does osquery support communicating over gRPC?

hello all ! , is there way that osquery could see custom configuration files ? by example one on /opt/product/etc/test.conf

Hello This problem that there will be two processes to launch osquery service has been bothering me for a long time. Is there any good solution? I have tried all the information I found on the Internet, but I still can't solve this error

Q: do you know any presto connector for osquery?

Hello, I am new to osquery and have installed it to solve my own problem. I've been ratted recently which AVs are not detecting. Basically someone is remotely connected to my laptop. I am learning osquery to solve this problem. Please let me know if you can suggest tools/tips to help me. Many thanks

Been looking through the OSquery docs and I notice there is alot of random links to Table schema of various versions, would it be possible to generate something like

<https://osquery.io/schema/latest>

along with the versioned tags for linking to via Readthedocs.

@terracatta Do you know about earlier versions of macOS ?

Hi Everyone; I’m starting with osquery; is it possible to retrieve application metrics on Windows, just like the apps.last_opened_time on OSX?

How to convert last_execution_time to a human readable time format ? With unix, we can use the datetime(local_time, ‘unixepoch’, ‘localtime’) .. however, this logic is not working in windows

Can you be more specific? “The config/flags work with no errors?”

Let me try

is there no way to get a sockets llist from osquery in realtime? not listerns, i found that, i mean like out bound connections?

Heads up, I am doing some work on migration osquery infra to the osquery foundation. I do not expect to interrupt anything such as the osquery homepage. But bugs happen. 🙂

hello, is there a flag to only enable status logging to file system without getting the results logging

Sorry if this is the wrong channel… can’t find a more specific one that looks appropriate. Is it just me, or is the Yum repo for osquery broken? Following the instructions on the website from a fresh VM, I get the snippet that I’m including in the thread:

is there something up with the bucket where at least the Mac pkg downloads are hosted? getting this error as if either Amazon is having issues or the account is:

<Error>
<script>(function(){var t=[],e=!0;window.addEventListener("onelogin.markSubmitCandidates",(function(n){t.forEach((function(t){t.setAttribute&&t.setAttribute("data-ol-has-click-handler","")})),t=[],e=!1,window.dispatchEvent(new CustomEvent("onelogin.submitCandidatesMarked"))}),{once:!0}),EventTarget.prototype.ol_originalAddEventListener=EventTarget.prototype.addEventListener,EventTarget.prototype.addEventListener=function(n,o){var r=arguments.length>2&&void 0!==arguments[2]&&arguments[2];this.ol_originalAddEventListener(n,o,r),e&&"click"===n&&t.push(this)}})("")</script>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist</Message>
<BucketName>osquery-packages</BucketName>
<RequestId>3AA1F06777C219F3</RequestId>
<HostId>3kASpKs313IpFPYukrJpYcJbC5vv1NKVhv6Czk7+2Rpm35lB/1OfIrA/FAUy74rvDeLcflsJgso=</HostId>
</Error>

when trying to hit https://osquery-packages.s3.amazonaws.com/darwin/osquery.pkg

Hi, i'm having some trouble trying to resolve this issue when i execute my "osqueryd.exe" with its osquery.flags within a Windows host running osquery. I been researching this issue in this slack, but i don't know how to fix it. So far, i been trying to use "impl_thrift.cpp" in the "extensions" folder, obtaining the same result:

Thrift: Thu Sep 17 15:31:15 2020 Client connected.

Thrift: Thu Sep 17 15:31:15 2020 TPipe ::GetOverlappedResult errored GLE=errno = 109

Thrift: Thu Sep 17 15:31:15 2020 Client connected.

Thrift: Thu Sep 17 15:31:15 2020 TConnectedClient died: TPipe: GetOverlappedResult failed

Any suggestions? Thanks in advance

that doesn't make sense to me, is osquery actually keeping track here, or is the way I'm running the query incorrect?

is

osquery_schedule

only useful during an execution?

should it be included in the rule packs?

Hello, while trying to download

*<https://pkg.osquery.io/linux/osquery-4.4.0_1.linux_x86_64.tar.gz|osquery-4.4.0_1.linux_x86_64.tar.gz>*

from https://pkg.osquery.io/linux/osquery-4.4.0_1.linux_x86_64.tar.gz I get the following issue.

<Error>
<Code>NoSuchBucket</Code>
<Message>The specified bucket does not exist</Message>
<BucketName>osquery-packages</BucketName>
<RequestId>0A23C925024E0B12</RequestId>
<HostId>tOesVcAttGyYsWkbOBKVb7Pwan8mnM7Cp9OuMDXDTgqJGPZOB9HXKo4a5Kr/ynLS+DzgS+BFf9E=</HostId>
</Error>

Apologies, if this is not the right place to post this.

What’s up?

curl <https://pkg.osquery.io/rpm/GPG>
curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: <https://curl.haxx.se/docs/sslcerts.html>

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.

The

trusty/main

repos have not been updated since January. Please use

deb [arch=amd64] <https://pkg.osquery.io/deb> deb main

as documented on: https://osquery.io/downloads/official/4.4.0 (see https://github.com/osquery/osquery/issues/6181)

https://github.com/lifting-bits/mcsema/tree/master/examples/Maze in this example they take a maze game compiled for x86, lift it from the binary, and then compile it for arm without the source

Thanks Fritz. I am brand new to the osquery space. Any advice?

Thank you Fritz. I was speaking more from a sales perspective. 🙂 I just started with Uptycs and am looking to get introduced to folks in the osquery realm.

once a query gets denied (through the formerly termed "blacklisting"), does it ever get allowed to run again automatically?

When installing through the msi, there was osqueryd and osqueri available to run however when I build it, I cant run the service or find them

I'm trying to build osquery from source (for perf safety testing), and I'm running into this error?

CMake Warning at libraries/cmake/source/modules/utils.cmake:34 (message):
  Git version >=2.14.0 is required to perform shallow clones, detected
  version 1.8.3.1, falling back to full clones (slower).
Call Stack (most recent call first):
  libraries/cmake/source/modules/utils.cmake:150 (initializeGitSubmodule)
  libraries/cmake/source/modules/Findaugeas.cmake:11 (importSourceSubmodule)
  CMakeLists.txt:144 (find_package)
  CMakeLists.txt:69 (importLibraries)
  CMakeLists.txt:184 (main)


You need to run this command from the toplevel of the working tree.
CMake Error at libraries/cmake/source/modules/utils.cmake:56 (message):
  Failed to update the following git submodule:
  "/osquery/libraries/cmake/source/augeas/src"
Call Stack (most recent call first):
  libraries/cmake/source/modules/utils.cmake:150 (initializeGitSubmodule)
  libraries/cmake/source/modules/Findaugeas.cmake:11 (importSourceSubmodule)
  CMakeLists.txt:144 (find_package)
  CMakeLists.txt:69 (importLibraries)
  CMakeLists.txt:184 (main)

I want to group hosts by osq version but even with a GROUP BY, osquery always returns me one row per host