Plain OSQuery agent configuration

[Stephen-Ridgway]

Hi!

Has anyone had any luck configuring plain OSQuery agents to register with Fleet on SO? We are getting '404' responses when the agents attempt to enroll at https://[ip]:8090/api/v1/osquery/enroll

SR

[reyesj2]

Verify you have run sudo so-allow for an osquery agent from the manager node

sudo so-firewall includedhosts osquery_endpoint 

[defensivedepth]

Have you seen the macOS deployment docs? It uses the generic installer: https://docs.securityonion.net/en/2.3/osquery.html#agents-deployment