https://github.com/osquery/osquery logo
Title
p

pirxthepilot

11/14/2018, 10:18 PM
Is there a way to push YARA config using fleet 1.0.9?
m

marpaia

11/15/2018, 12:48 AM
if you upgrade to fleet 2.0.0, you can distribute any osquery configurations you need with the
fleetctl
CLI
p

pirxthepilot

11/15/2018, 12:52 AM
that's great! and is 2.0.0 backwards compatible with osquery 2.x versions? we are still running 2.11.2.
m

marpaia

11/15/2018, 12:53 AM
i haven’t tested that exactly if i’m being honest, but i would expect it to be ok
but for sure test it if upgrading osquery is out of the question
but consider updating osquery too 🙂
p

pirxthepilot

11/15/2018, 12:55 AM
we definitely will, it will just take time cos we have many thousands of endpoints haha. say we stick with fleet 1.0.9 for now, will yara config still be possible there?
m

marpaia

11/15/2018, 12:58 AM
if you could independently distribute the yara sigs, you might be able to do some tom foolery at the database shell to make it happen
but i really suggest testing out osquery 2.11.2 with fleet 2.0.0
it almost definitely works
2.11.2 was a pretty stable release
the last of the 2's iirc
p

pirxthepilot

11/15/2018, 1:01 AM
hmm yeah sounds like a good opportunity to upgrade to 2.0. looking forward to fleetctl, btw 🙂 thanks Mike!
🤘 1
u

8p8c

11/15/2018, 1:21 AM
How would you get the yara signature file into fleet so that you could it get to endpoints?
m

marpaia

11/15/2018, 1:21 AM
yara signatures are loaded from disk, always
fleet is just saying where they are on the filesystem
u

8p8c

11/15/2018, 1:25 AM
Am I misunderstanding if i think that one would not be able to get the signature file out there with the help of only fleet[ctl]?
m

marpaia

11/15/2018, 2:33 AM
yeah, that is more of a matter of how you deploy and configure osquery on individual hosts. this is more of a problem that launcher aims to help with, although launcher doesn’t currently have any features that enable distributing and maintaining yara signatures.
u

8p8c

11/15/2018, 2:35 AM
👍 thanks for clarifying!
m

marpaia

11/15/2018, 2:35 AM
of course, happy to help, this whole ecosystem can be pretty confusing at times