https://github.com/osquery/osquery logo
Join Slack
Powered by
Hey y’all, I am creating a blog post on: - Install...
# fleet
c
Hey y’all, I am creating a blog post on: • Installing/setting up FleetDM manually on Ubuntu 20.04 • Installing/setting up FleetDM with an Ansible playbook • Installing/setting up FleetDM with Docker-compose v2.x, • Installing/setting up FleetDM with Docker swarm v3.X. • How to manually install Osquery on Windows and Ubuntu • How to install Osquery on endpoints with an Ansible playbook • Section on converting an Osquery query pack to the YAML format to upload to FleetDM with FleetCTL • Section on creating query pack via webgui • Section on running live queries with FleetCTL • Section on running live queries with web gui • Section on the new file carve feature in FleetDM In a thread below, please add any additional items I should cover in my blog post for first time FleetDM users.
👍 3
z
CI/CD for queries
Personally I'd love a deep dive on the options in the 
flags
file and the 
conf
file.
c
@Zach Zeid I love the idea about CI/CD but I will probably cover that in a separate post since I don’t know of an easy way to implement that.
It would require some additional research and implementation but I love the idea 🙂
@Zach Zeid attempting to generate a discussion here. Is there something specific about the flags file that the Osquery documentation doesn’t cover?
Or is the fact that as a blog writer I just hand you a flags file without any context as to why i choose the flags I did? If so, I might meet you in the middle and add a comment to each flag option with supporting references linking to Osquery’s documentation
z
I'm generally a dense person, and it's not really clear to me when something should be in 
flags
vs 
conf
, and what options are required vs what aren't vs what options selected need other required flags
c
Ahhhh. Yeah that took me some time to understand as well.
z
I've generally been told that the docs make sense, but they don't for me, that's my hottake
c
I think I can providence so on that topic that will help ppl 🙂
🎉 1
m
I would be interested in "alerting" strategies based on query packs/snapshots 🙂
c
@maxwhite can you elaborate/provide an example on what you mean by alerting strategies?
m
For example, if I want to be alerted when a device is not encrypted (what to look for in the logs, how to send to a SIEM/Lambda?)
But it might be too infrastructure-dependant for a general blog
c
yeah that would be a more IR focused blog post for me. However, it’s good to know ppl are interested in something like that for a future blog post
👍 1
@Zach Zeid per your comment above on when to add a config setting to 
osquery.flags
vs. 
osquery.conf
I wrote guidance on my latest blog post here: https://holdmybeersecurity.com/2021/01/07/getting-started-with-fleetdm-v3-6-0/
🎉 1
Checkout it out and let me know if that helps 🙂
@Zach Zeid also per your first comment on CI/CD I am currently working on mocking up a CI/CD pipeline with Gitlab which will turn into a blog post
🎉 1
z
Thanks man for the work, I'll check it out! Looking forwarding to the next release 😄
5 Views
Open in Slack
PreviousNext
Powered by