Slackbot
11/20/2023, 10:59 AMMike S.
11/20/2023, 8:51 PMOrtal Kombat
11/21/2023, 1:28 PMOrtal Kombat
11/21/2023, 1:46 PMSamantha Baker
11/21/2023, 3:57 PMZapier
11/21/2023, 7:53 PMNeha
11/22/2023, 9:46 AMNeha
11/22/2023, 9:54 AMnick fury
11/22/2023, 1:32 PMRicardo
11/22/2023, 1:53 PMlee
11/24/2023, 2:42 AMPierre N
11/26/2023, 3:57 AMGuy
11/27/2023, 11:27 AMfleetctl package --type msi --fleet-desktop --fleet-url=<https://fleet.onrender.com> --enroll-secret=someecret
Error:
Generating your osquery installer...
Windows Installer XML Toolset Toolset Harvester version
Copyright (c) .NET Foundation and contributors. All rights reserved.
=================================================================
Native Crash Reporting
=================================================================
Got a UNKNOWN while executing native code. This usually indicates
a fatal error in the mono runtime or one of the native libraries
used by your application.
=================================================================
=================================================================
Managed Stacktrace:
=================================================================
=================================================================
wine client error:29: write: Bad file descriptor
Error: package root files: heat failed: exit status 1
Zapier
11/28/2023, 3:42 PMLuke Heath
11/29/2023, 1:36 AMVenkatrami Reddy
11/29/2023, 7:12 PMStefano
11/30/2023, 10:39 AMzwass
Rubén Rodríguez García
12/01/2023, 9:04 AMRubén Rodríguez García
12/01/2023, 9:04 AMZapier
12/01/2023, 5:12 PMMike S.
12/01/2023, 8:16 PMColin Smith
12/02/2023, 4:29 PMorbit
starts osqueryd
on macOS, it sets `--disable_carver=false`:
% ps -ax | grep osquery
87960 ?? 0:00.06 /opt/orbit/bin/osqueryd/macos-app/stable/osquery.app/Contents/MacOS/osqueryd --pidfile=/opt/orbit/osquery.pid --database_path=/opt/orbit/osquery.db --extensions_socket=/opt/orbit/orbit-osquery.em --logger_path=/opt/orbit/osquery_log --enroll_secret_env ENROLL_SECRET --host_identifier=uuid --tls_hostname=<http://glycine.wesleyan.edu|glycine.wesleyan.edu> --enroll_tls_endpoint=/api/v1/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/v1/osquery/config --config_refresh=60 --disable_distributed=false --distributed_plugin=tls --distributed_tls_max_attempts=10 --distributed_tls_read_endpoint=/api/v1/osquery/distributed/read --distributed_tls_write_endpoint=/api/v1/osquery/distributed/write --logger_plugin=tls,filesystem --logger_tls_endpoint=/api/v1/osquery/log --disable_carver=false --carver_disable_function=false --carver_start_endpoint=/api/v1/osquery/carve/begin --carver_continue_endpoint=/api/v1/osquery/carve/block --carver_block_size=8000000 --tls_server_certs /opt/orbit/certs.pem --augeas_lenses /opt/orbit/lenses --force --flagfile /opt/orbit/osquery.flags
In an attempt to disable file carving, I added --disable_carver=true
to `osquery.flags`:
% sudo cat /opt/orbit/osquery.flags
--disable_carver=true
Then restarted `orbit`:
sudo launchctl unload /Library/LaunchDaemons/com.fleetdm.orbit.plist
sudo launchctl load /Library/LaunchDaemons/com.fleetdm.orbit.plist
However, when orbit
starts osqueryd
, it still passes the --disable_carver=false
flag. If there's a conflict between the command-line flags and the contents of --flagfile
, which wins? Does it matter which order they're specified? Is there a way to tell for sure that carving is disabled? Thanks!aldente
12/05/2023, 4:38 PMosqueryi
, but not when run in Fleet as a distributed query? I’ve tested other distributed queries on the host and it returns results
SELECT
f.path
FROM
file AS f
JOIN
mdfind ON mdfind.path = f.path AND mdfind.query = "kMDItemDisplayName == 'ids.csv'";
aldente
12/05/2023, 4:42 PMfleet:v4.38.1
Zapier
12/06/2023, 5:07 PMtokcum
12/07/2023, 4:19 PMMike S.
12/07/2023, 8:25 PMmason kemmerer
12/07/2023, 9:27 PMLuke Heath
12/07/2023, 10:28 PM