Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Title
e
Erfan
08/14/2020, 10:27 AMHey there,
I want to test osquery with ELK
ELK stack is ready and I want to test this on windows and ubuntu hosts
Does Osquery send logs to logstash itself? or I need to send osquery logs from log file with filebeats?
g
Gavin
08/14/2020, 11:20 AMThe second, https://github.com/dactivllc/osquery-in-a-box/ has a solid example of this.
e
Erfan
08/14/2020, 12:55 PMIn my scenario is kolide a mandatory?
I dont need kolide fleet
I just need to get log from osquery periodic queries
s
seph
08/14/2020, 1:03 PMOsquery does not support logstash directly.
You can have it write to local disk, and use filebeat as you suggested.
You can use a TLS server (like fleet) to manage and consolidate.
e
Erfan
08/14/2020, 1:08 PMThank you, I dont need TLS in my environment
So I should send the content in osqueryd.results.log with filebeats to logstash, am I right?
s
Stefano Bonicatti
08/14/2020, 1:20 PMThat is the log which contains the query results only
So yes if you're interested in that. Otherwise in the same folder where normally the results log end up to, there should also be message logs with their various levels (INFO, ERRORS)
e
Erfan
08/14/2020, 1:36 PMWhat type of logs are stored in those files?
Are they useful?
s
seph
08/14/2020, 1:43 PMTLS isn't so much about TLS. It's the remote control protocol. Required if you want to use osquery's life query, or the native mechanism to distribute configuration. If you have other config management tools you can use them.
g
Gavin
08/14/2020, 2:33 PMHi @Erfan I want to apologies for the confusion I thought this was posted in the Kolide channel and in haste responded I am happy you got the correct resolution.
e
Erfan
08/14/2020, 4:08 PMDear @seph I just need osquery for some periodical queries on my endpoints and have the results in json format on my elk stack
Do I need kolide or configuration management tool also in this case ?
s
seph
08/14/2020, 5:06 PMHow will you get the configuration of the scheduled queries to your endpoints?
e
Erfan
08/14/2020, 8:21 PMOur endpoints are windows 10 mostly and I think the Microsoft SCCM can do this task
s
seph
08/14/2020, 8:22 PMNo idea.
But that’s the question you should work through.
* What installs osquery.
* Who maintains the osquery configuration
* What distributes the osquery configuration
* How are logs collected / aggregated
* How are logs analyzed
There’s no single answer here.
e
Erfan
08/14/2020, 8:32 PMYes, thanks for your asnwers
My issue is on the last 2 items
Now I will send logs to elk with beats to parse them and then see what issues will happen