Is Fleet the successor to Kolide Fleet?

Hey all I am having issues using fleet to carve a file from a user's Downloads directory on OSX 10.15.7. I have tested both osquery 4.4.0 and 4.8.0. I have configured the PPPC profile per https://osquery.readthedocs.io/en/stable/deployment/process-auditing/#automatically-granting-permissions-silent-installs. Is there something special required for fleet carving from Downloads?

Does osquery either report to fleet OR write to a local log or can it do both?

Hello everyone! I've updated my issue about android here : https://github.com/osquery/osquery/issues/7144#issue-913346308. Feel free to correct what seems to be wrong. I know that my post is a bit long. To sum up: if we want to use Osquery as an app (service or deamon) on Android, it is needed first to compile with the Android NDK (cross-compilation). And one of the biggest issues is that NDK (BIONIC) does not support the pthread_cancel function of gnu-libc. There is a function that BIONIC proposes as replacement (pthread_cleanup_push), but the arguments are differents, so I'm not sure whether it is possible. Thus, right now, the solution that seems to work fine, is to compile from a Linux-arm machine with static option to provide a binary that will run as a deamon in the system layer (will not run in the Java Android layer). I know that it is not functionnal for the user and it could not be a real portage solution, but it works (osqueryi and osqueryd) with some restrictions that I try to enumerate. The next step for me is to make some tables for Android. From now on, I can't go on with the NDK compilation (unless you can help me with this) @alessandrogario @Mike Myers @Stefano Bonicatti

Hello, if I set some environment variables in the OS, can I retrieve them using OSQuery? Or alternatively is there some other method where I can retrieve a constant value that I set per device? I was setting a decorator query in each .conf file previously to do this, but since moving to fleet, having the shared conf means I can't do that now, so I guess setting an Environment variable on heach machine and querying it will be best way?

tough crowd

I assume this has been asked before, but… if I have a client hooked up to a TLS server with multi-day intervals and I want to trigger it to re-run all queries in the pack 'scoped' to the client, there's no way to restart the interval counter via HUP'ing daemons or something client-side, is there?

Hi everyone. I have a newbie question about creating a table. I followed the instructions to create a simple uptime table (I called test). At the end of the building process, I got this error : no rule to build the target " ../specs/test.table", needed for "specs/native/test.cpp". I created 2 files : test.table file and put it in osquery/specs/linux/; and test.cpp and put it in osquery/osquery/tables/utility/. I also added : test.cpp line in the function generateTablesUtilityUtilitytable() in osquery/osquery/tables/utility/CMakeLists.txt; and added android.table line in the function generateNativeTables() in osquery/specs/CMakeLists.txt. I don't see where is the problem here. Why the rule is not found?

Hi everyone, just a quick question. Since for tls mode, authentication and enrollment is needed. Is it possible to do this on a lambda function? I am asking this because i am trying to use lambda as a central management server where it can query the endpoints. Please do let me know if it does not make sense to do this. Just exploring options. Thanks!

Hello! I know that Android is not officially supported yet, but I want to try to make several tables for this platform (it could be usefull someday). I will make a blueprint to deal with this. But first I want to know whether my code is correct before doing other tables. I made a table for Android that queries an important file called packages.xml (all information about the apps on the system). It is needed to be root on the phone to get reponses for those table, but I will try to make tables to get other usefull information on the system without being root. So if you see something wrong in the code, please tell me

exe

are windows binaries. There will never be one built on macos. bison and flex using the system one sounds like it’s not building under rosetta, or finding the binaries. That sounds a lot like it’s grabbing some native paths. Vagrant is some larger testing thing. If you’re trying to build, you don’t need it

This message was deleted.

sorry for the amateur question. But does anyone know how to join os_version table to rpm_packages table? i cant seem to find a common identifier to perform the join. Thanks!

how to get osqueryi on mac or how to use -S flag?

@seph are you able to define a different OSQUERY_HOME somewhere?

Hi the have version of osquery to Raspbian 10 ?

has anyone been able to set the secret and tls cert path in osquery.flag in windows? If i set the full path "C:\Program Files\osquery\secret.txt" it is unable to read it but if i just set it as secret.txt and cd into the dir and run osqueryd --flagfile="C:\Program Files\osquery\osquery.flag" it works.

Hi all , I am new to os query. I have a question and this is based on my understanding. can os query alert on short live process such a malware activity ( opening cmd.exe from winword) and if that process is terminated with in a very short time can we monitor those. because a query on os query will return results only when we run the search. what if we were not running the search at the time of malware activity. It would a potential miss right.

Anyone getting error for binary based installation of fleetdm on ubuntu. Iam getting a 404. It's wired 🤔

Is there a schema for google cloud instance meta data?

Hello! Recently came across OSQuery and I'm currently playing around with it and Kibana. I have imported the dashboards provided by the osquery module for FileBeat and I'm seeing some errors in the visualizations such as:

Saved field "osquery.result.host_identifier" of index pattern "osquery-*" is invalid for use with the "Unique Count" aggregation.

Anyone else happen across this and know of a solution?

is there any

osquery

extension written in C? that interacts with the

osqueryd

specifically. or any idea how to make one?

This the only way for FreeBSD? I looked and on the freshports repo it is version 3.33 or something super old.......

Hello, has osquery changed how osqueryd.results.log works? It now uses a sticky bit and I can't find any documentation to what changed? I am struggling to change these permissions as the daemon keeps changing it back which means I can't log my results into splunk. Thanks

the fact that you're seeing that indicates either extremely high disk activity (we're reading from a ring buffer) or a bug in the NTFS journal reader, which might be possible if they changed formats underneath us

is there a way to get cpu utilisation and memory information from windows? The tables cpu_time and memory_info dont seem to be there in windows

Hi, is there a way to get process events in windows using osqueryd? I know that we can use process_events table for Linux, but is there something similar for windows too?

Where's the best place to discuss troubleshooting why an additional pack .conf is not loading for me?

Next question: what is the expected output of osqueryctl config-check? my config loads successfully and osqueryd starts up, gets a pid, etc. and shows query packs loaded, etc. However, when I do an osqueryctl config-check I get a bunch of RocksDB [WARN] errors (samples attached in thread)

Hi there can somebody share any other "Fleet-Kolide" like console solutions out there either pen source or paid? Thank you. jh