Zafar
07/01/2019, 1:16 PM{
"options": {
"config_plugin": "filesystem",
"logger_plugin": "filesystem",
"utc": "true"
},
"schedule": {
"system_info": {
"query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
"interval": 3600
},
"high_load_average": {
"query": "SELECT period, average, '70%' AS 'threshold' FROM load_average WHERE period = '15m' AND average > '0.7';",
"interval": 900,
"description": "Report if load charge is over 70 percent."
},
"low_free_memory": {
"query": "SELECT memory_total, memory_free, CAST(memory_free AS real) / memory_total AS memory_free_perc, '10%' AS threshold FROM memory_info WHERE memory_free_perc < 0.1;",
"interval": 1800,
"description": "Free RAM is under 10%."
}
},
"packs": {
"osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
"incident-response": "/usr/share/osquery/packs/incident-response.conf",
"it-compliance": "/usr/share/osquery/packs/it-compliance.conf",
"vuln-management": "/usr/share/osquery/packs/vuln-management.conf",
"hardware-monitoring": "/usr/share/osquery/packs/hardware-monitoring.conf",
"ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf"
}
}
I can see alert in C:\ProgramData\osquery\log\osqueryd.results.log as shown below
{
"name": "system_info",
"hostIdentifier": "DESKTOP-A0NBI09",
"calendarTime": "Mon Jun 24 16:45:23 2019 UTC",
"unixTime": 1561394723,
"epoch": 0,
"counter": 0,
"decorations": {
"host_uuid": "5FCD824C-2A53-11B2-A85C-F0D28B2FA201",
"username": "LENOVO"
},
"columns": {
"cpu_brand": "Intel(R) Core(TM) i7-8565U CPU @ 1.80GHz",
"hostname": "DESKTOP-A0NBI09",
"physical_memory": "8281911296"
},
"action": "added"
}
But on wazuh-manager UI, I am looking alert related to osquery error messages as shown in the screenshot.
Can anyone please help me what is being missed here?