felix
12/09/2019, 10:32 AMapiVersion: v1
kind: pack
spec:
description: test
id: 3
name: test
queries:
- description: ""
interval: 10
name: Info
platform: ""
query: Info
removed: false
shard: 100
snapshot: true
version: ""
targets:
labels:
- All Hosts
zwass
12/09/2019, 5:31 PMfelix
12/09/2019, 5:32 PMzwass
12/09/2019, 5:34 PMfelix
12/09/2019, 5:37 PMzwass
12/09/2019, 5:39 PMfelix
12/09/2019, 5:39 PMzwass
12/09/2019, 5:42 PMfleetctl get pack foo
?felix
12/09/2019, 5:43 PMzwass
12/09/2019, 5:44 PMosqueryd
and the osquery configuration you set in Fleet?felix
12/09/2019, 5:45 PMapiVersion: v1
kind: options
spec:
config:
decorators:
load:
- SELECT uuid AS host_uuid FROM system_info;
- SELECT hostname AS hostname FROM system_info;
options:
disable_distributed: false
distributed_interval: 10
distributed_plugin: tls
distributed_tls_max_attempts: 3
logger_plugin: tls
logger_tls_endpoint: /api/v1/osquery/log
logger_tls_period: 10
pack_delimiter: /
overrides: {}
{
// Configure the daemon below:
"options": {
"enroll_secret_path": "C:\\Program Files\\osquery\\enroll_secret",
"tls_server_certs": "C:\\Program Files\\osquery\\certs\\server.pem",
"tls_hostname": "fleet:443",
"host_identifier": "hostname",
"enroll_tls_endpoint": "/api/v1/osquery/enroll",
"config_plugin": "tls",
"config_tls_endpoint": "/api/v1/osquery/config",
"config_refresh": 30,
"disable_distributed": "false",
"distributed_plugin": "tls",
"distributed_interval": 30,
"distributed_tls_max_attempts": 3,
"distributed_tls_read_endpoint": "/api/v1/osquery/distributed/read",
"distributed_tls_write_endpoint": "/api/v1/osquery/distributed/write",
"logger_plugin": "tls",
"logger_tls_endpoint": "/api/v1/osquery/log",
"logger_tls_period": 10,
"logger_min_stderr": 0,
"logger_min_status": 0
}
}
zwass
12/10/2019, 4:49 PMfelix
12/10/2019, 4:52 PMzwass
12/10/2019, 4:59 PMosquery.conf
into a flagfile and then I think it will work.osqueryd --help
and you will see that config_plugin is a CLI only flag)felix
12/10/2019, 5:14 PMzwass
12/10/2019, 5:43 PM