Ted Dorosheff
01/31/2022, 6:10 PMfile_events
, correct?
wondering why it is that my file_events
table appears active, yet with no subscriptions and no events. I've my FIM category defined via config.sharvil
01/31/2022, 6:14 PM--enable_file_events=true
in your flag file?Ted Dorosheff
01/31/2022, 6:28 PM# Server
--tls_server_certs=/var/osquery/certs/cert.pem
--tls_hostname=<http://fleetdm-ui.ouryahoo.com|fleetdm-ui.ouryahoo.com>
--tls_session_reuse=true
--tls_session_timeout=3600
--config_tls_max_attempts=3
# Enrollment
--enroll_secret_path=/var/osquery/secret.txt
--host_identifier=hostname
--enroll_tls_endpoint=/api/v1/osquery/enroll
# Configuration
--config_plugin=filesystem
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=300
--config_accelerated_refresh=60
--config_check=false
--config_dump=false
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
# Logging
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
--logger_tls_period=10
--logger_tls_compress=false
--logger_tls_max_linesize=1048576
--logger_tls_max_lines=2048
--disable_logging=false
--logger_event_type=true
--logger_snapshot_event_type=true
--logger_min_status=0
--logger_min_stderr=0
--logger_stderr=false
--logger_path=/var/osquery/log
--logger_mode=420
--value_max=512
--buffered_log_max=0
# File carving
--disable_carver=false
--carver_start_endpoint=/api/v1/osquery/carve/begin
--carver_continue_endpoint=/api/v1/osquery/carve/block
--carver_block_size=2000000
# Extensions control
--disable_extensions=false
# Daemon control/runtime control
--schedule_splay_percent=10
--schedule_max_drift=60
--schedule_default_interval=3600
--schedule_timeout=0
--pack_refresh_interval=3600
--pack_delimiter=/
--disable_watchdog=false
--watchdog_level=0
--watchdog_memory_limit=0
--watchdog_utilization_limit=0
--watchdog_delay=60
--enable_extensions_watchdog=true
--utc=false
--table_delay=0
--hash_cache_max=500
--hash_delay=20
--disable_caching=false
--disable_hash_cache=false
--read_max=52428800
--force=true
--pidfile=/var/osquery/osqueryd.pidfile
# Backing storage control
--database_path=/var/osquery/osquery.db
--database_dump=false
# Events control
--disable_events=false
--disable_endpointsecurity=false
--events_expiry=3600
--events_optimize=true
--events_max=50000
--enable_fsevents=true
--enable_event_tapping=true
--enable_file_events=true
# Audit control
--disable_audit=false
--audit_persist=true
--audit_allow_config=true
--audit_allow_sockets=true
--audit_allow_process_events=true
sharvil
01/31/2022, 6:35 PM--enable_fsevents
flagTed Dorosheff
01/31/2022, 7:11 PMfile_events
working?file_paths
defined somewhere?sharvil
01/31/2022, 7:39 PM// Define a schedule of queries:
"schedule": {
"file_events": {
"query": "SELECT * FROM file_events;",
"removed": false,
"interval": 2
}
},
"file_paths": {
"tmp": [
"/tmp/%%"
]
},
"disable_events": "false",
"enable_file_events": "true"
Ted Dorosheff
01/31/2022, 8:36 PM# Server
--tls_server_certs=/var/osquery/certs/cert.pem
--tls_hostname=<http://fleetdm-ui.ouryahoo.com|fleetdm-ui.ouryahoo.com>
--tls_session_reuse=true
--tls_session_timeout=3600
--config_tls_max_attempts=3
# Enrollment
--enroll_secret_path=/var/osquery/secret.txt
--host_identifier=hostname
--enroll_tls_endpoint=/api/v1/osquery/enroll
# Configuration
--config_plugin=filesystem
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=300
