InsightAgent | How to include the addtional configuration to the deployment process

InsightIDR
1

Hi All,

For InsightAgent deployment, is there a way where we can incorporate the additional configuration stated in this reference Configure the Insight Agent to Send Additional Logs | InsightIDR Documentation in the installation process?

Kind of, instead of doing it after installing the agent, it would be much easier to have it pre-configured then shipped for targeted or massed deployment on asset. Technically, the additional configuration that is required here is just a JSON file directive.

Am not sure if the above is allowed or possible,

BR,

2

Hi @kr7, its currently not a feature of the agent to pass this file as a parameter during install. The only option would be to add the file to the correct directory post install.

David

3

Hi David,

Thank you very much for the information.

BTW, is there any plan for the InsightAgent (InsightIDR use-case) to have the capability to include other/specific Windows event IDs aside from the default listed here Insight Agents with InsightIDR | InsightIDR Documentation

My original query actually spawns from the requirement that we are required to include the Windows event ID 612 or 4719 in the log collection.

BR,