Title
#general
teoseller

teoseller

07/05/2018, 12:57 PM
Dear i have a question, i would like to enable the support to Windows Event Log, but i don't have the file osquery.man under the osquery directory ...who can help me?
y

yuvalapidot

07/05/2018, 1:44 PM
Hey, I am not sure if that helps - but from https://github.com/facebook/osquery/blob/master/docs/wiki/installation/install-windows.md, it seems like you can also use 'manage-osqueryd.ps1' - which is installed by default with osquery on Windows. Install: .\manage-osqueryd.ps1 -installWelManifest Uninstall: .\manage-osqueryd.ps1 -uninstallWelManifest BTW, if you didn't do it yet, you should add --windows_event_channels to your flags, I set it to: --windows_event_channels=System,Application,Setup,Security,Microsoft-Windows-PowerShell/Operational. I also used --disable_events=false, though I am not completely sure it is a must with windows_events...
teoseller

teoseller

07/05/2018, 3:01 PM
ah great ..thanks
3:01 PM
but this flag " --windows_event_channels=System,Application,Setup,Security,Microsoft-Windows-PowerShell/Operational." ...exactly what this flag do ?
3:01 PM
it is not clear to me
y

yuvalapidot

07/09/2018, 8:22 AM
Sorry for the late response. List of Windows event log channels to subscribe to. By default the Windows event log publisher will subscribe to some of the more common major event log channels. However you can subscribe to additional channels using the Log Name field value in the Windows event viewer. To see the list of possible event logs open Event Viewer in Windows, and search the log names.
teoseller

teoseller

07/09/2018, 10:40 AM
No problem thanks for the response .
10:42 AM
But after I subscribe ...what happen? What osquery do with that subscription? Send the log to a central management server like kolide ? You can query the subscrib channel ? Is not clear to me .
10:42 AM
Thank you again
y

yuvalapidot

07/09/2018, 10:56 AM
Once you enabled Windows events and subscribed to the channels you wanted, osquery is able to query the events from the Windows event logger. Of course - you have to query the Windows_events table to get the data regarding the windows events:
select * from windows_events
. Afaik, the windows_events tables (though ends with '_events') is not a pure osquery event table - thus you can try query it even in osqueryi if you use the proper flags. Nevertheless, using scheduled query for event tables is probably preferable - using Kolide fleet or any other fleet management tool can be useful for you but not mandatory, you can also log scheduled queries to a log file and read it from there.
teoseller

teoseller

07/09/2018, 12:30 PM
Thanks a lot super super useful !!! Really thanks