Question regarding architecture and fleet

[hmmxp]

Dear SecurityOnion Community,

I have a few questions

Architecture

• Search Node: Is this an Elasticsearch all-in-one node? Can we separate Elasticsearch master node, data node, coordinating node?

Fleet

• Can we managed Wazuh agent using fleet? Or we must deploy both Wazuh agent and osquery agent?

[defensivedepth]

RE: Search Node

Correct, this is an ES all-in-one node.

RE: Fleet

Wazuh and Osquery are two different endpoint agents - they are managed separately. It would be common to pick one or the other to deploy.