Title
#general
e

Erfan

08/14/2020, 10:27 AM
Hey there, I want to test osquery with ELK ELK stack is ready and I want to test this on windows and ubuntu hosts Does Osquery send logs to logstash itself? or I need to send osquery logs from log file with filebeats?
Gavin

Gavin

08/14/2020, 11:20 AM
The second, https://github.com/dactivllc/osquery-in-a-box/ has a solid example of this.
e

Erfan

08/14/2020, 12:55 PM
In my scenario is kolide a mandatory? I dont need kolide fleet I just need to get log from osquery periodic queries
s

seph

08/14/2020, 1:03 PM
Osquery does not support logstash directly. You can have it write to local disk, and use filebeat as you suggested.
1:03 PM
You can use a TLS server (like fleet) to manage and consolidate.
e

Erfan

08/14/2020, 1:08 PM
Thank you, I dont need TLS in my environment So I should send the content in osqueryd.results.log with filebeats to logstash, am I right?
Stefano Bonicatti

Stefano Bonicatti

08/14/2020, 1:20 PM
That is the log which contains the query results only
1:22 PM
So yes if you're interested in that. Otherwise in the same folder where normally the results log end up to, there should also be message logs with their various levels (INFO, ERRORS)
e

Erfan

08/14/2020, 1:36 PM
What type of logs are stored in those files? Are they useful?
s

seph

08/14/2020, 1:43 PM
TLS isn't so much about TLS. It's the remote control protocol. Required if you want to use osquery's life query, or the native mechanism to distribute configuration. If you have other config management tools you can use them.
Gavin

Gavin

08/14/2020, 2:33 PM
Hi @Erfan I want to apologies for the confusion I thought this was posted in the Kolide channel and in haste responded I am happy you got the correct resolution.
e

Erfan

08/14/2020, 4:08 PM
Dear @seph I just need osquery for some periodical queries on my endpoints and have the results in json format on my elk stack Do I need kolide or configuration management tool also in this case ?
s

seph

08/14/2020, 5:06 PM
How will you get the configuration of the scheduled queries to your endpoints?
e

Erfan

08/14/2020, 8:21 PM
Our endpoints are windows 10 mostly and I think the Microsoft SCCM can do this task
s

seph

08/14/2020, 8:22 PM
No idea.
8:22 PM
But that’s the question you should work through.
8:23 PM
* What installs osquery. * Who maintains the osquery configuration * What distributes the osquery configuration * How are logs collected / aggregated * How are logs analyzed There’s no single answer here.
e

Erfan

08/14/2020, 8:32 PM
Yes, thanks for your asnwers My issue is on the last 2 items Now I will send logs to elk with beats to parse them and then see what issues will happen