Jason NG
08/04/2021, 3:20 AM# Server
--tls_hostname=<http://osquery-demo.com:8080|osquery-demo.com:8080>
--tls_server_certs=/etc/osquery/fleet.pem
# Enrollment
--host_identifier=instance
--enroll_secret_path=/etc/osquery/secret.txt
--enroll_tls_endpoint=/api/v1/osquery/enroll
# Configuration
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=10
# Live query
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
# Logging
--logger_plugin=kafka_producer
--logger_kafka_brokers=<name>.<http://kafka.ap-southeast-1.amazonaws.com:9094,<name>.kafka.ap-southeast-1.amazonaws.com:9094|kafka.ap-southeast-1.amazonaws.com:9094,<name>.kafka.ap-southeast-1.amazonaws.com:9094>
--logger_kafka_topic=AWSKafkaTutorialTopic
--logger_kafka_acks=0
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
# File carving
--disable_carver=false
--carver_start_endpoint=/api/v1/osquery/carve/begin
--carver_continue_endpoint=/api/v1/osquery/carve/block
--carver_block_size=2000000
theopolis
08/07/2021, 2:26 AM