SIEM with Osquery Event Log Aggregation and Confluent Platform

What this post added

Introduces a method for integrating osquery event logs into Confluent Platform for SIEM. Details the use of a custom osquery Python extension leveraging librdkafka for publishing logs to Kafka, supporting both Confluent Platform and Confluent Cloud. Demonstrates creating ksqlDB streams from osquery 'processes' and 'open_files' topics and performing a join to identify processes opening files, with a practical example of creating a large file and observing the join results. Discusses the limitations of the built-in osquery Kafka producer plugin and highlights the benefits of the custom extension for cloud readiness and Avro/Schema Registry integration.