zentral - what's new? - macdevops:yvr 2017
Post on 22-Jan-2018
43 Views
Preview:
TRANSCRIPT
Zentral - what's new?open hub for monitoring
Henry Stamerjohann Apfelwerk GmbH & Co. KG, Germany
@henry@head_min
https://osquery.io
https://github.com/google/santa
event processing + filtering
• collect structured information • ready to analyze • act on • time-sensitive decisions
Event data
Observe Orient Decide Act
https://en.wikipedia.org/wiki/OODA_loop
Observe
Orient Decide
Events Act
event stream processing
Events
Notifications
Inventory software management
configuration management
zentral
https://github.com/zentralopensource/zentral
Zentral
MunkiOSQuery
Santa
Sal
Inventory
API
Puppet DB
JamfPro
Watchman
FileWave
Munki
OSQuery
Events + config
TLS
Munki
Santa
OSQuery
/var/log/
Auditd
JamfPro logs
Log shipping
LogstashFilebeat
internal events
Infrastructure events
Nagios
?
Events
external events
Syslog
Event store / backends
Elastic Search
KinesisStore
Jira
Slack SMS
Zendesk
Trello
Actions
Notification / actions
Jss API
Probes = events + filters
Events (filter only)
Probe types
Probe
Metadata filter
Payload filter
Inventory filter
Event Probe
Event types
Probe feeds
Feeds (samples to start with)
Probe types
Probe feeds
Probe feeds
Probe + config
Probe types
Config + Events filter
Probe config
Probe
Config TLS
OSQuery
Santa
Monolith = munki config
Client event stream
Client events
MunkiMunki
Client events
Santa
Client events
OSQuery
Client events
Inbound events
aggregate system events
aggregate system events + build audit trails
SRSLY ?
Google Santa
select * from santa_collectedapplication;
SAML, and, and…
SSO / SAML
SimpleMDM
Ad hoc signed .pkg
Ad hoc signed .pkg
• community support via GitHub (free) • support contract, paid tier (on request)
• SaaS (cloud based service) • Professional services, custom development • Integration support (on premise)
Support
Deploymentsimple Zentral all-in-one (to get started) • Amazon AWS (prod. / eval.) • GoogleCloudServices (prod. / eval.) • Vagrant box (evaluation) • VMware .ova (evaluation) • docker-compose (dev. / eval.)
Links
goo.gl/etN3sv
thank you !
twitter: @head_min slack: henry
top related