PROCEDURES: Modules Update

info

These procedures utilize the Deploy-Agent PowerShell module (262COS-CVAH_Agent_Deployer-SCRIPT-001) to deploy agents.

tip

The -ElasticURL $ElasticURL -ElasticPassword $ElasticPassword -ExportToElastic parameters will stream script execution logs to the Elasticsearch agent-deployer index, enabling you to view them in the [DIAGNOSTICS] Host Agent Deployment Kibana dashboard (Diagnostics -> Host Agent Deployment):

Procedures

Copy the content for the corresponding deployment option into your PowerShell_ISE.exe console and populate the required variables (<##########>) with their actual filepaths/values:

Winlogbeat
Filebeat

Winlogbeat

note

The -WinlogbeatModules option should be used during installation if the Filebeat config references the use of a module.

Command Template

$ElasticURL="https://elasticsearch.<KIT_DOMAIN>:9200"
$ElasticPassword='<ELASTIC_PASSWORD>'

$WinlogbeatModules="<WINLOGBEAT_MODULES_FOLDER>"

Deploy-Agent -ComputerName $Targets `
    -ElasticURL $ElasticURL -ElasticPassword $ElasticPassword -ExportToElastic `
    -Credential $Credential -SSHCredential $SSHCredential `
    -WinlogbeatModules $WinlogbeatModules

Filebeat

note

The -FilebeatModules option should be used during installation if the Filebeat config references the use of a module.

Command Template

$ElasticURL="https://elasticsearch.<KIT_DOMAIN>:9200"
$ElasticPassword='<ELASTIC_PASSWORD>'

$FilebeatModules="<FILEBEAT_MODULES_FOLDER>"

Deploy-Agent -ComputerName $Targets `
    -ElasticURL $ElasticURL -ElasticPassword $ElasticPassword -ExportToElastic `
    -Credential $Credential -SSHCredential $SSHCredential `
    -FilebeatModules $FilebeatModules

Winlogbeat​

Filebeat​

Winlogbeat

Filebeat