lvferdi
11/03/2021, 7:23 PMOpenPlgx
11/04/2021, 12:01 PMlvferdi
11/04/2021, 12:01 PMno event_filter found
OpenPlgx
11/04/2021, 12:03 PMlvferdi
11/04/2021, 12:05 PMosquery.conf
file and the queries in a query packOpenPlgx
11/04/2021, 12:07 PMlvferdi
11/04/2021, 12:08 PMOpenPlgx
11/04/2021, 12:08 PMlvferdi
11/04/2021, 12:08 PMOpenPlgx
11/04/2021, 12:08 PMlvferdi
11/04/2021, 12:09 PMselect * from win_socket_events;
and receive the results, but I don't see the filtering being applied by the extension.OpenPlgx
11/04/2021, 12:10 PMlvferdi
11/04/2021, 12:12 PMOpenPlgx
11/04/2021, 12:13 PMlvferdi
11/04/2021, 12:20 PMOpenPlgx
11/04/2021, 12:33 PMlvferdi
11/04/2021, 1:29 PMvalue not set
{
"utc": "true",
"custom_plgx_EnableSSL": "true",
"custom_plgx_EnableAmsiStreamEventData": "true"
},
{
"version": "1.0",
"queries": {
"win_process_events": {
"query": "select wpe.action, wpe.eid, wpe.pid, wpe.path, wpe.process_guid, wpe.cmdline, wpe.parent_pid, wpe.parent_path, wpe.parent_process_guid, wpe.owner_uid, wpe.utc_time as time, h.md5, h.sha1, h.sha256 from win_process_events wpe JOIN win_hash h USING (path) where action='PROC_CREATE';",
"interval": 30,
"platform": "windows",
"version": "2.9.0",
"description": "Windows Process Events",
"value": "Process Events"
}
},
"plgx_event_filters": {
"win_process_events": {
"parent_path": {
"exclude": {
"values": [
"C:\\Program Files\\osquery\\extensions\\plgx_win_extension.ext.exe",
"C:\\Program Files\\SplunkForwarder\\bin\\splunkd.exe",
"C:\\Windows\\System32\\svchost.exe"
]
}
}
}
}
}
OpenPlgx
11/05/2021, 7:07 AMlvferdi
11/05/2021, 3:09 PM--config_plugin=filesystem
--config_path=C:\Program Files\osquery\osquery.conf
--enable_monitor=false
--events_expiry=3600
--events_max=2500
--logger_plugin=filesystem
--logger_path=C:\Program Files\osquery\log
--logger_event_type=true
--database_path=C:\Program Files\osquery\osquery.db
--pidfile=C:\Program Files\osquery\osquery.pid
--disable_watchdog=true
--watchdog_level=-1
--disable_events=false
--enable_windows_events_publisher=true
--enable_windows_events_subscriber=true
--enable_powershell_events_subscriber=true
--enable_powershell_events_publisher=true
--enable_ntfs_event_publisher=true
--enable_ntfs_event_subscriber=true
--windows_event_channels=Microsoft-Windows-Powershell/Operational,Microsoft-Windows-AppLocker/EXE and DLL,Microsoft-Windows-AppLocker/MSI and Script,Microsoft-Windows-AppLocker/Packaged app-Deployment,Microsoft-Windows-AppLocker/Packaged app-Execution
--allow_unsafe
--extensions_autoload=C:\Program Files\osquery\extensions.load
--extensions_interval=10
--extensions_timeout=90
--database_dump=false
--schedule_default_interval=30
--pack_refresh_interval=30
--extensions_require=plgx_win_extension
himanshu
11/05/2021, 6:05 PMC:\Program Files\osquery>osqueryd\osqueryd.exe -S --flagfile osquery.flags
Filters got applied in registry and events are coming in table queries.
can you try these and let us know it worked just to move a step further that osquery+extension is working in your environment.exclude
and include
keys should have registry value having entries of respective filters specified in conf filelvferdi
11/05/2021, 7:14 PMhimanshu
11/07/2021, 7:47 AM"plgx_event_filters":
field, you should not see No event_filter found
message in foreground.lvferdi
11/07/2021, 4:25 PMhimanshu
11/08/2021, 4:17 AMOpenPlgx
11/08/2021, 5:36 AMlvferdi
11/08/2021, 12:20 PMwin_proc_events
registry entry but socket events are not being filtered. I will check for process eventsOpenPlgx
11/08/2021, 5:15 PMlvferdi
11/08/2021, 5:34 PMhimanshu
11/08/2021, 5:36 PM