Does Windows version of OSquery support Socket_eve...
# windows
Does Windows version of OSquery support Socket_events and Process_events tables? From my understanding it does not... From Linux : "platform": "linux", "schedule": { "process_events":{ "query": "SELECT auid, cmdline, ctime, cwd, egid, euid, gid, parent, path, pid, time, uid FROM process_events ;", "interval": 10, "description": "Process events collected from the audit framework" }, "socket_events":{ "query": "SELECT action, auid, family, local_address, local_port, path, pid, remote_address, remote_port, success, time FROM socket_events WHERE remote_address NOT IN ('', "interval": 10, "description": "Socket events collected from the audit framework" }, -- I am trying to figure out windows equivalent of these queries
z is your friend here
Those tables are not supported on windows.
thats what my understanding was - thanks @zwass
While at it Zach, (@zwass) I would like to contribute for these tables for Windows. I have started reading on this topic. If there is already some known work, or windows equivalent of auditD etc, please share it - will come in handy
Windows equivalent of AuditD would be ETW, but the last time I looked, there was no ETW publisher you could turn on that would correlate process events and socket events. You had to attempt to do it yourself, but that approach is prone to race conditions.
We did it anyway and it became this
The reliable way to do it is with a kernel-mode driver, but that violates osquery design principles
Windows also has process auditing, but osquery would have to enable that as a policy change on the host, and that's also against osquery design principles (changes to host configs)
There are a handful of osquery tables that require users to change host configs for deployment. Could that be solution here?
@Shan, at PolyLogyx we have built these tables thru an extension (not the core) as they leverage kernel components. If it interests you, feel welcome to pick the extension from:
For more, you can check on polylogyx-extension channel
Will do. thanks for the info guys. appreciate it.