Ojas
09/14/2022, 9:15 AMKathy Satterlee
09/14/2022, 3:34 PMOjas
09/15/2022, 2:28 AMKathy Satterlee
09/15/2022, 2:40 PMkinesis
and osquery
are server settings and need to be configured in the Fleet binary using command line flags, environmental variables or a config file.Ojas
09/15/2022, 2:44 PMKathy Satterlee
09/15/2022, 3:10 PMoptions
section, there are just some settings you're missing there. Check out the example here:
https://osquery.readthedocs.io/en/stable/deployment/aws-logging/Ojas
09/15/2022, 6:54 PMKathy Satterlee
09/15/2022, 7:12 PMagent_options
rather than as a server setting, you would add the necessary osquery flags (listed in the osquery docs listed above) to options
in the Fleet UI.Ojas
09/16/2022, 5:50 AMKathy Satterlee
09/16/2022, 4:09 PMfleetctl apply
? By passing a config file when starting the server? The format for those is all a little different.Ojas
09/16/2022, 4:17 PMKathy Satterlee
09/16/2022, 4:35 PMconfig:
options:
host_identifier: hostname
schedule_splay_percent: 10
logger_plugin: aws_kinesis,aws_firehose
aws_kinesis_stream: fleetosquery****
aws_firehose_stream: fleetosquery***
aws_access_key_id: *********
aws_secret_access_key: *********
aws_region: eu-west-2
disable_carver: false
pack_delimiter: /
proxy_hostname: **
carver_block_size: 2097152
logger_tls_period: 10
distributed_plugin: tls
disable_distributed: false
distributed_interval: 10
carver_start_endpoint: /api/v1/osquery/carve/begin
carver_disable_function: false
carver_continue_endpoint: /api/v1/osquery/carve/block
distributed_tls_max_attempts: 3
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT hostname AS hostname FROM system_info;
schedule:
time:
query: SELECT * FROM time;
interval: 2
removed: false
overrides: {}
The properties you're setting here are all part of agent_options
. You can use agent_options.config
to set up the osquery configuration for your hosts. You don't have to include agent_options
itself because that's the section you're editing.
I hope that helps! Try applying those options and enrolling a new host. If things don't start passing through, check AWS and the host logs to see if there's any interesting data there.Ojas
09/16/2022, 7:19 PM