eclecticiq-polylogyx-extension
  • l

    lvferdi

    10/21/2021, 8:09 PM
    Hello, hoping to get some help. I downloaded the latest release from git of PolyLogyx and added the extension to osquery along with the extensions.load file. When the extension starts I get a couple errors
    No event_filter found
    and
    CreateFileW failure Error
    and none of the event tables have any data. the
    No event_filter found
    error repeats over and over. I see the queries being scheduled and run with osqueryd in the foreground but no data ever populates the tables. Thoughts please?
  • l

    lvferdi

    11/02/2021, 2:25 PM
    Can someone help me with exclusions vs inclusions and which win. I have win_socket_events running and I am trying to exclude splunk events. I have the port splunk uses in the includeded ports filter but in the process_name section I exclude the splunk process name. Yes in the results I still see splunk process being reported. The only thing I can think of is that INCLUDES trump EXCLUDES and if the include matches then the exclude is ignored. Is this how it works? Or am I doing something completely incorrect.
  • l

    lvferdi

    11/03/2021, 7:23 PM
    Has anyone has success in getting include and/or exclude filters to work. No matter what I try I can't seem to filter out anything with exclude or only collect specific things with include. Any help would be appreciated
  • o

    OpenPlgx

    11/09/2021, 5:21 AM
    @lvferdi, would love to know more about how you are using the extension and the data it generates, if you are open to sharing it..
  • l

    lvferdi

    11/15/2021, 7:08 PM
    What would cause the error;
    No event control (blocking) filter found in config
    when the
    plgx_event_filters
    are set in the
    osquery.conf
    file
  • o

    OpenPlgx

    11/16/2021, 4:08 AM
    Can you share your blocking config?
  • l

    lvferdi

    11/24/2021, 4:32 PM
    Does the
    win_file_event
    polylogyx filter apply to the
    win_pefile_event
    query as well as the
    win_file_event
    query. As in if I have filters set in my osquery conf file for
    win_file_events
    will those filters apply when I run a
    select * from win_pefile_events;
  • l

    lvferdi

    11/29/2021, 9:00 PM
    I am working on filtering windows registry events. I am testing the filters with this activity on my windows server
    $start = Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wuauserv" | Select-Object -ExpandProperty "Start"
    Attack successful if zero exit
    
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wuauserv" -Name "Start" -Value 4 -Force
    Attack successful if zero exit
    
    Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wuauserv" | Select-Object -ExpandProperty "Start"
    Attack successful if output matches /4/
    
    Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\wuauserv" -Name "Start" -Value $start -Force
    When I execute this with
    target_name: { include: { values [ * ] } }
    , I get the results I would expect but if I add
    "target_name": {
            "include": {
              "values": [
                "*\\Start",
              ]
            }
           }
    I get no results. Expected outcome is that since the resulting registry entry ends with
    \Start
    the include filter for
    *\\Start
    would be enough to capture the information.
  • o

    OpenPlgx

    12/01/2021, 3:52 PM
    We will roll up a fix for that. And while we are at it, and given you are a sysmon user as well, we observed that sysmon doesn't give events for mounted drives. How useful would you say it is, if any.
  • s

    Shane Sanborn

    01/28/2022, 7:45 PM
    Hi, just started working with this extension on osquery, I have been getting certain error logs when I start up osquery with the extensions and not sure if the extension is working properly
    2022-01-28_15.38.41 INFO  plgx_win_extension.ext.cpp:601: ##### EclecticIQ Osquery Extension v3.0.0.0 #####
    2022-01-28_15.38.44 INFO  plgx_win_extension.ext.cpp:699: distributed_tls_plugin is tls
    2022-01-28_15.38.44 ERROR plgx_win_extension.ext.cpp:739: Failed retrieving Kernel state from osqueryd config. Error: 2 (The system cannot find the file specified.
    
    )
    2022-01-28_15.38.44 INFO  plgx_extension_watcher.cpp:41: Watcher Thread starting..
    2022-01-28_15.38.44 ERROR plgx_load_unload_vast_driver.cpp:34: Driver-Init Failed: 1056
    2022-01-28_15.38.44 ERROR plgx_load_unload_vast_driver.cpp:34: Driver-Init Failed: 1056
    2022-01-28_15.38.44 ERROR plgx_win_extension.ext.cpp:761:  Driver Load Failed Again
    2022-01-28_15.38.44 INFO  plgx_win_extension.ext.cpp:780: Polylogyx plugin not found. Creating Config thread to refresh config
    2022-01-28_15.38.44 INFO  plgx_win_extension.ext.cpp:784: config_tls_plugin is filesystem
    Any help would be appreciated thanks!
  • s

