Hey friends What s the best way to forward all the scheduled

Question

Hey friends What s the best way to forward all the scheduled query results to another endpoint We need to collect em all in our SIEM

Jason · Answer

There are lots of different ways Depends on where fleet is hosted

Jason · Answer

at the most basic you log to disk and use whatever forwarders your SIEM supports on the fleet host s

Jason · Answer

or you can use AWS Kinesis or GCP PubSub

Jason · Answer

and pull it from there

pvirani · Answer

yeah definitely gonna go the Kinesis way

pvirani · Answer

thinking of hosting on either EKS or ECR not sure yet still researching

defensivedepth · Answer

We use Filebeat gt Elasticsearch

Jason · Answer

yeah if you are deploying containers kinesis is the way to go

Saulo Guilhermino · Answer

My approach is to store the result logs on the filesystem using the flags `osquery result log plugin filesystem` and `filesystem result log file var log fleet result log enable log rotation true` and then using a filebeat to read this file and send the logs to my logstash

zwass · Answer

All of the above are excellent options Many folks on AWS have good success with Kinesis Firehose

Mystery Incorporated · Answer

I use logstash gt elasticsearch

Mystery Incorporated · Answer

coz my logstash is ingesting from a ton of sources not just OSQ logstash is probably overkill if you just want to do osquery results