Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

osquery

image.png

Why would a snapshot query be doubling up and telling me that the things are both on and off at the same time???

osquery generally wouldn’t. You mentioned your query is `SELECT type,state FROM windows_security_products` That should produce two rows, each with two columns.

Your screenshot looks like a SIEM post processing a log pipeline. I’d look to either your SIEM parsing rules, or your log pipeline;

Try to get logs from earlier to diagnose where your failiure is

Hi <@U7QP20JQH> here is the JSON that is returned directly from osquery pre-processing into elastic:

`{"snapshot":[{"state":"On","type":"Firewall"},{"state":"Off","type":"Firewall"},{"state":"On","type":"Antivirus"},{"state":"Off","type":"Antivirus"}],"action":"snapshot","name":"pack/Windows Base Pack/fw_av_snapshot","hostIdentifier":"xxx","calendarTime":"Fri Jul 30 06:19:03 2021 UTC","unixTime":1627625943,"epoch":0,"counter":0,"numerics":false,"decorations":{"company":"xxx","host_hostname":"xxx","username":"xxx"}}`

<@U7QP20JQH> it seems like osquery is reporting two conflicting states for the same query how can that be?????

Pretty weird. What's the scheduled query?

It's just `SELECT type,state FROM windows_security_products`  set as a snapshot query and told to run every 112 seconds

It would appear that it does not do it all the time however, as I can see some good looking results such as:

`{"snapshot":[{"state":"On","type":"Firewall"},{"state":"On","type":"Antivirus"}],"action":"snapshot","name":"pack/Windows Base Pack/fw_av_snapshot","hostIdentifier":"xxx","calendarTime":"Sat Jul 31 00:43:39 2021 UTC","unixTime":1627692219,"epoch":0,"counter":0,"numerics":false,"decorations":{"company":"xxx","host_hostname":"xxxx"}}`

Does the osquery_schedule show exactly what you think the query is? If you `select *` do the other columns hint at anything?

<@U7QP20JQH> where do I see. the osquery_shedule?

Turns out user installed Bitdefender, and so it is reporting Bitdefender on, Microsoft Defender off

Would that have been visible in a `select *` ?

I had to wait for the machine to come back online

Screen Shot 2021-08-01 at 11.06.17 pm.png

I need to rethink how I'm alerting on that table in that case