Anyone using Humio or Splunk as the database collecting quer

Question

Anyone using Humio or Splunk as the database collecting query results Any pro tips for a noob

Evgeny Sidorov · Answer

Hi I m using splunk and I collect results via HTTPS For that I needed to develop a proxy forwarder that takes results from osquery modifies them and forwards to Splunk HEC

raj · Answer

Thanks That s what we ll probably have to do also

raj · Answer

I was hoping there d be a pre existing tool but we might use a log collector agent nxlog syslog etc to send the data over TLS

Evgeny Sidorov · Answer

In general you can forward the logs via rsyslog but the overall scheme will be like osquery gt disk gt rsyslog gt splunk

Evgeny Sidorov · Answer

which can affect IO

Evgeny Sidorov · Answer

in my case disk IO is expensive so I don t store anything on disk and forward the logs to Splunk right from memory via HTTPS smiley

raj · Answer

Good point We re already using nxlog on almost everything but a lot of that data s probably from memory rather than disk