grahamgilbert
07/09/2019, 3:42 PM{
"auto_table_construction": {
"munki_application_usage": {
"columns": [
"event",
"bundle_id",
"app_version",
"app_path",
"last_time",
"number_times"
],
"path": "/Library/Managed Installs/application_usage.sqlite",
"platform": "darwin",
"query": "SELECT * from application_usage;"
}
},
"decorators": {
"always": [
"SELECT \"itx_corp\" AS envIdentifier",
"SELECT hardware_serial AS serial FROM system_info",
"SELECT uuid as hardware_uuid FROM system_info",
"select uuid as system_uuid from block_devices join mounts on name = device where mounts.path = \"/\"",
"select platform from os_version"
]
},
"options": {
"aws_access_key_id": "my_access_key",
"aws_firehose_stream": "my_firehose_stream",
"aws_kinesis_random_partition_key": true,
"aws_kinesis_stream": "my_kinesis_stream",
"aws_region": "us-east-1",
"aws_secret_access_key": "my_access_key",
"config_plugin": "filesystem",
"enable_monitor": false,
"events_expiry": 3600,
"extensions_autoload": "/var/osquery/extensions.load",
"extensions_interval": 3,
"extensions_timeout": 3,
"logger_min_status": 0,
"logger_min_stderr": 0,
"logger_plugin": "aws_firehose,aws_kinesis,filesystem",
"schedule_splay_percent": 20,
"tls_server_certs": "/var/osquery/ca.pem",
"verbose": true,
"worker_threads": 2
},
"packs": {
"airbnb_info": "/var/osquery/packs/airbnb_info.conf",
"airbnb_mac_os_x": "/var/osquery/packs/airbnb_mac_os_x.conf",
"airbnb_windows": "/var/osquery/packs/airbnb_windows.conf",
"hardware-monitoring": "/var/osquery/packs/hardware-monitoring.conf",
"incident-response": "/var/osquery/packs/incident-response.conf",
"osquery-monitoring": "/var/osquery/packs/osquery-monitoring.conf",
"ossec-rootkit": "/var/osquery/packs/ossec-rootkit.conf",
"osx-attacks": "/var/osquery/packs/osx-attacks.conf",
"vuln-management": "/var/osquery/packs/vuln-management.conf",
"windows-attacks": "/var/osquery/packs/windows-attacks.conf"
},
"schedule": {
"info": {
"interval": 86400,
"query": "SELECT * FROM osquery_info;"
}
}
}