    Shane Sanborn

    03/01/2022, 7:31 PM
    Hi team, is there anyway for the extension and osquery not to use as many resources. Our osquery configuration before we added the extension with its query was lower than 5% cpu on average, but now with it its has gone up to average around 40% combined and will spike higher. We are wondering if there is any method to lower this. Any help is appreciated
  • o

    OpenPlgx

    04/13/2022, 4:48 PM
  • o

    OpenPlgx

    05/05/2022, 3:31 PM
    Announcing the release of new version of the extension v 3.5.1: https://github.com/eclecticiq/osq-ext-bin • Bug fixes • Additional visibility into File Delete events
  • o

    OpenPlgx

    05/13/2022, 12:19 PM
    Based on the above extension, a new community version of the platform is released today and available at: https://github.com/eclecticiq/eiq-er-ce
  • o

    OpenPlgx

    05/13/2022, 12:19 PM
    To know more about the additional visibility features in the extension: https://blog.eclecticiq.com/catch-em-deletes-increasing-visibility-not-the-cost
  • l

    lvferdi

    05/17/2022, 12:03 PM
    Good Morning. When looking in the extension log I can see references to a cert and attempted connections to a management server. Can this be disabled as we are not using that functionality of this extension.
  • l

    lvferdi

    05/17/2022, 3:19 PM
    I am also experiencing the race condition mentioned on git where filtered events get collected. Is there a way to reduce this, at times the amount of logs collected causes the extension to crash. And it seems even after allowing time for the race condition to correct I see events that should have been filtered being collected by the extension.
  • l

    lvferdi

    05/20/2022, 3:53 PM
    Is there any other logging location for the extension other than
    plgx-win-extension
    . I have been getting what appears to be resource exhaustion. I start the extension and it collects logs for about 1 minute then stops collecting. tailing the extension log I can see it reapplying the event filters and re-reading the config then eventually show the error below. Is there a place I can find more logs on this issue so I can try to fix it.
  • o

    OpenPlgx

    05/24/2022, 1:03 PM
    In case you wish to deploy osquery+agent without a manager (e.g. thru a script on local or remote systems or in a sandbox prior to detonating a malware), here is a script that will enable you to do so. https://github.com/eclecticiq/osq-ext-bin/tree/master/install
  • o

    OpenPlgx

    07/05/2022, 8:57 AM
    Thanks @lvferdi for your continued testing and reporting the issues. A new release of the extension has been posted with instruction on how to adjust the agent log depth (which can significantly help on query performances). https://github.com/eclecticiq/osq-ext-bin
  • l

    lvferdi

    07/05/2022, 12:30 PM
    I will install today and reply with results.
  • l

    lvferdi

    07/05/2022, 12:30 PM
    Ty
  • o

    OpenPlgx

    07/06/2022, 5:06 AM
    Looking forward
  • s

    Shane Sanborn

    07/27/2022, 2:29 PM
    Hey Team, we have been load testing with osquery and this extension and it seems that using this extension makes osquery run and peak with a much higher cpu% than our normal osquery configurations. We were wondering if this normally makes osquery use a lot more cpu% or if this could just be resolved with tweaking our configs.
  • o

    OpenPlgx

    07/29/2022, 3:17 PM
    @Shane Sanborn, any improvements with your testing? Is there any logs you can share, if not.
  • l

    lvferdi

    08/02/2022, 8:07 PM
    Afternoon polylogyx team, just wanted to say the newly released agent has been rock solid. With the right filters to reduce overly noisy sources I have been able to get the agent to run error free for over a week with no errors from the extension. File_Events seemed to be one of the biggest offenders but I got that dialed in. Thanks for the great agent.
  • o

    OpenPlgx

    08/02/2022, 9:39 PM
    @lvferdi, thanks for the kind words. And a minor correction. We are now "EclecticIQ" team 🙂
  • o

    OpenPlgx

    10/25/2022, 5:51 PM
    Announcing the new release of our extension which has additional monitoring (e.g. named pipes) and a cool new feature that integrates the extension with 'desktop search'. This allows to use OSquery's SQL syntax to search for files on the desktop and overcomes the limitation of 'file' table. https://github.com/eclecticiq/osq-ext-bin
  • o

    OpenPlgx

    10/29/2022, 4:43 AM
    And also published the new version of our full Osquery management solution, Endpoint Response (ER) 4.0 Community Edition : https://github.com/eclecticiq/eiq-er-ce
  • o

    OpenPlgx

    11/30/2022, 2:02 PM
    We created a table in our extension that helps monitor log files. The blog describes on how the table can be used to monitor for IIS logs https://medium.com/eclecticiq/using-log-parsing-to-stop-microsoft-iis-backdoor-attacks-3bd6081dc47d