New Elastic Agent - Cloudtrail & Sysmon

[aboundinginterest]

As a month ago, there is a new elastic agent.

I want to ship both sysmon and AWS cloud trail logs to security onion . Previously I used winlogbeat & filebeat.

Do I just use the elastic agent now? Are there any videos on this topic? A short 20 minute video would be very helpful.

Thanks

[dougburks]

If you are using Security Onion 2.4, then you should use Elastic Agent:
https://docs.securityonion.net/en/2.4/elastic-agent.html