be a nice addition so they don't conflict with the default ones
4:22 PM
TY! Apreciate it