Fleet Deploy OSQuery to Windows

Elastic Security SIEM
1

I have successfully deployed both OSQuery manager and one agent to a Linux machine.
However; my deployment to a Windows box doesn't seem to be working.
I believe it's because the log path needs to be modified to something suitable to Windows.

This is the default value: /var/log/osquery/osqueryd.results.log*

2

Hi, @sourcreamnormanbates

When installing the Elastic Agent on the Windows host, did you use administrator permissions at the command prompt? I recommend creating an inbound rule in the Windows Firewall for the Elastic Agent. In some situations, Windows Firewall blocks remote communications.

What version of Windows? On this host, is there any endpoint protection solution such as antivirus?

3

Which integration are you using? Osquery Logs or Osquery Manager?

The first one requires that you already have osquery installed on the host and will collect the logs for it, the second one will use the osqueryd that is shipped with the agent and allows you to run queries directly from Kibana.

4

OK that worked now that I understand the difference between the two.
For some reason I thought "Logs" was a client and "Manager" was the server side.
I guess I overcomplicated things.
Thanks for the reply, this will be a great addition to our DFIR capability.

5

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.