the windows_events table will read in windows events based on configured channels and send them as results

I want reduce the agents installed and maybe replace winlogbeat with continuous windows_events query could be a good solution?

maybe setting kafka as logger plugin?

osquery is kind of a kit ... spend a lot of time configuring and testing

we already have osquery on endpoints, but used only for response, maybe we can use it also for win event forwarding

osquery reporting format is verbose

so lots of bandwidth

and the mainline code is not great at high throughput events yet

then you have queries in your schedule (e.g. every 60 seconds) to filter what you want. The results get forwarded by logger

I have more osqauery experience with linux than windows and there the problem is auditd 🙂

you

otherwise, avoid buffered_logger based loggers like tls and kinesis.

I will test it