Sunil
01/30/2023, 3:07 PMRachel Perkins
01/30/2023, 3:14 PMSunil
01/30/2023, 3:44 PMRachel Perkins
01/30/2023, 4:53 PMSunil
01/30/2023, 5:40 PMRachel Perkins
01/30/2023, 6:18 PMkafkarest
but you need a kafkarest proxyhost setup first to point to as wellSunil
01/30/2023, 6:41 PMRachel Perkins
01/30/2023, 8:21 PMKathy Satterlee
01/30/2023, 10:28 PM- FLEET_KAFKAREST_AUDIT_TOPIC=fleet_audit
- FLEET_ACTIVITY_AUDIT_LOG_PLUGIN=kafkarest
Those two values are related to admin activities in Fleet. Wanted to make sure that was clear given that we're also talking about process auditing using the process_events and socket_events tables.Sunil
01/31/2023, 10:35 AMKathy Satterlee
01/31/2023, 2:45 PMRachel Perkins
01/31/2023, 3:23 PMSunil
01/31/2023, 7:04 PMKathy Satterlee
01/31/2023, 7:30 PM## Connection settings for Kafka Rest Proxy
##This assumes that your services are running on the same network in Docker
- FLEET_KAFKAREST_PROXYHOST=kafka-rest:38082
- FLEET_KAFKAREST_TIMEOUT=5
- FLEET_KAFKAREST_CONTENT_TYPE_VALUE=application/vnd.kafka.json.v2+json
## Settings to sent osquery result logs for scheduled queries to Kafka:
- FLEET_OSQUERY_RESULT_LOG_PLUGIN=kafkarest
- FLEET_KAFKAREST_RESULT_TOPIC=fleet_result
## Settings to also send the activity stream to Kafka
- FLEET_ACTIVITY_ENABLE_AUDIT_LOG=true
- FLEET_ACTIVITY_AUDIT_LOG_PLUGIN=kafkarest
- FLEET_KAFKAREST_AUDIT_TOPIC=fleet_audit
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
If you're using Fleet's installer packages, those are the default settings.Sunil
02/01/2023, 6:19 AM--logger_plugin=tls,filesystem
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
Kathy Satterlee
02/01/2023, 3:26 PM<http://kafka-rest:38082>
Sunil
02/01/2023, 3:44 PMKathy Satterlee
02/01/2023, 3:47 PMSunil
02/01/2023, 3:47 PMKathy Satterlee
02/01/2023, 4:28 PMhttp://
there.Sunil
02/01/2023, 4:59 PMKathy Satterlee
02/01/2023, 5:09 PM<https://localhost:38082>
instead. If that doesn’t do the trick, I’ll reach out for some backup :)Sunil
02/01/2023, 5:12 PMKathy Satterlee
02/01/2023, 5:25 PMcurl
that url?
<https://localhost:38082/topics/?topic=fleet_result>
*Just noticed that I instinctively added the s
. Try with just http
as well.Sunil
02/01/2023, 6:10 PMKathy Satterlee
02/01/2023, 6:26 PMSunil
02/03/2023, 6:21 AMKathy Satterlee
02/03/2023, 6:31 PMfleet_audit
is for admin activity in Fleet (logins, running/saving/modifying queries, etc). Next step will be tot set up scheduled queries using those tables, then the results will come through with the rest of your scheduled queries.