Elastic Agent

From https://www.elastic.co/elastic-agent:

With Elastic Agent you can collect all forms of data from anywhere with a single unified agent per host. One thing to install, configure, and scale.

Each Security Onion node uses the Elastic Agent to transport logs to Elasticsearch. You can also deploy the Elastic Agent to your endpoints to transport logs to your Security Onion deployment.



In order to receive logs from the Elastic Agent, Security Onion must be running Logstash. Evaluation Mode and Import Mode do not run Logstash, so you’ll need Standalone or a full Distributed Deployment. In a Distributed Deployment, forward nodes do not run Logstash, so you’ll need to configure agents to send to your manager or receiver nodes. For more information, please see the Architecture section.

To deploy an Elastic agent to an endpoint, go to the Security Onion Console (SOC) Downloads page and download the proper Elastic agent for the operating system of that endpoint. Don’t forget to allow the agent to connect through the firewall by going to Administration –> Configuration –> firewall –> hostgroups.


Once there, select the elastic_agent_endpoint option.


If you’d like to see this in action, check out our Youtube video at https://youtu.be/cGmQMsFuAvw.


If deploying the Elastic Agent to a Linux host, make the file executable and then execute using sudo:

chmod +x ./so-elastic-agent_linux_amd64
sudo ./so-elastic-agent_linux_amd64


If deploying the Elastic Agent to macOS, you will need to take a few steps. First, remove the quarantine attribute. Then, make the file executable. Finally, execute the file using sudo:

xattr -d com.apple.quarantine ./so-elastic-agent_darwin_amd64
chmod +x ./so-elastic-agent_darwin_amd64
sudo ./so-elastic-agent_darwin_amd64

After the installer has completed, review the Elastic docs for your version of macOS and approve the required settings (system extension and full drive access) as shown at https://www.elastic.co/guide/en/security/8.9/elastic-endpoint-deploy-reqs.html.


Once the agent starts sending logs, you should be able to find them in Dashboards, Hunt, or Kibana.


You can manage your agents using Elastic Fleet.

Live Queries

You can query your agents in realtime using Osquery Manager.


You can read more about integrations in the Elastic Fleet section and at https://docs.elastic.co/integrations.

More Information


For more information about the Elastic Agent, please see https://www.elastic.co/guide/en/fleet/current/fleet-overview.html.