Anyone who has configure osquery to send results to s3? can we have a call?
below is my config and still results are not flowing into aws 😐
config:
spec:
host_settings:
enable_software_inventory: true
vulnerability_settings:
databases_path: /tmp/
options:
host_identifier: hostname
schedule_splay_percent: 10
logger_plugin: aws_kinesis,aws_firehose
aws_kinesis_stream: fleetosquery****
aws_firehose_stream: fleetosquery***
aws_access_key_id: *********
aws_secret_access_key: *********
aws_region: eu-west-2
disable_carver: false
pack_delimiter: /
proxy_hostname:
**
carver_block_size: 2097152
logger_tls_period: 10
distributed_plugin: tls
disable_distributed: false
logger_tls_endpoint: /api/osquery/log
distributed_interval: 10
carver_start_endpoint: /api/v1/osquery/carve/begin
carver_disable_function: false
carver_continue_endpoint: /api/v1/osquery/carve/block
distributed_tls_max_attempts: 3
schedule:
time:
query: SELECT * FROM time;
interval: 2
removed: false
osquery:
osquery_result_log_plugin: kinesis
osquery_status_log_plugin: kinesis
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT hostname AS hostname FROM system_info;
overrides: {}