theopolis
{
"options": {
"config_plugin": "filesystem",
"logger_plugin": "filesystem",
"logger_path": "/var/log/osquery",
"disable_logging": "false",
"schedule_splay_percent": "10",
"utc": "true"
},
"schedule": {
"system_info": {
"query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
"interval": 3600
},
"Host_name_of_computer":{
"query": "SELECT hostnames, model FROM etc_hosts;",
"interval": 216000
},
"Logged_in_users":{
"query": "SELECT user, model FROM logged_in_users;",
"interval": 3600
}
},
"decorators": {
"load": [
"SELECT uuid AS host_uuid FROM system_info;",
"SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
]
},
"packs": {
//"osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
//"incident-response": "/usr/share/osquery/packs/incident-response.conf",
//"it-compliance": "/usr/share/osquery/packs/it-compliance.conf",
//"osx-attacks": "/usr/share/osquery/packs/osx-attacks.conf",
// "vuln-management": "/usr/share/osquery/packs/vuln-management.conf",
//"hardware-monitoring": "/usr/share/osquery/packs/hardware-monitoring.conf",
// "ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf"
}
}
The `Host_name_of_computer`'s interval is a bit high, 60*60*60s