Elastic agent in SO. #5831
-
|
Just wanted to check if SO is planning the support of ELK SIEM along with Elastic Agent in future. |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 5 replies
-
|
Yes, we plan to support Elastic Agent in the future. |
Beta Was this translation helpful? Give feedback.
-
|
That is great news. Is there a release you are aiming to have this implemented? |
Beta Was this translation helpful? Give feedback.
-
|
Elastic Agent currently sends directly to Elasticsearch and thus requires opening the Elasticsearch port to your endpoints. They are working on a new feature to allow Elastic Agent to send to Logstash instead. We are waiting on that since that allows for a much smaller attack surface. |
Beta Was this translation helpful? Give feedback.
-
|
any news on this? i see that logstash output is already a thing |
Beta Was this translation helpful? Give feedback.
-
|
I think this is getting closer. There is now a logstash integration for the Elastic Agent in Technical Preview. |
Beta Was this translation helpful? Give feedback.
-
|
They mentioned some of it here https://blog.securityonion.net/2023/02/security-onion-in-2022-and-2023.html Probably will be here sometime this year for the 2.4 drop. |
Beta Was this translation helpful? Give feedback.
Yes, we plan to support Elastic Agent in the future.