Howdy folks, I'm trying to test packs, but I keep getting

Error reading the query pack named: ...

- am I missing something? I'll put a little more details in the 🧵

When carving, I am getting the message, "I0524 173332.621054 10575 carver.cpp:186] Failed to post carve: No session_id received from remote endpoint" Any idea what is happening and how to avert?

howdy channel 🙂 wonder what everyone is using to monitor the running status of osqueryd these days? cron? osqueryctl? launchtl? ps-aux? thank you

Hi All, Here is a vulnerability reported in YARA library by Black Duck software. https://nvd.nist.gov/vuln/detail/CVE-2021-3402 This vulnerability affects all versions before libyara 4.0.4 and it seems osquery uses YARA 4.0.2. Would this vulnerability have an impact on the osquery running on Windows ? Thanks!

Hi there, Is there anyway to enhance details in any _events tables? For instance, I configured user events collection and created a test user. the entries in the table were only | 0 | 0 | 15161 | op=add-group | 1116 | /usr/sbin/useradd | ? | pts/3 | 1621952044 | 12789 | | 0 | 0 | 15161 | op=add-user | 1114 | /usr/sbin/useradd | ? | pts/3 | 1621952044 | 12789 | However, if I collect events via osquery daemon, th eentries were quite rich in var/log/osquery/osqueryd.results.log {“name”“pack fim monitoring file events”,“hostIdentifier”“uk-9750-000c29e2a944",“calendarTime”:“Tue May 25 133330 2021 UTC”,“unixTime”1621949610,“epoch”0,“counter”0,“numerics”false,“decorations”{“host uuid”“3B004D56-9286-0147-0C53-F51415E2A944”,“username”“saadmin”},“columns”{“action”“CREATED”,“atime”“1621949430",“category”“home”,“ctime”“1621949430",“gid”:“1012",“hashed”:“1",“inode”:“296",“md5”:“620f0b67a91f7f74151bc5be745b7110",“mode”:“0700",“mtime”:“1621949430",“sha1”“1ceaf73df40e531df3bfb26b4fb7cd95fb7bff1d”,“sha256”“ad7facb2586fc6e966c004d7d1d16b024f5805ff7cb47c7a85dabd8b48892ca7",“size”:“4096",“target_path”“/home/saadmin”,“time”“1621949430",“transaction_id”:“0",“uid”:“1012"},“action”:“added”}

Big news https://www.elastic.co/blog/whats-new-elastic-security-7-13-0 osquery fleet manager built into elastic

Hello again! Could you please help me to understand some details about “instance” host_identifier? Where is it actually stored? And in what cases can it change? Reboot? Reinstall/update Osquery? I am trying to solve problems for identifying users’ endpoints when hostnames can be duplicated (like default “MacBook Pro”), which leads to problems with enroll. It seems that uuid is a good option for users, not servers. We tried the instance, but it seemed that after reinstalling / updating osquery, the entries are duplicated in the flit.

When Carving the files and the watcher is terminating the process as the thresholds are crossed, I see the temporary files created is not cleaned up properly. Is this expected or some config did I miss?

how does https://osquery.io/schema/4.8.0#ec2_instance_tags work? I'm currently on an instance, running

select * from ec2_instance_tags;

and it returns nothing.

Hi there, why cannot I query device_partitions without a WHERE clause? I wanted to list all parititions on centos7 if that matters.

Still inverstigating changes in event framework from 4.7.0 and 4.8.0 Seems like

events_max

now closely tied with

events_expiry

. Previously

events_max

meant number of events to preserve in database at cleanup. Now it's a number of batches, and batches are formed by event time. Shouldn't this change be in

4.7.0

changelog?

Hi! I have a small question, I added my OS_QUERY client on my Debian server, it shows up well in Fleet_DM but does not appear in the list of operating systems unlike my Windows agents. Do you have any idea? Thank you!

Is there any benefit from having two of the same queries running at different intervals, one that is set to

snapshot

and the other set to

differential

? Or would it make more sense to just have

differential

on a more frequent schedule?

Hey everyone 👋 Just joined. We’re using Uptycs/osquery for asset mgmt and IDS, looking to learn all I can about osquery in the process 🙂

Yet: "options": { "config_plugin": "filesystem", "logger_plugin": "filesystem", "logger_path": "/var/log/osquery", "disable_logging": "false", "log_result_events": "true", "pidfile": "/var/osquery/osquery.pidfile", "events_expiry": "3600", "verbose": "false", "worker_threads": "2", "enable_monitor": "true", "disable_events": "false", "disable_audit": "false", "audit_allow_config": "true", "host_identifier": "hakase-labs", "enable_syslog": "true", "syslog_pipe_path": "/var/osquery/syslog_pipe", "force": "true", "audit_allow_sockets": "true", "schedule_default_interval": "3600", "schedule_splay_percent": "10", "database_path": "/var/osquery/osquery.db", "utc": "true" },

is there a way to join apt_sources and deb_packages to see all of the available packages by where it's from?

👋 Annual “falco vs osquery” gap analysis question: Both support eBPF. Falco has some blocking/prevention features, but besides that, is there more Falco has to offer over osq for k8s monitoring?

Is there a way to read NTP information on the host? meaning, settings of chrony or ntp server on linux? This question has been asked before on the channels but unsure if there was a clear way.

Is this where we can ask questions about fleetdm?

@Stefano Bonicatti Ah! Ok got it, thank you so much!

Hi everyone, my name is Jason and I have a quick question on this. Once I enroll a osquery client to Kolide and I no longer see logging events in this log file (/var/log/osquery/osqueryd.results.log) is this an expected behavior? Can somebody share their experience with this? Thank you. jh

Hi everyone "Failed to load certificate. Is Fleet App URL configured properly?" how do i deal with this.trying to install Fleetdm and integrate with osquery

Hi, I am enabling osquery on a linux system, and Iooking for logs on mount and umount of file systems. I see those logs on /var/log/messages file but when I check syslog_events table I dont get these logs. Did anyone face a similar issue?

Hi, my name is Silvano and i have a quick question regarding setting up Fleetdm. I have been trying to add the hosts in vain and it appears like its an issue with the self-signed certificate. I'd appreciate if someone could guide me on how to enroLl hosts to FleetDM Error,

I0615 15:16:19.983693 17433 tls.cpp:255] TLS/HTTPS POST request to URI: <https://172.27.63.225:8412/api/v1/osquery/enroll>
W0615 15:16:20.030148 17433 tls_enroll.cpp:77] Failed enrollment request to <https://172.27.63.225:8412/api/v1/osquery/enroll> (Request error: certificate verify failed) retrying...

Hi , When I query the process_file_events table in osquery 4.7 and 4.8 I see the following error displayed E0611 210245.777830 4057 eventsubscriberplugin.cpp:700] Found 9 invalid events (9 have been successfully erased) This was working in osquery 4.6. Anyone know the root cause and is there any workaround?

Hi #general, can anyone tell from the logs below why I could not start osqueryd at all? This just happened suddenly

New to OSquery. Can anyone help me understand what i am doing wrong. I am looking to enable file_events. Where exactly do i enable this feature?

Has anybody set up osquery to be serverless? I am unable to find much information about it except for a video by cloudflare which deploys it in GCP.

Is anyone using osquery to check software against CVEs for vulnerabilities?

Is anyone able to tell me how I can put a file hash into the hash table plz?