Hey friends! What's the best way to forward all th...
# fleetp
pvirani
07/28/2021, 5:24 PMHey friends! What's the best way to forward all the scheduled query results to another endpoint? We need to collect em all in our SIEM
j
Jason
07/28/2021, 5:32 PMThere are lots of different ways. Depends on where fleet is hosted.
Jason
07/28/2021, 5:32 PMat the most basic, you log to disk and use whatever forwarders your SIEM supports on the fleet host(s)
Jason
07/28/2021, 5:33 PMor you can use AWS Kinesis or GCP PubSub
👍🏽 2
Jason
07/28/2021, 5:33 PMand pull it from there
p
pvirani
07/28/2021, 5:34 PMyeah definitely gonna go the Kinesis way
pvirani
07/28/2021, 5:35 PMthinking of hosting on either EKS or ECR not sure yet. still researching
d
defensivedepth
07/28/2021, 5:42 PMWe use Filebeat --> Elasticsearch
ty 1
j
Jason
07/28/2021, 5:45 PMyeah if you are deploying containers, kinesis is the way to go
ty 1
💯 2
s
Saulo Guilhermino
07/28/2021, 6:10 PMMy approach is to store the result logs on the filesystem (using the flags
osquery: result_log_plugin: filesystemfilesystem: result_log_file: /var/log/fleet/result.log, enable_log_rotation: true👀 1
z
zwass
07/28/2021, 10:14 PM
All of the above are excellent options! Many folks on AWS have good success with Kinesis/Firehose.
🙏🏽 1
👍🏽 1
m
Mystery Incorporated
07/29/2021, 10:22 AMI use logstash -> elasticsearch
ty 1
Mystery Incorporated
07/29/2021, 10:23 AMcoz my logstash is ingesting from a ton of sources not just OSQ, logstash is probably overkill if you just want to do osquery results
💯 1
ty 2
4 Views