Mystery Incorporated
06/23/2021, 1:41 AM2021/06/23 11:41:36 http: TLS handshake error from x.x.x.x:52295: local error: tls: bad record MAC
zwass
Mystery Incorporated
06/23/2021, 1:45 AMzwass
Mystery Incorporated
06/23/2021, 1:47 AM"C:\Program Files\osquery\osqueryd\osqueryd.exe" --flagfile="C:\Program Files\osquery\osquery.flags"
zwass
Mystery Incorporated
06/23/2021, 1:54 AMC:\Program Files\osquery>osqueryd.exe --flagfile="C:\Program Files\osquery\osquery.flags"
C:\Program Files\osquery\osqueryd\osqueryd.exe --flagfile="C:\Program Files\osquery\osquery.flags"
Now service is running and the message about tls is not being spamed fleet side, but the host does not show as online and if I delete it, it does not re-enrolChris
06/23/2021, 1:41 PMMartavis Parker
06/23/2021, 2:38 PMzwass
Mystery Incorporated
06/23/2021, 5:23 PMChris
06/23/2021, 5:41 PMMystery Incorporated
06/23/2021, 6:34 PM--enable_ntfs_event_publisher=true
--enable_windows_events_subscriber=true
--enable_windows_events_publisher=true
--enable_powershell_events_subscriber=true
--events_optimize=true
--events_max=200000
--events_expiry=86400
--disable_events=false
--windows_event_channels=System,Application,Setup,Security,Microsoft-Windows-Windows Firewall With Advanced Security/Firewall,Microsoft-Windows-Windows Firewall With Advanced Security/ConnectionSecurity
# Server
--tls_hostname=<http://mydomain.com:8881|mydomain.com:8881>
--tls_server_certs=fleet.pem
# Enrollment
--host_identifier=instance
--enroll_secret_path=secret.txt
--enroll_tls_endpoint=/api/v1/osquery/enroll
# Configuration
--config_plugin=tls
--config_tls_endpoint=/api/v1/osquery/config
--config_refresh=10
# Live query
--disable_distributed=false
--distributed_plugin=tls
--distributed_interval=10
--distributed_tls_max_attempts=3
--distributed_tls_read_endpoint=/api/v1/osquery/distributed/read
--distributed_tls_write_endpoint=/api/v1/osquery/distributed/write
# Logging
--logger_plugin=tls
--logger_tls_endpoint=/api/v1/osquery/log
--logger_tls_period=10
# File carving
--disable_carver=false
--carver_start_endpoint=/api/v1/osquery/carve/begin
--carver_continue_endpoint=/api/v1/osquery/carve/block
--carver_block_size=2000000
Martavis Parker
06/23/2021, 9:18 PMMystery Incorporated
06/25/2021, 4:11 AMMartavis Parker
06/25/2021, 3:10 PM