Title
#fleet
j

jimmy

07/31/2022, 1:27 PM
I want to have a server that manage all the yara queries. the problem is that I don't want to add every time new rule to the conf file like at the example at the osquery site. because it means I will need to deploy the new file evry time at all the agents. example: "yara": { "signature_urls": { "sig_url_1": "https://raw.githubusercontent.com/Yara-Rules/rules/master/cve_rules/CVE-2010-0805.yar", "sig_url_2": "https://raw.githubusercontent.com/Yara-Rules/rules/master/crypto/crypto_signatures.yar", "sig_url_3": "https://raw.githubusercontent.com/Yara-Rules/rules/master/malware/APT_APT3102.yar" } } I wanted to know if there is any way that I will have yara server that manage all the queries without modifying the conf file every time I add the server new query. maybe regex like ".*"?
Kathy Satterlee

Kathy Satterlee

08/01/2022, 2:52 PM
Hi, @jimmy! I see you've been chatting with @seph about this a little over in general. I'll see if I can get you some more clarification. Are you also using Fleet?
3:00 PM
It looks like there isn't a way to load all of those rules dynamically, we'd recommend using an automation tool like Puppet to deploy the updated configuration to your osquery agents.
Keith Swagler

Keith Swagler

08/01/2022, 5:39 PM
Hey Jimmy we're going through something similar at the moment. What we've found is that you can set the config_plugin to tls and have configure Fleet to host the configs and just update the sig urls there
Kathy Satterlee

Kathy Satterlee

08/01/2022, 5:50 PM
Thanks for including that! I didn't want to assume Fleet was involved 🙂
Saulo Guilhermino

Saulo Guilhermino

08/01/2022, 8:46 PM
Hey @Keith Swagler I'm a bit curious about your solution, are you using the
Global agent options
config on Fleet to do this?
j

jimmy

08/02/2022, 3:12 PM
I'm using fleet 3.5.1, does it possible also at that version?
Keith Swagler

Keith Swagler

08/02/2022, 7:04 PM
Hey @Saulo Guilhermino yea we are. though you probably will have to use overrides for each platform
7:06 PM
@jimmy that's a pretty old version, and updating is pretty painless.
Saulo Guilhermino

Saulo Guilhermino

08/02/2022, 7:09 PM
Interesting, thanks @Keith Swagler! If it's not too much to ask, could you post part of your config so we can have a reference?
j

jimmy

08/03/2022, 3:51 PM
@Keith Swagler but does it work at fleet 3.5.1?
3:59 PM
@Keith Swagler i wanted to update my fleet but its not possible because that problem:https://osquery.slack.com/archives/C01DXJL16D8/p1655819083815489
Keith Swagler

Keith Swagler

08/04/2022, 5:02 PM
@Saulo Guilhermino I'll put together some example ones but there are some docs herehttps://fleetdm.com/docs/using-fleet/configuration-files#agent-options
5:03 PM