Channels
android_tests
apple-silicon
arm-architecture
auditing-warroom
aws
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
general
golang
goquery
infrastructure
jobs
kolide
linen-dev
linux
macos
officehours
osctrl
plugins
process-auditing
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Powered by
Title
s
Sam.P
09/18/2020, 1:40 AM
Good day, I would like to make data transfer from kolide fleet to Kafka broker by using Kolide API token. But i have no idea how to make it. any suggestions. Thank you.
s
sundsta
09/18/2020, 1:59 AM
To query Kolide you would use the API token as a bearer token. EG:
https://github.com/kolide/fleet/blob/20328b0f8713ea687ef639c3a326b2c4ffca1cea/server/service/endpoint_appconfig_test.go#L27
Keep in mind that if you want the results of the osquery data, you need to use one of the logger plugins. The Kolide API cannot return that data
s
Sam.P
09/18/2020, 2:03 AM
So you mean using logstash to pass the osquery result to kafka?
s
sundsta
09/18/2020, 2:25 AM
Yes. The currently supported logger plugins are documented here:
https://github.com/kolide/fleet/blob/master/docs/infrastructure/configuring-the-fleet-binary.md#osquery_result_log_plugin
s
Sam.P
09/18/2020, 3:14 AM
Get it. Thanks man
6 Views
#kolide
Join Slack