Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

I know you have to type --enable_ntfs_event_publisher=true but where?

You can set osquery flags in the Fleet <https://fleetdm.com/docs/using-fleet/configuration-files#organization-settings|agent options> using `config.options`. Agent options can be set using a config file and `fleetctl apply` , or in the UI at Profile &gt; Settings &gt; Agent options. Either way, `config`  would look a little like this:


```config:
  options:
    pack_delimiter: /
    distributed_plugin: tls
    disable_distributed: false
    logger_tls_endpoint: /api/v1/osquery/log
    distributed_interval: 5
    distributed_tls_max_attempts: 3
    enable_ntfs_event_publisher: true
    disable_events: false```


That assumes that you're using Fleet to configure osquery. That's generally the case, but I don't know if the Security Onion agent is using Fleet for configuration, If this doesn't work in the SO Fleet install, I would recommend checking their documentation.

Thank you for your help.
Right now my FleetDM for Software reads: Software inventory *disabled* . Where do I enter enable_software_inventory:true to enable it?
When I try from the Agent Options it gives error message: unsupported key provided

--

That one would be set in the Fleet <https://fleetdm.com/docs/using-fleet/configuration-files#organization-settings|organization settings>.

Please forgive me if I missed a step, but it doesnt show what config file to edit or even a file name to edit. Just shows what to change.

There isn't a default file, you'd need to create and apply. A good way to do that is by pulling the current config and saving it to file:

`fleetctl get config  &gt; fleet-config.yaml`

Then you can make your edits to that file and apply the new settings:

`fleetctl apply -f fleet-config.yaml`

Then you can hang on to that file for the future.

<https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-to-configure-fleet>

If you don't already have `fleetctl` installed, there are instructions at the top of the page as well :slightly_smiling_face:

You have been very helpful. I have my FleetDM behind a firewall. Where can I go to see what firewall ports I will need to open for remote agents?

I mean  for Osquery endpoint agent. I believe it may by TCP 8090 if I correct.

Just to make sure I understand correctly, is the firewall on the agent side, blocking outgoing traffic from osquery or on the Fleet side blocking incoming traffic

My FleetDM with osquery are behind a firewall. I do not want the setup to be on the WAN exposed to the internet.
So that means the remote agents will need to connect from outside the office into the FleetDM/osquery.
For that to work, I will need to open ports on the firewall to allow outside traffic to my setup.

Perfect. communication from osquery itself is initiated by the agent installed on your devices, and sent to the Fleet server. As long as the port Fleet uses is open,  you should be golden

To clarify that further,  osquery isn't needed on the server side at all... unless you want to enroll that machine in Fleet and monitor it as well :)