Hey friends! What's the best way to forward all th...
# fleet
Hey friends! What's the best way to forward all the scheduled query results to another endpoint? We need to collect em all in our SIEM
There are lots of different ways. Depends on where fleet is hosted.
at the most basic, you log to disk and use whatever forwarders your SIEM supports on the fleet host(s)
or you can use AWS Kinesis or GCP PubSub
👍🏽 2
and pull it from there
yeah definitely gonna go the Kinesis way
thinking of hosting on either EKS or ECR not sure yet. still researching
We use Filebeat --> Elasticsearch
ty 1
yeah if you are deploying containers, kinesis is the way to go
ty 1
💯 2
My approach is to store the result logs on the filesystem (using the flags
osquery: result_log_plugin: filesystem
filesystem: result_log_file: /var/log/fleet/result.log, enable_log_rotation: true
) and then using a filebeat to read this file and send the logs to my logstash
👀 1
All of the above are excellent options! Many folks on AWS have good success with Kinesis/Firehose.
🙏🏽 1
👍🏽 1
I use logstash -> elasticsearch
ty 1
coz my logstash is ingesting from a ton of sources not just OSQ, logstash is probably overkill if you just want to do osquery results
💯 1
ty 2