Title
#general
Macear

Macear

09/30/2020, 7:55 AM
Hi 👋 I’ve got the following question: Say, we have some devices (Mac OS) which are online for several hours then goes offline then again turned on etc. As I got it, osquery resets its inner timer every time after it (even if device has been put to sleep, hibernated) and some queries with high interval will never launch. Right? If so, is there any workarounds to make such queries run except reducing interval itself as it causes an increase of events?..
s

seph

09/30/2020, 10:47 AM
The timer should be cumulative.
Macear

Macear

09/30/2020, 11:16 AM
@seph how can I set cumulative timer for a query?
12:12 PM
@seph oh, you meant that if the device was put to sleep than timer won’t be reset? But what could we do if the device was restarted?
s

seph

09/30/2020, 12:32 PM
The timer for queries is cumulative based on osquery runtime. It should not reset on boot
12:32 PM
I'm not sure what you mean by "set"?
12:32 PM
Is there a problem you're having?
Macear

Macear

09/30/2020, 12:59 PM
@seph I asked the wrong question because I didn’t understand how timer works. Now I got you, sorry for stupid question 🙂 thanks a lot!
1:04 PM
@seph and I have some other questions.. How osquery defines its runtime? Why after boot runtime isn’t reset to 0? Would runtime be reset to 0 after restarting osquery?
s

seph

09/30/2020, 1:08 PM
No need to apologize. We all start somewhere 🙂
1:09 PM
Offhand, I’m not sure. What do you mean by runtime? Are you still asking about the query scheduler stuff, or is this some table.
1:10 PM
By “why” answers aren’t always easy to answer. Some of that predates me. Sometimes there’s a considered reason. Sometimes it’s just the first thing someone thought of
Macear

Macear

09/30/2020, 1:23 PM
Yes, I’m asking only about the query scheduler. I want to understand the following: I added a query with interval of 24h. This query was scheduled by osquery. Several hours later the device is rebooted, on boot osquery starts and gets the query from kolide again. We need to wait 24h from the beginning? Or it would resume from the point where the device were restarted? Several hours later a user on the device could restart osquery (osqueryctl restart), osquery starts and gets the query from kolide again. Would it resume from the point where osquery was restarted or it starts from the very beginning? PS. I definitely has some problems with posing questions 🙂
1:33 PM
Instead of “why” I meant “would”.. that’s a typo. That shouldn’t has been a “why” question, my bad
s

seph

09/30/2020, 1:40 PM
the osquery schedule should work off the cumulative osquery runtime. Neither computer restarts, nor osquery restarts should matter.
Macear

Macear

09/30/2020, 1:42 PM
@seph thanks for your patience and your answer! 😄
s

seph

09/30/2020, 1:42 PM
np
theopolis

theopolis

09/30/2020, 2:36 PM
Also keep in mind osquery makes minor adjustments to schedule intervals, called a “splay” value. This is similar to splaying in chef and other tools that may be effecting large numbers of hosts. The default is to splay up to 10% of the interval value plus or minus. That prevents all of your machines from executing the same query at the same time, as well as executing all 24h interval queries at the same time.
Macear

Macear

09/30/2020, 4:55 PM
@theopolis ok 👍 thanks
2:52 AM
But is there any setting to make osquery run a query on startup? I e osquery starts and run queries once?
2:55 AM
Or maybe set cron schedule? It’d be really helpful
s

seph

10/01/2020, 2:03 PM
When you say cron, having osquery run something ever N seconds by the clock? What would happen if the machine was asleep?
theopolis

theopolis

10/01/2020, 3:31 PM
But is there any setting to make osquery run a query on startup? I e osquery starts and run queries once?
I do not think this really exists but several folks have asked for it. I think we could support it with a new feature
{
  "query": "select * from TABLE_NAME",
  "startup": true
}
s

seph

10/01/2020, 3:44 PM
Get’s weird if you think about diff queries.
3:45 PM
And machine load.
3:46 PM
IIRC schedule queries execute sometime within the time range? Maybe
startup: true
would bias that to execute in the very beginning. Still have to work through not melting the machine.
3:46 PM
(We experimented a little in launcher with a feature like this)
Macear

