Hi, I'm currently using " listening_ports " table and " process_open_sockets " table with some joins with processes and related tables. The issue is that there's a hit and miss scenario where a connection might be open/closed between the query intervals and it may not represent actual data. To improve this, I'm thinking of using " socket_events " table instead with appropriate joins with process_events table etc. to replace both the queries/tables as stated above. Will it be sufficient or would I still be missing some data here ? Any suggestions are welcome. Thanks 🙂

@Vibhor I see. Thanks. If the output is very specific to my own system, should I write a logger-plugin? Does it require to add it to the source code and compile?

Hi All, Is there anyway to know process name from process id in osquery?

How would i go about installing Kolide and Upticks?

not in the way you’re asking for it, no. you’d have to run an instance of osqueryd in each vm to perform that kind of data collection.

I'm trying to capture fim events. I would prefer audit events over inotify but when I query process_file_events table, it doesn't return anything. But if I query file_events table, I get all the fim events. I;m using following flags: --disable_events=false --disable_audit=false --audit_allow_config=true --audit_persist=true --audit_allow_sockets --audit_allow_process_events=true --audit_allow_fim_events=true conf: "file_paths": { "fim": [ "/apps/osquery/fim/" ] } I've written a script which generates FIM events in directory '/app/osquery/fim' Am I missing something ? Any misconfiguration ? using osquery version: 3.2.6

I'm new to OSQuery and am wondering if there's any documentation on how the tables relate to each other. In other words, which column in table A make sense to use with which other column in table B to create a join condition? For example, there are a lot of "uid" and "uuid" columns but I'm not sure they necessarily make sense to use together in joins. Some are even different data types (text vs. integer).

Can we query *_events table more than once for same set of data ? Are events deleted from table as soon as they are first queried or they do persist in table as per --events-expiry flag value ?

Is tihs correct query to retrieve only VM processes from processes table ?

@fmanco, yes, I suspect something along those lines. So what is the way out/forward? Shouldn't the kill/pkill take care of that?

you have tools like ansible/puppet/chef which 1) update some config on disk. 2) reload the service managing the daemon (systemd/init/launchd etc)

Hey, is it possible for osqueryi to use the same database (using database flag) and query events which are registered in it via osqueryd ? So, instead of scheduling queries in osqueryd, can I use osqueryi to execute queries on event based tables ? Provided, osqueryd is configured correctly and is both osqueryd and osqueryi are using same database. Any comments ?

@Prakhar I’ve wondered the same thing myself, recently. One approach might be to write a custom Augeas lens to parse your file, and access those contents via the

augeas

table in osquery. I’d love to know if other have other ideas on how to query the contents of a file.

@Prakhar you can only write to custom table

but there is no entry for this command

@lvferdi, how about this -

SELECT users.uid, authorized_keys.* FROM users JOIN authorized_keys ON users.uid == authorized_keys.uid;

has there been any work on exposing DEP profiles on macOS?

is there a way to get queries from the shell_history table to return history data from shells besides sh and bash?

Question: I have a group of Linux (Ubuntu 16.04.4 LTS user space with 4.17.7 kernel) servers that have suddenly started running rather slowly. At the same time, one server in the group remains as fast as ever. I am trying to figure out what has led to this mysterious slowdown, and after messing around with top, htop, and various point Linux tools, I decided to switch to osquery to see if I can diagnose the issue. If anyone has some ideas on how to explore this issue with osquery, I'd appreciate it.

normally decorators are valid for all packs/queries. Can decorators also be used/identified per a pack or a query?

If you run the query like that with

osqueryi

it's going to try to get the results immediately which means there will be no events.

Hi everyone ! I’m currently trying to use the events tables, running osqueryd in the background, and querying periodically the tables with osqueryi --database_path, but I get

Failed to upgrade database

Has anyone tried this before ? I’ve seen this issue on github https://github.com/facebook/osquery/issues/4615 The script does fix the problem, but the osqueryd service has to be stopped and restarted to migrate and fixe the issue

I wrote an article about osquery architecture that some of you folks would probably be interested in: https://blog.kolide.com/osquery-under-the-hood-c1a8df46bb7a

So in that diagram "TLS Endpoint", "AWS", or "File System" which could also be a Syslog server or tool like Splunk?

@Mustafa any

_events

tables will be collecting events as long as

osqueryd

is running, and then when you query them you will get all the events since the last query was executed.

hi all, anyone using osquery module in filebeat with ELK. all my fields in kibana starts with json. i.e json.host_identifier despite having var.namespace: true

Wazuh (fork of OSSEC) has integrated osquery (https://github.com/wazuh/wazuh/releases/tag/v3.5.0 )

hey! apart from the facebook packs, is there a list of queries that people/companies are using for endpoint monitoring or security?