I ve some decorators configured in osquery but I m not seein osquery #general

I’ve some decorators configured in osquery, but I’...

Jean M

04/15/2020, 6:29 PM

I’ve some decorators configured in osquery, but I’m not seeing the corresponding fields showing in the results log of scheduled packs, is this normal (meaning these decorators are applied somewhere else)? or maybe I’m doing something wrong…

Jean M

04/15/2020, 6:30 PM

Copy code

"decorators": {
        "load": [
            "SELECT uuid AS host_uuid FROM system_info;",
            "SELECT hardware_serial FROM system_info;",
            "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;",
            "SELECT hostname FROM system_info LIMIT 1;"
        ]
    },

seph

04/15/2020, 6:37 PM

Do you intend for those to be of type

load

and not something else? https://osquery.readthedocs.io/en/stable/deployment/configuration/#decorator-queries

Jean M

04/15/2020, 7:37 PM

I’ve not thought much about it yet, but probably I’ll use all the types as in the example, makes more sense in this case I think, like this:

Copy code

"decorators": {
        "load": [
            "SELECT uuid AS host_uuid FROM system_info;",
            "SELECT hardware_serial FROM system_info;"
        ],
        "always": [
            "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
        ],
        "interval": {
        	"3600": [
            	"SELECT hostname FROM system_info LIMIT 1;"
            ]
        }
    },

Thanks, I’ll try with this new configuration

seph

04/15/2020, 8:15 PM

Huh. reading the docs there I understand

always

and

load

but I have no idea what an interval decorator query is.

Jean M

04/15/2020, 8:42 PM

The
interval
type uses a map of interval ‘periods’ as keys, and the set of decorator queries for each value. Each of these intervals MUST be minute-intervals. Anything not divisible by 60 will generate a warning, and will not run.

Jean M

04/15/2020, 8:42 PM

from what I understood, these run at the defined period

seph

04/15/2020, 8:43 PM

Yes. That describes the structure of the setting, but not what it does. What does it mean to run an decorator on a schedule. Why wouldn’t you use a scheduled query for that?

Jean M

04/15/2020, 10:38 PM

Found the problem 😅 a decorator config was left forgotten in tls endpoint and had a syntax error..

24 Views

Open in Slack

Previous Next