Jacob Kitchel
07/15/2021, 10:23 PMStefano Bonicatti
07/15/2021, 10:29 PM--verbose
flag?Jacob Kitchel
07/15/2021, 11:33 PMI0715 17:20:25.228919 3022 init.cpp:357] osquery initialized [version=4.9.0]
I0715 17:20:25.229351 3022 system.cpp:375] Writing osqueryd pid (3022) to /var/run/osqueryd.pidfile
I0715 17:20:25.229488 3022 extensions.cpp:453] Could not autoload extensions: Cannot open file for reading: /etc/osquery/extensions.load
I0715 17:20:25.229720 3022 dispatcher.cpp:78] Adding new service: WatcherRunner (0x55ede8f91868) to thread: 140492825478912 (0x55ede8f79630) in process 3022
I0715 17:20:25.231575 3023 watcher.cpp:615] osqueryd watcher (3022) executing worker (3024)
I0715 17:20:25.249591 3024 init.cpp:354] osquery worker initialized [watcher=3022]
I0715 17:20:25.249827 3024 dispatcher.cpp:78] Adding new service: WatcherWatcherRunner (0x559fe8f4c598) to thread: 139894756615936 (0x559fe8f4cbd0) in process 3024
I0715 17:20:25.249964 3024 rocksdb.cpp:132] Opening RocksDB handle: /var/osquery/osquery.db
I0715 17:20:25.350992 3024 dispatcher.cpp:78] Adding new service: ExtensionWatcher (0x559fe8fd9658) to thread: 139894215120640 (0x559fe9060a70) in process 3024
I0715 17:20:25.351110 3024 dispatcher.cpp:78] Adding new service: ExtensionRunnerCore (0x559fe8fdbaa8) to thread: 139894223513344 (0x559fe8f64970) in process 3024
I0715 17:20:25.351162 3024 auto_constructed_tables.cpp:97] Removing stale ATC entries
I0715 17:20:25.351182 3123 interface.cpp:299] Extension manager service starting: /var/osquery/osquery.em
I0715 17:20:25.384059 3024 eventfactory.cpp:156] Event publisher not enabled: BPFEventPublisher: Publisher disabled via configuration
I0715 17:20:25.384328 3024 eventfactory.cpp:156] Event publisher not enabled: auditeventpublisher: Publisher disabled via configuration
I0715 17:20:25.384372 3024 eventfactory.cpp:156] Event publisher not enabled: inotify: Publisher disabled via configuration
I0715 17:20:25.384435 3024 eventfactory.cpp:156] Event publisher not enabled: syslog: Publisher disabled via configuration
I0715 17:20:25.384634 3024 events.cpp:36] Skipping subscriber: apparmor_events: Subscriber disabled via configuration
I0715 17:20:25.384781 3024 events.cpp:36] Skipping subscriber: process_file_events: Subscriber disabled via configuration
I0715 17:20:25.384855 3024 events.cpp:36] Skipping subscriber: seccomp_events: Seccomp subscriber disabled via configuration
I0715 17:20:25.384888 3024 events.cpp:36] Skipping subscriber: selinux_events: Subscriber disabled via configuration
I0715 17:20:25.384968 3024 events.cpp:36] Skipping subscriber: socket_events: Subscriber disabled via configuration
I0715 17:20:25.385524 3024 main.cpp:104] Not starting the distributed query service: Distributed query service not enabled.
I0715 17:20:25.385572 3124 eventfactory.cpp:390] Starting event publisher run loop: udev
I0715 17:20:25.385628 3024 dispatcher.cpp:78] Adding new service: SchedulerRunner (0x559fe9058ef8) to thread: 139894634559232 (0x559fe8fdebb0) in process 3024
I0715 17:44:24.995820 3125 scheduler.cpp:110] Executing scheduled query system_info: SELECT hostname, cpu_brand, physical_memory FROM system_info;
osquery> select * from osquery_packs;
+------+----------+---------+-------+----------------------+----------------------+--------+
| name | platform | version | shard | discovery_cache_hits | discovery_executions | active |
+------+----------+---------+-------+----------------------+----------------------+--------+
| main | | | 0 | 1 | 1 | 1 |
+------+----------+---------+-------+----------------------+----------------------+--------+
Linux DESKTOP-1CHO67D 5.4.72-microsoft-standard-WSL2 #1 SMP Wed Oct 28 23:40:43 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
Stefano Bonicatti
07/16/2021, 8:25 AM.conf
, otherwise it won’t load it.Jacob Kitchel
07/16/2021, 2:11 PMtester@DESKTOP-1CHO67D:/mnt/c/Users/jacob$ ls -al /etc/osquery/
total 32
drwxr-xr-x 3 root root 4096 Jul 15 15:18 .
drwxr-xr-x 96 root root 4096 Jul 14 20:44 ..
-rw-r--r-- 1 root root 6381 Jul 12 20:29 osquery.conf
-rw-r--r-- 1 root root 6381 Jul 14 22:37 osquery.conf.bak
-rw-r--r-- 1 root root 64 Jul 14 22:04 osquery.conf.bak.hash
drwxr-xr-x 2 root root 4096 Jul 15 15:18 osquery.conf.d
tester@DESKTOP-1CHO67D:/mnt/c/Users/jacob$ ls -al /etc/osquery/osquery.conf.d/
total 28
drwxr-xr-x 2 root root 4096 Jul 15 15:18 .
drwxr-xr-x 3 root root 4096 Jul 15 15:18 ..
-rw-r--r-- 1 root root 17756 Jul 15 15:18 ossec-rootkit.conf
Stefano Bonicatti
07/16/2021, 2:28 PMpack_name_1
example here: https://osquery.readthedocs.io/en/latest/deployment/configuration/#packs{
"packs": {
[...] // packs from the ossec-rootkit.conf
}
}
Jacob Kitchel
07/16/2021, 2:45 PMStefano Bonicatti
07/16/2021, 2:46 PMJacob Kitchel
07/16/2021, 2:47 PMStefano Bonicatti
07/16/2021, 2:48 PM{
"packs": {
"pack_name_2": {
"queries": {},
"shard": 10,
"version": "1.7.0",
"platform": "linux"
}
}
}
then you can also have the additional configuration file under conf.d
{
"packs": {
"pack_name_3": {
"queries": {},
"shard": 10,
"version": "1.7.0",
"platform": "linux"
}
}
}
{
"packs": {
"pack_name_1": "/path/to/pack.json",
"pack_name_2": {
"queries": {},
"shard": 10,
"version": "1.7.0",
"platform": "linux",
"discovery": [
"SELECT * FROM processes WHERE name = 'osqueryi';"
]
}
}
}
Look at pack_name_1
, if the path that’s there is substituted with the path to the ossec-rootkit.conf, then it will load those queriesJacob Kitchel
07/16/2021, 2:56 PM