PROCEDURES: Config Update

---

info

These procedures utilize the Deploy-Agent PowerShell module (262COS-CVAH_Agent_Deployer-SCRIPT-001) to deploy agents.

---

tip

The -ElasticURL $ElasticURL -ElasticPassword $ElasticPassword -ExportToElastic parameters will stream script execution logs to the Elasticsearch agent-deployer index, enabling you to view them in the [DIAGNOSTICS] Host Agent Deployment Kibana dashboard (Diagnostics -> Host Agent Deployment):

Procedures

Copy the content for the corresponding deployment option into your PowerShell_ISE.exe console and populate the required variables (<##########>) with their actual filepaths/values:

• Sysmon
• Winlogbeat
• Filebeat
• Auditbeat
• Metricbeat

---

Sysmon

Command Template

$ElasticURL="https://elasticsearch.<KIT_DOMAIN>:9200"
$ElasticPassword='<ELASTIC_PASSWORD>'

$SysmonConfig="<SYSMON_XML_CONFIG>"

Deploy-Agent -Credential $Credential -ComputerName $Targets `
    -ElasticURL $ElasticURL -ElasticPassword $ElasticPassword -ExportToElastic `
    -SysmonConfig $SysmonConfig

---

Winlogbeat

Command Template

$ElasticURL="https://elasticsearch.<KIT_DOMAIN>:9200"
$ElasticPassword='<ELASTIC_PASSWORD>'

$WinlogbeatConfig="<WINLOGBEAT_YML_CONFIG>"

Deploy-Agent -Credential $Credential -ComputerName $Targets `
    -ElasticURL $ElasticURL -ElasticPassword $ElasticPassword -ExportToElastic `
    -WinlogbeatConfig $WinlogbeatConfig

---

Filebeat

Command Template

$ElasticURL="https://elasticsearch.<KIT_DOMAIN>:9200"
$ElasticPassword='<ELASTIC_PASSWORD>'

$FilebeatConfig="<FILEBEAT_YML_CONFIG>"

Deploy-Agent -ComputerName $Targets `
    -Credential $Credential -SSHCredential $SSHCredential `
    -ElasticURL $ElasticURL -ElasticPassword $ElasticPassword -ExportToElastic `
    -FilebeatConfig $FilebeatConfig

---

 

Auditbeat

Command Template

$ElasticURL="https://elasticsearch.<KIT_DOMAIN>:9200"
$ElasticPassword='<ELASTIC_PASSWORD>'

$AuditbeatConfig="<AUDITBEAT_YML_CONFIG>"

Deploy-Agent -ComputerName $Targets `
    -Credential $Credential -SSHCredential $SSHCredential `
    -ElasticURL $ElasticURL -ElasticPassword $ElasticPassword -ExportToElastic `
    -AuditbeatConfig $AuditbeatConfig

---

Metricbeat

Command Template

$ElasticURL="https://elasticsearch.<KIT_DOMAIN>:9200"
$ElasticPassword='<ELASTIC_PASSWORD>'

$MetricbeatConfig="<METRICBEAT_YML_CONFIG>"

Deploy-Agent -ComputerName $Targets `
    -ElasticURL $ElasticURL -ElasticPassword $ElasticPassword -ExportToElastic `
    -Credential $Credential -SSHCredential $SSHCredential `
    -MetricbeatConfig $MetricbeatConfig

---