Macear

10/02/2020, 9:15 AM
I realised that running queries by cron is unnecessary cuz running by interval is enough. Running on startup could be helpful for us. I understand that it might be costly and possibly causes some problems. If it gets more realistic to implement it, that would great! 👍 thanks
s

seph

10/02/2020, 10:54 AM
Can you tell me about the use case? Is it a lot of queries, or a few? Is it the scheduled queries, and you want them earlier, or something else? One of the decorator queries can run on startup, is that what you're looking for?
Macear

Macear

10/02/2020, 12:13 PM
When I set queries (in my case, snapshots) to be run with interval of 4h (for example), we have to wait for 4h of osquery runtime which may expand to more hours if the user turns off its device or put it to sleep. Our security controls are based on those queries. If we have no results from osquery for some time we consider it as a defect and notify the users about this problem. We have been facing the before mentioned situation where we have no idea if a device is secured with correspondance to our requirments or not for long time. reducing the query intervals is not possible for us as it leads to sufficient increase of logs. And if there startup queries has been, we could solve this issue probably
s

seph

10/02/2020, 2:07 PM
That’s a good perspective to hear.
2:10 PM
To brainstorm a workaround… Do you have a TLS server that can issue distributed queries for that use case? It’s a bit more duplication, but the decorators can kinda do this. If your concern is that hosts are going to be off for so long they won’t send you a result soon enough, that sounds like they also won’t update results inside the frequency you need. So that might be something to explore, I don’t know if you can try it and see how it works in practice.
Macear

Macear

10/02/2020, 3:09 PM
Yes, we use Kolide as the TLS server. Distributed queries are nice possibility but in our case my colleagues which are engaged in defining defects (security requirements violated) are analysing them in a different system. After a query was set, its results via syslog would be loaded to our SIEM system where there are different scheduled searches/alerts for that. They (my colleagues) have no access to Kolide Web UI as in Kolide there isn’t appropriate RBAC and they would have more privileges than we wish them had. Can you please clarify how decorators could help us to do something like this? We use decorators, our use case is adding ip address of the device to each query to make correlation easier. As I understand decorators are the wrap-up “queries” which are run for every query at all. Am I right? If so, that’s gonna overwhelm us with logs... Also, as you can guess, users don’t apply security settings themselves. We have separate teams of people who are engaged in it. After some security settings were applied we want to check if it was done correctly. Usually for this purpose we have those osquery queries (controls). Taking away the personal device from a user for 4h is inappropriate for us, we are trying to return it asap. If the device was returned before my colleagues make sure everything is correct with the help of their searches in SIEM, it might turn out that something was done wrong and works (applying security settings) are required again. Frequently it is not an easy task because we make it impossible for users to keep working, or users have to get to the office again (no vpn access to that device). Therefore if there has been startup queries, we could trigger osquery to run them by restarting osquery. Logs could be delivered to our SIEM system faster.
3:14 PM
Also 🙂 thanks for providing us with some ideas to try as a workaround. The situation is not an easy one as for me of course, and I appreciate your help so much!
s

seph

10/02/2020, 8:27 PM
picking things apart…
8:29 PM
Yeah, decorators would be pretty overwhelming.
8:30 PM
It sounds a bit like you have multiple teams, doing multiple things, and the RBAC in fleet isn’t really enough to handle what you want. One devops style direction would be to instantiate fleet configs from a CI, and then let people contribute to it. Maybe?
8:32 PM
Wow, that’s an interesting use case. I think, though, that kind of re-check functionality would ideally be layered over distributed queries. They’re more oriented to the ad-hoc side. But, using them in fleet sound require you to build some layers over itl
8:33 PM
If you haven’t already, I’d also encourage you to look at our SaaS. We’ve been trying to help guide users through a lot of that settings process, and then check that it’s done.
terracatta

terracatta

10/02/2020, 8:48 PM
^^ Macear our entire platform is enabling communication between the security team and the end-users (which seems to be a key goal for you). If you use Slack at work you should check it out at kolide.com .
Macear

Macear

10/03/2020, 9:12 AM
The idea with using CI sounds ok, I will think it over. Thanks again. Also we will think about SaaS, need to estimate all pros and cons 👍