https://github.com/osquery/osquery logo
Join Slack
Channels
general
android_tests
apple-silicon
arm-architecture
auditing-warroom
awallaby
aws
beyond-identity
carving
code-review
community-feeds
core
darkbytes
doorman
ebpf
eclecticiq-polylogyx-extension
extensions
file-carving
fim
fleet
fleet-dev
fleetosquery
foundation
fuzzing
golang
goquery
help-proxy
infrastructure
jobs
kolide
linen-dev
linux
loonsecio
macos
officehours
osctrl
plugins
process-auditing
qingteng
querycon
queryhub
random
selfgroup
sql
tls
uptycs
vendor-feeds
website
windows
zeek
zentral
zercurity
Powered by
# general
  • h

    hobo

    12/03/2018, 8:45 AM
    Hey everyone. I hope everything is alright with y'all. Can someone provide me with materials on registering Windows Hosts to Kolide Fleet ? Thanks in advance !
    u
    • 2
    • 1
  • u

    钢铁侠

    12/03/2018, 1:00 PM
    socket_events can't get data when it left join process_events I encountered strange things.I record my computer's some info with socket_events and process_events.here is my sql.
    Copy code
    sql
    select * from process_events
    select socket_events.*,process_events.cmdline,process_events.cwd,process_events.pid as pepid from socket_events left join process_events  on socket_events.pid=process_events.pid;
    but I found that the
    cmdline
    ,
    cwd
    ,
    pepid
    are all empty in
    socket_events
    .for eaxmple
    Copy code
    cmd:  curl <https://osquery.io>
    
    name": "process_events",
        "@version": "1",
        "columns": {
          "parent": "21451",
          "cwd": "\"/root\"",
          "btime": "0",
          "auid": "1001",
          "egid": "0",
          "atime": "1448209686",
          "owner_gid": "0",
          "owner_uid": "0",
          "path": "/usr/bin/curl",
          "cmdline": "curl <https://osquery.io>",
          "gid": "0",
          "pid": "21923",
          "ctime": "1461222192",
          "time": "1543840554",
          "uptime": "28088276",
          "mode": "0100755",
          "mtime": "1448209686",
          "uid": "0",
          "euid": "0"
        },
    
    
    "name": "socket_events",
    "@version": "1",
    "columns": {
        "pepid": "",
        "local_port": "0",
        "cwd": "",
        "status": "unknown",
        "auid": "1001",
        "path": "/usr/bin/curl",
        "action": "connect",
        "cmdline": "",
        "family": "2",
        "fd": "3",
        "pid": "21923",
        "local_address": "",
        "remote_port": "443",
        "time": "1543840554",
        "uptime": "28088276",
        "remote_address": "54.193.126.242"
    },
    as you can see,the
    socket_events
    row has the same pid with the
    process_events
    row,but the
    cwd
    ,
    cmdline
    ,
    pepid
    are all empty in
    socket_events
    table. it it very strange. this Scenario has happened in all my 10 host.
    p
    s
    • 3
    • 13
  • g

    groob

    12/03/2018, 5:48 PM
    the best way is to read through the documentation and try to set something up. and ask questions here along the way when you run into trouble
    e
    • 2
    • 2
  • g

    groob

    12/05/2018, 2:07 PM
    or change the query name
    i
    • 2
    • 1
  • u

    钢铁侠

    12/09/2018, 6:45 AM
    when I read the osquery
    sokcet_events.cpp
    source code, I found that
    Copy code
    // skip operations on NETLINK_ROUTE sockets
    if (saddr[0] == '1' && saddr[1] == '0') {
        continue;
    }
    why is the saddr with 10 the NETLINK_ROUTE sockets?I can not find some info about it,does anybody knows it?
    p
    • 2
    • 6
  • s

    Saw Klaus

    12/10/2018, 12:39 PM
    how can i make osquery log alert in slack?
    b
    • 2
    • 1
  • j

    jackjack

    12/11/2018, 2:14 AM
    hey channel Not sure if this is the right place to ask. But running into error using the flag
    --audit_allow_sockets
    p
    • 2
    • 2
  • a

    alessandrogario

    12/11/2018, 1:38 PM
    Thanks for not push forcing again, I really appreciate it! It's a lot easier to follow now 🙂
    f
    s
    • 3
    • 3
  • f

    fritz

    12/12/2018, 3:34 PM
    So.... is there any word on spending the extra $$ to get the >10,000 messages archive back for this slack? It is a major bummer not being able to find the answers and context to previously asked questions anymore.
    ➕ 4
    f
    • 2
    • 1
  • g

    groob

    12/13/2018, 8:28 PM
    A project like fleet (disclaimer I work on it) is a good fit for that with osquery‘ s distributed plugin
    c
    • 2
    • 1
  • c

    Chris R.

