I found a very old PR to address this issue but only for Windows. https://github.com/osquery/osquery/issues/3929

Hello all. I just want to double check. can you only have one flagfile? I'm looking at an osquery distribution that likes to update/replace it's own flagfile but I might need to change some values to work on my platform I was hoping I could just do

--flagfile=first.flags --flagfile=overrides.flags

but I don't think that'll work scanning over the docs

First question and first exploration of osquery. I have the client installed and I can use Fleet to query the agent, simple queries like SELECT * FROM processes; work like a champ. I now want to set it up so file edits are reported, so if a file is created or edited, something will appear in Fleet. With the default install, what directories does osquery report on? How is that changed? Should I be using a query like SELECT * FROM file_events; or something different? Any help appreciated.

Regarding FIM, how are others handling initialization of systems & ensuring you’re not alerting on bootstrap changes, e.g cloud_init completion? For our autoscaling & replaceable nodes this is a high noise possibility. I’m thinking of utilising something like uptime - if uptime is <30mins then ignore FIM results. Curious as to what others are doing though.

Hello all. What is the best way to find the hash of a malicious .exe file on all hosts in a domain using osquery? And i try find .exe file, in directory \Users\%\Downloads\%%\%.exe but it dont find file in dir: \Users\user1\Downloads\dir1\dir2\evil.exe

how do I find from OsQuery the shared network recourses that mapped to my computer

In general, it seems like

osquery

might have trouble finding a specific file in the haystack that is a node's filesystem…

Welcome!

Johnny SRE

joined #general.

hi all. I'm trying to install osquery on a Debian 11 box and I keep getting the message

"GPG error: <https://pkg.osquerypackages.com/deb> deb InRelease: The following signatures couldn't be verified because the public key is not available.

Yet I've clearly added the GPG key using the following syntax:

apt-key adv --<http://keyserver.ubuntu.com|keyserver.ubuntu.com> --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B

What could I be doing incorrectly?

Welcome!

Alex Willingham

joined #general.

👋 Hi everyone! I doubt I’m alone but I’m probably not the common member here. I’m looking for solutions that would support IT support for family members, in particular aging parents at a distance. In my day job i’m a backend/platform engineer for an insurance startup. I’m a little surprised there seems to be little in this space targeted at folks who have families with kids, grandparents, and adult partners with an indifference to digital hygiene. I can’t be alone. In the short term I’m looking at simple ways i can make safe decisions easy and unsafe decisions hard. And then figuring out how to manage things like network settings to ensure I can connect to the devices through vpn.

Hello! I followed the "deploy on aws with terraform" instructions from here, https://fleetdm.com/docs/deploy/deploy-on-aws-with-terraform. Terraform deployment succeeded, but the ECS task is failing with the same error over and over, "Your Fleet database is not initialized. Fleet cannot start up."

[osquery:master] 1 new commit by Victor Häggqvist:

<https://github.com/osquery/osquery/commit/55145b381df286c3571fd09ca7e6ff67ea4f3870|55145b381df286c3571fd09ca7e6ff67ea4f3870>

Add additional chrome extensions paths (#8170) - Victor Häggqvist

Welcome!

dimaivanov1234

joined #general.

I want to restrict the Windows 10 machines we use at school during break time. Students are breaking computers. Can Fleet manage devices? Example: The PC was forgotten to be turned on remotely, let me turn it off with Fleet.

Welcome!

GrepCaffeine

joined #general.

[osquery:master] 1 new commit by Zach Wasserman:

<https://github.com/osquery/osquery/commit/89ccf14ef01bb4ef0d618732082335df8f3015ad|89ccf14ef01bb4ef0d618732082335df8f3015ad>

Remove atom_packages table (#8181) - Zach Wasserman

[osquery:master] 1 new commit by Stefano Bonicatti:

<https://github.com/osquery/osquery/commit/e666542bef5f7be5dc4ce7ba4f344594726d38d9|e666542bef5f7be5dc4ce7ba4f344594726d38d9>

docs: Correct link to a PR in the 4.7.0 changelog (#8186) - Stefano Bonicatti

[osquery:master] 1 new commit by Stefano Bonicatti:

<https://github.com/osquery/osquery/commit/ac174deee3f7e902a7abc817c602550eada3c112|ac174deee3f7e902a7abc817c602550eada3c112>

ci: Correct job order (#8185) - Stefano Bonicatti

Welcome!

thinh nguyen

joined #general.

Hi everyone 👋 From linux/apt_sources.cpp the apt sources seem to be missing information from files with the

.sources

extension. Osquery is only collecting data from

/etc/apt/sources.list

and

/etc/apt/sources.list.d/%.list

. Is there a reason for that or am I missing something?

[osquery:master] 1 new commit by Stefano Bonicatti:

<https://github.com/osquery/osquery/commit/904409ebd7aa72397870c1cb8b861b78369ba994|904409ebd7aa72397870c1cb8b861b78369ba994>

process_open_sockets: Mark pid column as additional instead of index (#8191) - Stefano Bonicatti

Assuming i otherwise have eventing enabled, and can pull user_events and es_process_events and auditd is set up right… is there a reason socket_events might be completely unpopulated? (This is on macOS)

Unrelated question, does osquery pull in the full set of ES events?

Or just literally the process_event types… ie, not any of the notify types (like login/authorization?)

Hi guys, Need help for setup of osquery. We have got a problem with a huge traffic to our infra when our endpoint /api/v1/logger is failed for any reasons. Does it have settings or flags for controlling failed retries attempts? We got a 1.5Gbit/sec traffic from 5k machines just for 1 hour and this load was increasing. Thanks in advance.

Hi, I do not find anything in Osquery schema tables to get Windows User Rights Assignment applied on computers https://learn.microsoft.com/en-us/windows/security/threat-protection/security-policy-settings/user-rights-assignment . This is helpful to get users with debug privs/load drivers/allow batch run, .... Did I miss something ? Thank you !

Anyone actively using Binalyze/B!nalyze and making use of their OSQuery implementation? Trying to see if it there is much crossover with a fleet deployment thats mainly used for inventory. Only docs i could find were a list of query templates https://kb.binalyze.com/air/features/triage/triage-rule-templates/osquery-templates

Welcome!

Scott Bonar

joined #general.

Anyone know how to resolve this error when building osquery?

no template named 'unary_function' in namespace 'std'

Not sure if this is because of recent changes in osquery, dependencies, or macOS (I'm on a different machine from usual, this one is an M2 on macOS 14.1.1)