Frequently Asked Questions

Answers to common questions about deploying, configuring, and operating Bindplane.

Here are some of the most frequently asked questions our customers have about Bindplane. If you do not see your question on the list, please contact support and we will be happy to help.

General

How much does Bindplane cost?

We offer a number of different plans at different price points, ranging from a completely Free plan to customized Enterprise plans. For more information, please visit our Pricing page.

What happens if my connection to Bindplane is interrupted? If the Bindplane Server goes down, does data get lost?

The Bindplane Server is only for configuration. The Bindplane Collector, which is an OpenTelemetry Collector, sends telemetry directly to the destination platform. If the Bindplane Server goes down the collector telemetry is not interrupted. You cannot push new configurations to the collectors until the connection is reestablished.

How many collectors can I run at once?

We have Enterprise customers in production using 70,000+ collectors, and we can support up to 1 million. Your maximum number of allowed collectors will be based on your plan. Visit our Pricing page for more details on the collector usage limits for each plan.

What is the difference between regular Bindplane and Bindplane (Google Edition)?

With our regular Bindplane plans, you have access to all of our available sources, destinations, and data reduction features. Your collector and telemetry usage limits will vary based on the level of plan you have selected. More details on those limits can be found on our Pricing page.

With the Google Editions of Bindplane (either Free or Enterprise level), you will have unlimited collector and telemetry usage, but are only able to send data to certain Google-specific destinations (e.g., Google Cloud, Google SecOps). For more information and to compare the Google Editions to our Enterprise offering, check out our website.

Self-Hosted

I have a setup question that isn't covered in the Getting Started guide. How do I deploy with an advanced feature?

Check out our advanced setup page if you need additional installation options such as Kubernetes, TLS or if you will be using a Proxy.

How do I upgrade Bindplane for Linux?

Running the install command without the --init flag at the end is enough to upgrade Bindplane. You can get the installer command from going to the download page. Run this script on your Bindplane Server to upgrade Bindplane.

Can you deploy Bindplane on Kubernetes?

You can install the Bindplane Server and collectors on Kubernetes. See Kubernetes Installation for more information.

Sources

File Source

How do you reset the file collector to re-read files in a directory?

Under the advanced configuration for the file source, set the file to read at the beginning and uncheck the "Enable File Offset Storage".

Destinations

Google SecOps

Windows Events Routing to Google SecOps

• Google SecOps can only read 'RAW' telemetry. Please verify that in the Google SecOps Destination settings 'Send Single Field' is checked, with the 'Field to Send' set to 'Body'.

• The 'Log Type' in the Google SecOps Destination settings should be set to 'WINEVTLOG' to capture Windows Event Logs.

• On the 'Windows Events' Source, under 'Advanced', please make sure 'Raw Logs' is selected.

• To send events from a custom channel to Google SecOps, you can specify the channel name in the 'Windows Events' source under 'Advanced Settings'. To find the value for the custom channel name you can run the following commands on the Windows Server to find the value of the custom channel log name:Get-WinEvent -ListLog *

• To capture DNS logs on Windows, you can add the 'DNS Server' channel in the Windows Events source and under Advanced.

• To capture DHCP logs on Windows, you can use the CSV source and point it to your DHCP logs that may be located at 'c:\windows\system32\dhcp\dhcpsrvlog.*.txt'