InsightAgent | How to include the addtional configuration to the deployment process

Hi All,

For InsightAgent deployment, is there a way where we can incorporate the additional configuration stated in this reference Configure the Insight Agent to Send Additional Logs | InsightIDR Documentation in the installation process?

Kind of, instead of doing it after installing the agent, it would be much easier to have it pre-configured then shipped for targeted or massed deployment on asset. Technically, the additional configuration that is required here is just a JSON file directive.

Am not sure if the above is allowed or possible,


Hi @kr7, its currently not a feature of the agent to pass this file as a parameter during install. The only option would be to add the file to the correct directory post install.


Hi David,

Thank you very much for the information.

BTW, is there any plan for the InsightAgent (InsightIDR use-case) to have the capability to include other/specific Windows event IDs aside from the default listed here Insight Agents with InsightIDR | InsightIDR Documentation

My original query actually spawns from the requirement that we are required to include the Windows event ID 612 or 4719 in the log collection.