-
Notifications
You must be signed in to change notification settings - Fork 402
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Ship audit activity to external destinations #8416
Comments
We clarified this on a call and what we want to stream to an external destination are the |
@zhumo This only requires code changes in #platform. Shall I edit the description to remove the remaining TODOs? |
Yes please go ahead! |
@zhumo To not cause issues (and/or degrade performance) with admin operations that will generate activities (ideally all), we'll stream the activity externally on a separate asynchronous job. |
That’s fine but please document.
On Thu, Dec 15, 2022 at 8:54 AM Lucas Manuel Rodriguez < ***@***.***> wrote:
@zhumo <https://github.com/zhumo> To not cause issues (and/or degrade
performance) with admin operations that will generate activities (ideally
all), we'll stream the activity externally on a separate asynchronous job.
Is a delay, of, say, 5 minutes on the external streaming acceptable? (In
other words: The activity will be visible in the UI instantly as usual, but
the streaming to the external destination may take up to 5 minutes.)
@chiiph <https://github.com/chiiph>
—
Reply to this email directly, view it on GitHub
<#8416 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ABI4PYVXSG7PF2NTFE5OW3TWNMPH7ANCNFSM6AAAAAARL43P2U>
.
You are receiving this because you were mentioned.Message ID:
***@***.***>
--
*Mo Zhu*
Head of Product
fleetdm.com <http://www.fleetdm.com> | @fleetctl
<https://twitter.com/fleetctl>
|
Re opening this issue because the feature hasn't been released. |
/docs/configuration/config.md) Auditing activity
|
/docs/content/admin/configuration.md#activity-audit-log-plugin) for more details. A distant stream, |
Problem
As a Fleet admin who is expanding my Fleet user base to other teams/groups/departments in my organization, I want to aggregate users' Fleet activity in an external destination built for storage and analytics purposes, so that I can analyze user activity in case of issues or set up monitoring to detect non-standard usage.
Business Case
This enables Fleet to be used by a more diverse user base. It reduces the hesitancy on the part of the Fleet admin to give more access more broadly.
Analytics
Requirements
osquery_result_log_plugin
option.activity_audit_log_plugin
which accepts the same set of options asosquery_result_log_plugin
.result_stream
calledactivity_audit_stream
, which pushes the data to a certain stream in the external destination.filesystem
,firehose
,kinesis
,lambda
,pubsub
,kafkarest
, andstdout
.Documentation
Analytics
--
Related
PR: #9001
Child issues
Platform team
Documentation
The text was updated successfully, but these errors were encountered: