Title
#kolide
j

Jan Jacobs

11/03/2020, 5:38 PM
Does anyone know how much work it takes to build reporting into the OSS version of Kolide?
zwass

zwass

11/03/2020, 5:40 PM
Assuming you are talking about Fleet... There is no reporting in Fleet. You would configure your logs to go into an aggregation system (Splunk, ELK, etc.) and then build reports there.
j

Jan Jacobs

11/03/2020, 5:48 PM
Yes, i was talking about fleet ๐Ÿ˜ƒ i was wondering, because the SAAS version has reporting as far as i can see
sundsta

sundsta

11/03/2020, 6:03 PM
The SaaS is also not Fleet. Separate code base
j

Jan Jacobs

11/03/2020, 6:33 PM
Now ik even more confused.. and all i wanted was reporting ๐Ÿ™ˆ
s

seph

11/03/2020, 6:45 PM
What does reporting mean to you? Reporting is generally going to be some kind of server side storage/aggregation/reporting flow. As folks have commented, the SaaS is a different codebase from Fleet.
j

Jan Jacobs

11/04/2020, 6:00 PM
yeah, and thats why i came here for help ๐Ÿ˜‰ we are a small MSSP looking to use osquery for security analytics. much like uptycs and zercurity, they have logging and reporting, but they only offer SaaS or very expensive solutions. since we are targetting really small to small company's, we cant afford to ask them to pay hundreds of dollars a month. so i am basicly left with the option of looking into building it ourselves
6:03 PM
We have looked into Wazuh for this. which is tightly integrated with ELK, but truth be told, im no fan of ELK.. that might be just me ofcourse ๐Ÿ˜‰
sundsta

sundsta

11/04/2020, 6:09 PM
ELK is a solid option if youโ€™re rolling your own solution. Alternatively, if you want to keep within the SQL ecosystem Postgres+TimescaleDB seems solid. There arenโ€™t too many free and open source options in that space.
j

Jan Jacobs

11/04/2020, 6:33 PM
well Postgres sounds good! that i know ๐Ÿ˜‰
6:36 PM
the problem with Wazuh/ELK for me is, that i cant seem to get it working.. and there are scaling issuesin the future that i worry about ๐Ÿ™‚ and Kibana and me just dont seem to get along