<#371 Osctrl technology> Issue created by <nidhin0...
# osctrl
g
#371 Osctrl technology Issue created by nidhin077 Hi, I'm hoping this is going well for you. This is unrelated to the issue. instead, I would want to know about the technologies and techniques you employed in the osctrl. As we are creating an application, we must utilise Osquery to gather information about numerous machines and show it on the user interface. This is the use case, so we have now utilised the Osquery TLS test endpoint service at port 8080: $ git clone https://github.com/osquery/osquery $ cd osquery $ tools/tests/test_http_server.py --tls --persist --cert tools/tests/configs/test_server.pem --key tools/tests/configs/test_server.key --ca tools/tests/configs/test_server_ca.pem --use_enroll_secret --enrol l_secret tools/tests/configs/test_enroll_secret.txt --test-configs-dir tools/tests/configs/ 8080 127.0.0.1 - - [15/Nov/2023 163738] "POST /logger HTTP/1.1" 200 - 127.0.0.1 - - [15/Nov/2023 163738] "POST /logger HTTP/1.1" 200 - Also tried enrolling a node to the above osctrl-tls like remote endpoint using the osquery daemon service like below: $ git clone https://github.com/osquery/osquery $ cd osquery $ sudo osqueryd --verbose --ephemeral --disable_database --tls_hostname localhost:8080 --tls_server_certs ./tools/tests/configs/test_server_ca.pem --config_plugin tls --config_tls_endpoint /config --logger_tls_endpoint /logger --logger_plugin tls --enroll_tls_endpoint /enroll --enroll_secret_path ./tools/tests/configs/test_enroll_secret.txt I1115 163912.656174 8048 init.cpp:413] osquery initialized [version=5.10.2] I1115 163912.656275 8048 extensions.cpp:453] Could not autoload extensions: Cannot open file for reading: /etc/osquery/extensions.load I1115 163912.656335 8048 dispatcher.cpp:78] Adding new service: WatcherRunner (0x557f52ef3858) to thread: 140628891117312 (0x557f52eb1580) in process 8048 I1115 163912.656767 8049 watcher.cpp:720] osqueryd watcher (8048) executing worker (8050) I1115 163912.661576 8050 init.cpp:410] osquery worker initialized [watcher=8048] I1115 163912.661681 8050 dispatcher.cpp:78] Adding new service: WatcherWatcherRunner (0x564e42c44308) to thread: 140385638168320 (0x564e42c41af0) in process 8050 I1115 163912.661760 8050 dispatcher.cpp:78] Adding new service: ExtensionWatcher (0x564e42c4a828) to thread: 140385629775616 (0x564e42c44b10) in process 8050 I1115 163912.661805 8050 dispatcher.cpp:78] Adding new service: ExtensionRunnerCore (0x564e42c4a0b8) to thread: 140385621382912 (0x564e42c5fd50) in process 8050 I1115 163912.661839 8053 interface.cpp:299] Extension manager service starting: /var/osquery/osquery.em I1115 163912.661841 8050 tls_enroll.cpp:81] TLSEnrollPlugin requesting a node enroll key from: https://localhost:8080/enroll I1115 163912.662338 8050 system.cpp:164] Failed to read system uuid, returning ephemeral uuid I1115 163912.662437 8050 smbios_tables.cpp:253] Could not read SMBIOS memory I1115 163912.663532 8050 tls.cpp:263] TLS/HTTPS POST request to URI: https://localhost:8080/enroll I1115 163912.668138 8050 auto_constructed_tables.cpp:99] Removing stale ATC entries I1115 163912.668260 8050 tls.cpp:263] TLS/HTTPS POST request to URI: https://localhost:8080/config I want to know how to write the data to a Postgres database after obtaining the connection from the machine using this way. Upon reviewing your configuration, I noticed that you were storing and displaying data in the user interface using a Postgres database. We're stuck right now, so if you don't mind, could you please explain the process or step? It would be really helpful for us to keep moving forward. jmpsec/osctrl
#371 Osctrl technology Issue closed as completed by javuto jmpsec/osctrl