osquery #general

Chad Bennett

07/31/2022, 3:46 AM

Does anyone have any open source recommendations for MDM functionality on Windows machines?

jimmy

07/28/2022, 12:02 PM

I want to have a server that manage all the yara queries. the problem is that I don't want to add every time new rule to the conf file like at the example at the osquery site. because it means I will need to deploy the new file evry time at all the agents. example: "yara": { "signature_urls": { "sig_url_1": "https://raw.githubusercontent.com/Yara-Rules/rules/master/cve_rules/CVE-2010-0805.yar", "sig_url_2": "https://raw.githubusercontent.com/Yara-Rules/rules/master/crypto/crypto_signatures.yar", "sig_url_3": "https://raw.githubusercontent.com/Yara-Rules/rules/master/malware/APT_APT3102.yar" } } I wanted to know if there is any way that I will have yara server that manage all the queries without modifying the conf file every time I add the server new query.

zwass

08/02/2022, 6:14 PM

Has anything changed with the osquery build? I was able to build successfully using the instructions a couple weeks ago, but now I'm getting an error:

Copy code

cmake -DCMAKE_OSX_DEPLOYMENT_TARGET=10.12 -DCMAKE_C_COMPILER=clang -DCMAKE_CXX_COMPILER=clang++ ..
CMake Warning (dev) in CMakeLists.txt:
  No project() command is present.  The top-level CMakeLists.txt file must
  contain a literal, direct call to the project() command.  Add a line of
  code such as

    project(ProjectName)

  near the top of the file, but after cmake_minimum_required().

  CMake is pretending there is a "project(Project)" command on the first
  line.
This warning is for project developers.  Use -Wno-dev to suppress it.

CMake Error at process/CMakeLists.txt:31 (add_osquery_library):
  Unknown CMake command "add_osquery_library".
Call Stack (most recent call first):
  process/CMakeLists.txt:9 (generateOsqueryProcess)
  process/CMakeLists.txt:106 (osqueryProcessMain)


CMake Warning (dev) in CMakeLists.txt:
  No cmake_minimum_required command is present.  A line of code such as

    cmake_minimum_required(VERSION 3.23)

  should be added at the top of the file.  The version specified may be lower
  if you wish to support older CMake versions for this project.  For more
  information run "cmake --help-policy CMP0000".
This warning is for project developers.  Use -Wno-dev to suppress it.

-- Configuring incomplete, errors occurred!

Stefano Bonicatti

08/02/2022, 6:21 PM

@zwass that seems like the cmake command it's not being pointed to the top level CMakeLists.txt

Victor De Souza

08/02/2022, 8:09 PM

Does anyone have any suggestions on running

profile.py

with an extension? When I pass it our .conf file, all queries that come from our extension returns a -1

daguy666

08/03/2022, 2:24 PM

How do we invite people here?

Victor Chaplygin

08/03/2022, 5:13 PM

Hi folks! Is it planned to expand the default tables in osquery? For example containerd, crio, kubernetes

Tommy P

08/03/2022, 8:37 PM

What up yo

Tommy P

08/03/2022, 8:38 PM

Wut it dew

pvirani

08/04/2022, 5:15 PM

I am getting these errors when running

sudo add-apt-repository 'deb [arch=amd64] <https://pkg.osquery.io/deb> deb main'

any idea why or how to solve it?

Copy code

Err:19 <https://osquery-packages.s3.amazonaws.com/xenial> xenial Release                          
  404  Not Found
Err:6 <http://apt.datadoghq.com> stable Release.gpg                                               
  The following signatures couldn't be verified because the public key is not available: NO_PUBKEY

E: The repository '<https://osquery-packages.s3.amazonaws.com/xenial> xenial Release' does not have a Release file.
N: Updating from such a repository can't be done securely, and is therefore disabled by default.
N: See apt-secure(8) manpage for repository creation and user configuration details.
W: An error occurred during the signature verification. The repository is not updated and the previous index files will be used. GPG error: <http://apt.datadoghq.com> stable Release: The following signatures couldn't be verified because the public key is not available: NO_PUBKEY

pvirani

08/04/2022, 5:16 PM

this was working fine up until a couple of months ago. Seems to have broken in the last couple of months

Stefano Bonicatti

08/04/2022, 5:30 PM

@pvirani are you sure that you don’t have the repository being added multiple times? I seem to recall in a distant past osquery had different choices for some distributions versions, but now it’s “generic”. When I update I see:

Copy code

Hit:9 <https://osquery-packages.s3.us-east-1.amazonaws.com/deb> deb InRelease

Stefano Bonicatti

08/04/2022, 5:32 PM

So you might want to check your

/etc/apt/sources.list

and

/etc/apt/apt.conf.d

folder for anything that specifies the repo with the other format

Zohaib Nasir

08/05/2022, 1:51 PM

Hi everyone, I have configured fleet server. Hosts section not displaying IP address, Mac address info. Also, in 'Last Fetched' column, its displaying 'Never'. Any idea what could be the issue? i am using fleet version 4.18.0 and osquery version 3.3.0.

