Channels
#general
- t
thor
09/26/2017, 7:45 PM@Ben https://github.com/facebook/osquery/issues/3734 THanks 🙂👍 1b- 2
- 1
- s
Stephen Touset
09/28/2017, 7:18 PMCopy codeosquery> SELECT username, key FROM users JOIN authorized_keys USING (uid) WHERE authorized_keys.key LIKE 'ssh-rsa %' LIMIT 1; ... virtual_table.cpp:516] The authorized_keys table returns data based on the current user by default, consider JOINing against the users table ... virtual_table.cpp:531] Please see the table documentation: <https://osquery.io/docs/#authorized_keys>t- 2
- 1
- r
reed
10/03/2017, 7:53 AMHow soon after tagging does a release actually get pushed to the website and to the deb repo?ct- 3
- 4
- a
ag4ve
10/03/2017, 6:46 AMSo saw this and two things came to mind (wrt osquery) https://motherboard.vice.com/en_us/article/evpmyw/some-macos-users-arent-getting-the-firmware-security-patches-they-think-they-havec- 2
- 1
- a
ag4ve
10/03/2017, 6:49 AM1. Is it possible to show firmware version (and how reliable is that - obviously if you're owned all bets are off but is versioning reliable here too) I need to Google some (though if the group has looked into this...t- 2
- 2
- b
barn
10/03/2017, 10:29 PMalso https://github.com/facebook/osquery/releases implies 2.8.1 is released, but el website does not?c- 2
- 1
- p
psbkb
10/12/2017, 8:28 PMdo I need to run the malware and run the query around the developed IOCc- 2
- 1
- t
theopolis
10/13/2017, 2:18 PMHey @Ben, thanks for checking that out, are the parameters accessible on Darwin the same way?b- 2
- 1
- b
barn
10/24/2017, 12:28 AMis
on by default, aka, what have I done?--logtostderr Log messages to stderr in addition to the logger plugin(s)- 1
- 2
- t
theopolis
10/25/2017, 12:57 AMIt looks like a few of the inline command, switches, are being interpreted incorrectly like double-dash being formatted as a long dash. Is there a way to fix that? Also the process_events can be powered with OpenBSM now, the kernel extension is not supported at all anymore.z- 2
- 1
- t
theopolis
11/07/2017, 1:46 AMJenkins has nothing to do with package hosting :) sleep well knowing Jenkins is not in the critical path of anything osquery relateda- 2
- 1
- s
stefanmaerz
11/10/2017, 2:20 AMSo far OSquery has been absolutely awesome. Am really liking what I am seeing from the tool and the communityosquery 5c- 2
- 1
- m
marpaia
11/16/2017, 6:27 PMwe definitely want to make it feel like something that is for the osquery community and vendor neutral so if there are bits or flourishes you think we could iterate on, we’d be happy to!l- 2
- 1
- g
groob
11/17/2017, 10:18 PMI've been playing with oklog in fleet. not sure if I have enough to report on yet, but it's a very fun experiment https://github.com/oklog/oklogs- 2
- 8
- c
clippy
11/18/2017, 1:31 AMdo you have a space between your two logger plugins?p- 2
- 5
- t
theopolis
11/22/2017, 1:56 AM@zwass @npamnani any chance you could investigate the AWS? Unfortunately we don’t use the integrations so we rely on everyone else on that front :Dz- 2
- 2
- c
clong
12/04/2017, 11:31 PMwould any VCs like to invest in my startup?acs- 4
- 5
- d
diptanu
12/20/2017, 7:19 PM@theopolis Any thoughts about the table name?t- 2
- 1
- c
clippy
12/21/2017, 7:25 PMHey folks! We're going to be open sourcing our Osquery TLS server + logging infra project at a DFIR meetup on Jan 17th. If you're in the bay area on Jan 17th it would be awesome to have folks show up and tell me how bad my code is 🙂🍻 13as- 3
- 7
- s
spookerlabs
12/28/2017, 5:30 PMThere we go! Nice stuff Beats crew is developing https://twitter.com/tudor_g/status/946392995049476098👍 1l- 2
- 1
- p
pmahoney
01/23/2018, 6:34 PMnot sure if that InRelease file needs to be there and is missing, or if 17.10 considers it a fatal error while 17.04 doesn't, or what- 1
- 5
- p
pickmansec
01/24/2018, 6:33 PMThe context of the question was identifying reinstalled systems- 1
- 2
- g
groob
01/29/2018, 4:30 PMwe can help in #kolidem- 2
- 1
- c
coolguru
01/31/2018, 4:02 PMLet me know what you think about go audit after checking it out. Thanks!s- 2
- 2
- j
James McPhee
01/31/2018, 6:38 PMi haven't looked too much into osquery's audit stuff to see if we can do anything advanced on system. currently we're using it as basically a relay. get the audit messages sent to centralized logging soonest. but that's because we're snapping it in to replace auditd and then go-audit. if there's more we can do with it, i'm sure it'll come up once we finish the migrationj- 2
- 2
- m
marpaia
02/01/2018, 7:34 PMif you ever need a server to do something, chances are @groob has already written a popular open source implementation of it🍺 5cg- 3
- 3
- t
theopolis
02/02/2018, 3:18 AM@jaredl, that's correct, there was no "watchdog_utilization_limit" originally, it was just a "level" where the default was normalj- 2
- 19
- j
jaredl
02/05/2018, 8:24 PMYeah I thought so as well, we’ve only got 15
configured for watching and none of these appear to be directly related to the activities offile_pathsnagios- 1
- 6
- t
theopolis
02/06/2018, 2:20 AMI see just about 300 in active test within our infra, which is very low, and @obelisk is the point person on if/where we'll be testing. But for those with audit usage, it is highly recommended to update and test! and we will love you forever if you doj- 2
- 20
- m
marpaia
02/06/2018, 4:11 PM@seph we’re really looking for a pretty wide range of talks from new-user experience stories (i am new to osquery and i recently set up a pipeline and this is what was hard about it) to deep-dives into subsystems of osquery (like IR, FIM, process auditing, etc)s- 2
- 2