Announcing our latest osquery extension for windows.."osquery meets sysmon" as we call it 🙂 https://github.com/polylogyx/osq-ext-bin

I spender a day to find how to select max open files of an user, but can’t find anything? Is the possible to use Osquery to get max open files ?

hey all - I will be presenting on osquery at the Security Onion Conference Oct 19th, and BSidesAugusta the following day. ("Integrating Osquery into Security Onion" & "Live Interrogation with Osquery") Please feel free to show up and and ask me questions that I don't know the answer to 🙂

@leadZERO @Evgeny Sidorov https://alessandrogar.io/post/osquery-development-with-qtcreator-and-clion/ written with my bad english 🙂

hello everyone, some have experience with osquery integration towards alienvault ossim (opensource, no-USM) ?

hi osquery team, any future planning on releasing official build for Solaris OS?

Anyone have experience enroll Mac clients with Kolide?

@Mustafa As per the document " the associated 'dirty' query is blacklisted from running for 24 hours. " How can I reset this for my testing purpose to run that query in next session?

Uhm sorry, I saw boost and thought it was related. This is strange, are you trying to import libraries from /usr/include or /usr/lib?

Can someone help me understand this discrepancy? I purposely added a seconded user to a linux system with a uid of 0. Putting a

where uid="0"

only returns my root user.

where uid_signed="0"

gets me both users. This doesn't seem right to me

Hi everyone, I would like to give you an heads up for https://osquery.io/blog/osquery-lockdown in case you don't closely follow the blog. Please read.

greetings, having some issues with osquery logging to AWS kinesis & firehose. doesn't look like the aws channel has much activity. can someone here assist?

why does usb_evices table aren't available on windows?

About the rocksDB that osquery uses, can I extract info when it's running without stopping the databasis?

I’ve been itching to write a plugin table that talks to WMI 😄

Hey folks, just curious, but has anyone been able to build osquery for AIX? Or do you foresee any challenges with doing so?

Hey guys - quite new to OSQuery and Fleet; trying to get my clients to join, can't get it done. I have Fleet setup in Docker swarm behind a reverse proxy (traefik) which is doing SSL termination. Whenever I try to join a osquery daemon I get TLS errors, even when using the insecure flags. Anyone who can help?

Any suggestions on tools which are commonly used to visualize OsQuery results? I'm currently using Kibana. But I was hoping for something that comes with a few more pre-configured visualizations for the packs shipped with OsQuery.

good afternoon guys! qq: what was the flag I need to give to have content in table

process_events

? I thought there was a flag....Thanks a bunch 😄

Is there currently a plan for when a 3.3.1 package will be available for download?

Hey all - I have been working with Chris Sanders / Applied Network Defense to produce an online course on osquery. Today it launched! You can find out more info + look over what it covers at learnosquery.com

We are currently running 3.3.0 on a few windows machines, delivering data up to Kinesis without any issues

I got the service up and running, with a .flag and secret and cert file, but Fleet is not seeing any new hosts.

Hey - looking for an init script for osquery on an openrc linux system - is there one, or has someone written one?

@zwass I pinged in our SF slack and this was the response. "We've made some extensive changes to our GitHub permissions recently, which seems to be the source of the 404. I pinged some folks in another channel about it"

yes but i do not understand the process that is created when i stop the osquery service

Anyone have insight into why the last table is so slow to return results (even when there are less than a hundred rows).

osquery> select COUNT (*) from last;
+-----------+
| COUNT (*) |
+-----------+
| 65        |
+-----------+

Hey I've some pretty basic doubt. If osqueryd is running and collecting events and I restart the daemon for some reason, would I lose events that were not queried before the restart ? Assuming all those buffer/Rocksdb etc do not run out of size and are well within defined thresholds.

Hi, I am trying to add libipset as a dependency. Added the formula to osquery/tools/provision/formula and also included it in the provision.sh script. I ran make deps and it was successfully installed to usr/local/osquery/Cellar. But when I try to build, it throws “undefined symbol” error while linking. Please did I miss any step?