Jordan

08/05/2022, 5:00 PM

G’Morning folks….I have written a logging plugin that is logging the status logs great, but I have been playing with the flags for an hour and I can not get the scheduled queries to log there as well. Has anyone gotten this to work successfully?

ihor

08/08/2022, 7:32 AM

Hi, is osquery version 5.4.0 still considered as a pre-release? We get "..-dirty" at the end of the version when try to compile from master (tag 5.4.0)

Zohaib Nasir

08/08/2022, 11:55 AM

Hi everyone, I am getting 'certificate verify failed' error while connecting osquery to fleetdm. i am using osquery version 5.4.0 and fleetdm version 4.18.0. when i use osquery version 4.1.2 it works absolutely fine. Any idea what could be the issue? W0807 063845.080950 5115 tls_enroll.cpp:101] Failed enrollment request to https://IP:8080/api/osquery/enroll (Request error: certificate verify failed) retrying... W0807 063849.117959 5115 tls_enroll.cpp:101] Failed enrollment request to https://IP:8080/api/osquery/enroll (Request error: certificate verify failed) retrying...

Stefano Bonicatti

08/08/2022, 12:17 PM

@Zohaib Nasir how are you providing the certificates? If you’re not using the defaults so, providing flags like

tls_server_certs

and similar, be sure to give them through the flagfile or the process arguments, not the config file. In 5.4.0 we enforce this, because they are CLI flags and shouldn’t be given or changed through the config file. You will also get warnings in the logs about them if that’s the case.

Zohaib Nasir

08/08/2022, 12:34 PM

@Stefano Bonicatti I am using below command to connect to fleetDM server. sudo /usr/bin/osqueryd --host_identifier=instance --enroll_tls_endpoint=/api/osquery/enroll --config_plugin=tls --config_tls_endpoint=/api/osquery/config --config_path=/etc/osquery/osquery.conf --config_refresh=10 --disable_distributed=false --distributed_plugin=tls --distributed_interval=3 --distributed_tls_max_attempts=3 --distributed_tls_read_endpoint=/api/osquery/distributed/read --distributed_tls_write_endpoint=/api/osquery/distributed/write --logger_plugin=tls --logger_tls_endpoint=/api/osquery/log --logger_tls_period=10 --disable_events=false --disable_audit=false --audit_allow_user_events=true --audit_allow_selinux_events=true --audit_allow_process_events=true --enable_syslog=true --tls_hostname=FleetDM_IP:8080 --flagfile=/var/osquery/flagfile.txt --enroll_secret_path=/var/osquery/enroll_secret --tls_server_certs=/var/osquery/fleet.pem

Ibra

08/08/2022, 12:37 PM

hi all, is it possible to run a query from the fleet gui that allows changing the server hostname on the endpoints? basically I need to migrate all endpoints to a new fleet server with new FQDN

Aleksandr Maus

08/08/2022, 4:11 PM

Hi 👋 I was playing with https://github.com/osquery/osquery-go library, trying to cancel the

Query

call through the context timeout/cancellation and it doesn’t seem to work. The

Query

call still waits until the query completes. Checking the ctx.Err() after the call verifies that the context was indeed cancelled. Anybody saw this before? before I dig any further

Sagar Patil

08/08/2022, 4:56 PM

Hello team , I was trying integrate one of Linux server which have wazuh agent already installed enroll with osquery . But osqueryd isn't intiating after several attempts , can anybody tell what I am doing wrong ?

Hugh (Zercurity)

08/09/2022, 4:02 PM

@Zohaib Nasir have you enabled logging in the flags?

Hugh (Zercurity)

08/09/2022, 4:02 PM

Copy code

--logger_plugin=filesystem
--logger_path=...

Hugh (Zercurity)

08/09/2022, 4:03 PM

Probably a configuration issue. You could also try running it directly from the command line.

Zohaib Nasir

08/09/2022, 4:04 PM

@Hugh (Zercurity) I used below command to create the service. "C:\Program Files\osquery\osqueryd\osqueryd.exe" --host_identifier=instance --enroll_tls_endpoint="C:\Program Files\osquery\api\osquery\enroll" --config_plugin=tls --config_tls_endpoint="C:\Program Files\osquery\api\osquery\config" --config_path="C:\Program Files\osquery\etc\osquery\osquery.conf" --config_refresh=10 --disable_distributed=false --distributed_plugin=tls --distributed_interval=3 --distributed_tls_max_attempts=3 --distributed_tls_read_endpoint="C:\Program Files\osquery\api\osquery\distributed\read" --distributed_tls_write_endpoint="C:\Program Files\osquery\api\osquery\distributed\write" --logger_plugin=tls --logger_tls_endpoint="C:\Program Files\osquery\api\osquery\log" --logger_tls_period=10 --disable_events=false --tls_hostname=MyIP:8080 --flagfile=flagfile.txt --enroll_secret_path=enroll_secret --tls_server_certs=fleet.pem --install

Zohaib Nasir

08/09/2022, 4:06 PM

@Hugh (Zercurity) I ran the command from command line.

Hugh (Zercurity)

08/09/2022, 4:07 PM

well, right off the bat, --enroll_tls_endpoint="C:\Program Files\osquery\api\osquery\enroll"

Hugh (Zercurity)

08/09/2022, 4:07 PM

is invalid

Hugh (Zercurity)

08/09/2022, 4:07 PM

as well as --config_tls_endpoint="C:\Program Files\osquery\api\osquery\config"