hello guys how are you looking for help regarding kolide fleet

anyone more familiar with how osquery is building boost have any insight into this linking error?

LINK : fatal error LNK1104: cannot open file 'libboost_date_time-vc142-mt-s-x64-1_70.lib'

Was trying to use

"boost/date_time/local_time/local_time.hpp"

in an extension

Was wondering if somebody could look into fixing https://github.com/osquery/osquery/issues/4300. It's a documentation issue, which caused a lot of gnashing of teeth because the docs didn't match the code at all.

Hi, can anyone confirm if the units of *_time columns of process table are ms?

I'm not able to find watchdog events in our SIEM. But I don't know where to check

IF

we're collecting these events in the first place

hey all, is it possible to use something other than Redis for fleet/osquery? is it possible to not use it at all and instead just use SQL?

Hi Folks. Does anyone know of a query that I can run that will use a lot of memory? I am testing memory consumption of osquery.

@Amol Khare You might get lucky by checking

system_info.hardware_serial

, VM's typically have atypical serials.

why does osquery only record things that happen if i run kitchen converge (vagrant back end) twice? (kitchen exec fails, kitchen login works but must be done manually, adding exec or bash to the recipe only works if i run converge twice) #beyondConfused

Hey guys, I released a blog based on the presentation I gave at infosecjupyterthon recording: “Untangling the Osquery❓ tables web🕸️ using Jupyter Notebooks📓” by Sevickson https://link.medium.com/exGJNfIKl6 Let me know if you have any comments or ideas. 😉

or do you only enable a subset of audit events for things you truly care about (e.g.

process_event

)

Has anyone been able to get processes.percent_processor_time column to return a non zero value on Linux with 4.3?

Are there any existing stats around memory resident size of osquery without any queries/packs enabled? Curious to hear how much cpu/mem resources folks usually give to osquery in your production fleet.

is there any information on OSQuery meta-characters and escaping?

where does the

tools

directory live? I don't see anything in

/etc/osquery

, is there something that should be installed from the rpm?

Hey people, is possible to add a windows host at kolide fleet?

Hi Folks, are there any guides on how to build CPP extensions? I tried to build the example extension by building the whole osquery project, but I'm not seeing the example_extension.ext file show up

Is it possible to query environment variables directly with an osquery statement?

Another possible way is obviously not shipping with all the dependencies statically compiled and take the ones from the system; though this won't work for our process, it can work for distro maintainers. We are still in the process of introducing a way to compile with system libraries; right now though, @Anatol Pomazau, one of the Arch Linux maintainers have a custom branch we helped a bit kickstarting, to get it compiled with system libs: https://github.com/anatol/osquery/commits/archlinux-rebase-4.2.0

Hello everyone. I'm new to osquery and learning it. i want to understand, when we pass custom conf file using osqueryi --config_path=/path/custom.conf, where does the output of the query printed? how do we find out if the query in config fie has been executed. even while using osqueryd --config_path=/path/custom.conf, i'm could not find out if the query has been executed

Hello, is there a stress test for osquery? I saw there was one but it has been removed

ah ok thanks for point that out ill follow it, for now ive disabled queries on those servers

Should I submit this as a bug report?

osquery> SELECT * FROM package_bom where path like '/private/var/db/receipts/com.github.salopensource.sal_scripts.bom';
osquery> SELECT * FROM package_bom where path == '/private/var/db/receipts/com.github.salopensource.sal_scripts.bom';
zsh: segmentation fault  osqueryi

what is the implication of setting

removed: false

in a query? I'm having some difficulty understanding what the expected behavior should be.

question for the channel - who's using cgroups with osquery? Looking for stories about this, advice, pitfalls, your settings, etc. <thread>

Has anyone successfully enabled eventing framework through Daemonset? I want to host the osquery agent as a Daemonset but would like to enable process eventing. Auditd won't lauch within the container. How do I open up a netlink socket from the container to the host? Any other approach that would work?

Hi! Probably you might already heard about the recent thunderspy.io and the attacks on thunderbolt ports, I was wondering if anyone explored the use of osquery to detect potential vulnerable devices? (I can think of two sources of information: thunderbolt ports and boot camp usage). Looking for hardware related tables seems to be possible to list for thunderbolt ports through pci_devices, but there’s no such table for Windows

It appears to me that the OSQUERY_KEY is missing on keyserver.ubuntu.com. Am I mistaken?

Is there a document how install fleet in windows?

may anybody help me?