--config_accelerated_refresh=60
--config_check=false
--config_dump=false
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
# Logging
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
--logger_tls_period=10
--logger_tls_compress=false
--logger_tls_max_linesize=1048576
--logger_tls_max_lines=2048
--disable_logging=false
--logger_event_type=true
--logger_snapshot_event_type=true
--logger_min_status=0
--logger_min_stderr=0
--logger_stderr=false
--logger_path=/var/osquery/log
--logger_mode=420
--value_max=512
--buffered_log_max=0
# File carving
--disable_carver=false
--carver_start_endpoint=/api/v1/osquery/carve/begin
--carver_continue_endpoint=/api/v1/osquery/carve/block
--carver_block_size=2000000
# Extensions control
--disable_extensions=false
# Daemon control/runtime control
--schedule_splay_percent=10
--schedule_max_drift=60
--schedule_default_interval=3600
--schedule_timeout=0
--pack_refresh_interval=3600
--pack_delimiter=/
--disable_watchdog=false
--watchdog_level=0
--watchdog_memory_limit=0
--watchdog_utilization_limit=0
--watchdog_delay=60
--enable_extensions_watchdog=true
--utc=false
--table_delay=0
--hash_cache_max=500
--hash_delay=20
--disable_caching=false
--disable_hash_cache=false
--read_max=52428800
--force=true
--pidfile=/var/osquery/osqueryd.pidfile
# Backing storage control
--database_path=/var/osquery/osquery.db
--database_dump=false
# Events control
--disable_events=false
--disable_endpointsecurity=false
--events_expiry=3600
--events_optimize=true
--events_max=50000
--enable_fsevents=true
--enable_event_tapping=true
--enable_file_events=true
# Audit control
--disable_audit=false
--audit_persist=true
--audit_allow_config=true
--audit_allow_sockets=true
--audit_allow_process_events=true
--<flag>=<boolean>
is somehow not working, since it looks like yours is in the format "<flag>":"<boolean>"
Stefano Bonicatti
01/31/2022, 9:09 PMTed Dorosheff
01/31/2022, 9:13 PM--config_plugin=filesystem
would disable remote config?Stefano Bonicatti
01/31/2022, 9:19 PMTed Dorosheff
01/31/2022, 9:20 PM"disable_events": "false",
"enable_file_events": "true"
would go in the config file, where in config would they go? options?Stefano Bonicatti
01/31/2022, 9:23 PM--enable_file_events=true --disable_events=false --verbose
, and then provide the file pathsTed Dorosheff
01/31/2022, 9:24 PMStefano Bonicatti
01/31/2022, 9:24 PMosqueryi --help
, all the flags under “osquery configurations options” can go in the “options” key of the config file. The idea is that those options can be enable or disabled at runtime.
Admittedly though that list isn’t always reflecting reality, there a couple of quirks around event publishers if I recall right, where you can’t always disable them to then re-enable them at runtime.Ted Dorosheff
01/31/2022, 9:37 PMdisable_logging
default boolean is false, yet without any configs whatsoever, it is set to true.osquery> select * from osquery_flags;
Stefano Bonicatti
01/31/2022, 9:41 PMconfig_path
in that table? Have you checked that you don’t have a config file there which sets different options?Ted Dorosheff
01/31/2022, 9:43 PM{
"options": {
"events_expiry": "60",
"config_refresh": "600",
"host_identifier": "instance",
"distributed_interval": 60
},
"decorators": {
"load": [
"SELECT COALESCE((select instance_id FROM ec2_instance_metadata), hostname) as hostname FROM system_info;"
]
},
"overrides": {
"platforms": {
"windows": {
"options": {
"events_expiry": "60",
"config_refresh": "600",
"host_identifier": "instance",
"distributed_interval": "60"
},
"decorators": {
"load": [
"SELECT COALESCE((select instance_id FROM ec2_instance_metadata), hostname) as hostname FROM system_info;"
]
},
"file_paths": {
"users": [
"C:\\users\\AppData\\Roaming\\%",
"C:\\users\\AppData\\Local\\%",
"C:\\users\\AppData\\Local\\temp\\%",
"C:\\users\\AppData\\Roaming\\Microsoft\\Windows\\StartMenu\\Programs\\Startup\\%",
"C:\\users\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\%",
"C:\\Users\\Default\\%"
],
"Windows": [
"C:\\Windows\\temp\\%",
"C:\\Windows\\system32\\Drivers\\%",
"C:\\Windows\\SysWOW64\\Drivers\\%",
"C:\\Windows\\system32\\GroupPolicy\\Machine\\Scripts\\%",
"C:\\Windows\\system32\\GroupPolicy\\User\\Scripts\\%",
"C:\\Windows\\system32\\Wbem\\%",
"C:\\Windows\\SysWOW64\\Wbem\\%",
"C:\\Windows\\system32\\WindowsPowerShell\\%",
"C:\\Windows\\SysWOW64\\WindowsPowerShell\\%",
"C:\\Windows\\Tasks\\%",
"C:\\Windows\\system32\\Tasks\\%",
"C:\\Windows\\AppPatch\\Custom\\%"
],
"ProgramData": [
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\%",
"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\%"
]
},
"exclude_paths": {
"windows": [
"C:\\Windows\\system32\\DriverStore\\Temp\\%",
"C:\\Windows\\system32\\wbem\\Performance\\%",
"C:\\$WINDOWS.~BT\\Sources\\%",
"C:\\Windows\\Installer\\%",
"C:\\Windows\\System32\\Tasks\\Adobe Acrobat Update Task%",
"C:\\Windows\\System32\\Tasks\\Adobe Flash Player Updater%",
"C:\\Windows\\System32\\Tasks\\OfficeSoftwareProtectionPlatform\\SvcRestartTask\\%"
]
}
},
"linux": {
"options": {
"events_expiry": "60",
"config_refresh": "600",
"host_identifier": "instance",
"distributed_interval": "60"
},
"decorators": {
"load": [
"SELECT COALESCE((select instance_id FROM ec2_instance_metadata), hostname) as hostname FROM system_info;"
]
},
"file_paths": {
"etc": [
"/etc/group",
"/etc/passwd",
"/etc/shadow",
"/etc/services",
"/etc/sudoers",
"/etc/ld.so.preload",
"/etc/ld.so.conf",
"/etc/ld.so.conf.d/%%",
"/etc/pam.d/%%",
"/etc/resolv.conf",
"/etc/modules",
"/etc/hosts",
"/etc/hostname",
"/etc/fstab",
"/etc/rsyslog.conf"
],
"ssh": [
"/root/.ssh/%%",
"/home/%/.ssh/%%",
"/etc/ssh/%%",
"/var/lib/sia/keys/",
"/var/lib/sia/certs/"
],
"logs": [
"/var/log/secure"
],
"docker": [
"/etc/docker/%%",
"/etc/default/docker",
"/etc/docker/daemon.json",
"/usr/bin/containerd",
"/usr/sbin/runc",
"/etc/sysconfig/docker",
"/usr/lib/systemd/system/docker.service",
"/usr/lib/systemd/system/docker.socket"
],
"osquery": [
"/etc/osquery/%%",
"/usr/share/osquery/packs/%%"
],
"firewalls": [
"/etc/sysconfig/iptables",
"/home/y/conf/yakl/%%",
"/etc/yakl/conf/%%"
]
}
},
"darwin": {
"options": {
"events_expiry": "60",
"config_refresh": "600",
"host_identifier": "instance",
"distributed_interval": "60"
},
"decorators": {
"load": [
"SELECT COALESCE((select instance_id FROM ec2_instance_metadata), hostname) as hostname FROM system_info;"
]
},
"file_paths": {
"System": [
"/System/Applications/",
"/System/Library/"
],
"Users": [
"/Users/%/"
],
"private": [
"/private/etc/sudoers",
"/private/etc/ssh/ssh_known_hosts",
"/private/etc/bashrc"
]
}
}
}
}
}
Stefano Bonicatti
01/31/2022, 9:46 PMosqueryi
logging is force disabled, together with the watchdog.Ted Dorosheff
01/31/2022, 9:47 PM