with osquery is it possible to forward also window...
# windowsv
vaar
08/19/2019, 3:55 PMwith osquery is it possible to forward also windows events not generated by osquery?
p
packetzero
08/19/2019, 3:56 PMyes
packetzero
08/19/2019, 3:56 PMthe windows_events table will read in windows events based on configured channels and send them as results
v
vaar
08/19/2019, 4:00 PMah, nice. thanks
vaar
08/19/2019, 4:02 PMI want reduce the agents installed and maybe replace winlogbeat with continuous windows_events query could be a good solution?
vaar
08/19/2019, 4:02 PMmaybe setting kafka as logger plugin?
p
packetzero
08/19/2019, 4:09 PMit will take some experimentation on your part to understand what works best for your environment.
packetzero
08/19/2019, 4:09 PMosquery is kind of a kit ... spend a lot of time configuring and testing
v
vaar
08/19/2019, 4:10 PMyeah, sure. We have a lot of problems with WEF, so a replacement is needed in any case.
vaar
08/19/2019, 4:10 PMwe already have osquery on endpoints, but used only for response, maybe we can use it also for win event forwarding
p
packetzero
08/19/2019, 4:10 PMif you are having issues with WEF, osquery might give you just as many issues
packetzero
08/19/2019, 4:11 PMosquery reporting format is verbose
packetzero
08/19/2019, 4:11 PMso lots of bandwidth
packetzero
08/19/2019, 4:11 PMand the mainline code is not great at high throughput events yet
v
vaar
08/19/2019, 4:13 PMbut it is still possible to filter for needed events and not everything via query
p
packetzero
08/19/2019, 4:14 PMyou subscribe to event channels like Windows-Security , Windows-Powershell, etc.
packetzero
08/19/2019, 4:15 PMthen you have queries in your schedule (e.g. every 60 seconds) to filter what you want. The results get forwarded by logger
v
vaar
08/19/2019, 4:16 PMthe logger forwards the query results, right?
p
packetzero
08/19/2019, 4:17 PMyes
v
vaar
08/19/2019, 4:18 PMthe osquery issues with the high throughput are on event channels subscriptors?
vaar
08/19/2019, 4:19 PMI have more osqauery experience with linux than windows and there the problem is auditd 🙂
p
packetzero
08/19/2019, 4:20 PMif you are not running on a high-load server, then performance should not be an issue for oyu
packetzero
08/19/2019, 4:20 PMyou
packetzero
08/19/2019, 4:20 PMotherwise, avoid buffered_logger based loggers like tls and kinesis.
v
vaar
08/19/2019, 4:22 PMwhat about kafka?
p
packetzero
08/19/2019, 4:23 PMI've never used it. it doesn't appear to cache events in rocksdb (which is issue with buffered_logger).
v
vaar
08/19/2019, 4:35 PMyes, it seems to forward the events directly, so it should be better for this use case
vaar
08/19/2019, 4:35 PMI will test it