    12/13/2018, 9:09 PM
    I have a customer asking if osquery has been successfully used on SUSE Linux, specifically SLES 11.x Apparently they are having trouble making it run. I don't have any details. Anybody here know if the tool has been made to work on SLES?
    k
    • 2
    • 1
  • s

    ShawnT

    12/14/2018, 5:16 PM
    When doing an on-demand yara scan, does the signature file have to be stored locally or could it be stored in a fileshare?
    p
    • 2
    • 2
  • b

    Brian Rak

    12/14/2018, 8:56 PM
    other then disabling prelink?
    u
    • 2
    • 1
  • a

    alessandrogario

    12/16/2018, 1:08 PM
    @spookerlabs https://osquery.slack.com/archives/C08VA3XQU/p1544828441041800
    👍 1
    s
    • 2
    • 1
  • s

    speckled

    12/20/2018, 11:24 AM
    @钢铁侠 The flag is created by the macro HIDDEN_FLAG respectively OSQUERY_FLAG (see include/osquery/flags.h)
    u
    • 2
    • 1
  • a

    Anadi

    12/20/2018, 11:59 AM
    There is more than that. You will not be able to view the event tables, and may not be able to run queries on a schedule.
    z
    • 2
    • 2
  • j

    julient

    12/20/2018, 12:45 PM
    @speckled on resource control, I advise to use cgroups like https://github.com/juju4/ansible-osquery/blob/master/tasks/cgroups.yml (initial tips from trailofbits)
    👍 1
    s
    • 2
    • 1
  • p

    packetzero

    12/20/2018, 6:54 PM
    i was going to rig up a script to parse schedule and packs in config and determine the ideal event_expiry. Before I do, has anyone already done this?
    u
    • 2
    • 2
  • a

    alessandrogario

    12/24/2018, 10:04 AM
    is that macOS?
    a
    • 2
    • 25
  • c

    ccc

    12/27/2018, 7:49 PM
    hello quick noob question. I have osquery deployed with kolide fleet and have imported some query packs. Where can i view the results of the queries? I can’t seem to find any documentation on where the output is saved to. ty
    d
    • 2
    • 1
  • p

    packetzero

    12/28/2018, 4:35 PM
    the nproc has backticks around it - gets set to number of processor cores. you can skip the "-j XX" as well
    u
    • 2
    • 1
  • c

    ccc

    12/28/2018, 8:24 PM
    is there somewhere i can find some useful queries or kibana dashboards?
    z
    d
    • 3
    • 2
  • d

    defensivedepth

    01/02/2019, 6:21 PM
    Thanks @fmanco for the Slack workspace upgrade. Nice to be able to see older results from searches, etc
    🍻 5
    osquery 6
    ❤️ 9
    ➕ 4
    🎉 14
    f
    • 2
    • 1
  • d

    DaveW

    01/03/2019, 7:42 PM
    Q: If I create a custom attack pack like testpack.conf and co-locate with the others, is it as simple as adding that new path to the osquery.conf file? Or am i missing steps?
    z
    • 2
    • 1
  • b

    Ben C

    01/07/2019, 1:09 AM
    congrats on upgrading to standard plan so we have full history. 👏
    ❤️ 2
    🎉 3
    z
    • 2
    • 1
  • s

    shed7

    01/07/2019, 10:58 AM
    Hello, I've got a bunch of osqueryd running at 100% CPU, what can I do to find out why?
    j
    • 2
    • 5
  • s

    seph

    01/07/2019, 3:51 PM
    It’s easy to run expensive queries. One thing to look at is the
    osquery_schedule
    table. https://blog.kolide.com/profiling-osquery-performance-with-kolide-cloud-8e01097469db has some info (and there are probably other blog posts about)
    w
    n
    • 3
    • 8
  • a

    alessandrogario

    01/07/2019, 7:21 PM
    looking forward to your improvements packetzero 😄
    ➕ 1
    p
    • 2
    • 1
  • d

    defensivedepth

    01/07/2019, 7:21 PM
    Thanks for the clarification @packetzero
    p
    • 2
    • 1
  • s

    seek3r

    01/07/2019, 8:45 PM
    @packetzero, are you concerned with another tables or at the moment just the events ones?
    p
    • 2
    • 2
1...101112...905Latest