SIEM with Osquery Event Log Aggregation and Confluent Platform

This post details how to integrate osquery event logs with Confluent Platform for SIEM use cases. It demonstrates using an osquery Python extension with librdkafka to publish logs to Kafka, and then using ksqlDB to create streams and join process and open_files events for real-time analysis. The implementation covers setting up a local Confluent Platform cluster with Docker and viewing the data in Confluent Control Center.