Remington Winters

07/01/2021, 7:06 PM
Hey all, we are trying to integrate fleet/orbit into our existing MDR solution. Is there a way to send alerts from fleet? I didnt see anything in the documentation or config. Any help would be appreciated.


07/01/2021, 7:16 PM
Typically you would pipe logs from fleet to your logging solution and alert on those (logs from query packs)
🙌🏽 1
🙌 1

Rachel Perkins

07/01/2021, 7:22 PM
Thanks Jason! As of now, there are no alerts in Fleet
This is probably the first alert feature that we're going to add. We would love any input to make our alerts more helpful

Mystery Incorporated

07/03/2021, 11:46 AM
Yes I do what Jason says about using another solution. I use logstash to soak up the osquery_results log into Elastic and I have Elastalert sending alerts to email and Teams. It works well you should try it.