#KOLIDE OSQUERY INSTALL#
#KOLIDE OSQUERY SERIAL#
#KOLIDE OSQUERY UPGRADE#
#KOLIDE OSQUERY CODE#
#KOLIDE OSQUERY FREE#

Getting osquery working optimally requires an understanding of the configuration options ( /etc/osquery/nf) as well as the runtime flags ( /etc/osquery/osquery.flags). Query these tables on a schedule and know when users plug in a USB drive either for immediate alerting to the SOC or for historical purposes when incident handling.

#KOLIDE OSQUERY SERIAL#

| LJDTT16G |Īnother table of interest is the usb_devices osquery> select usb_port, vendor, model, serial from usb_devices osquery> select driver,vendor,model from hardware_events Particularly important for high security environments (classified networks) or for those IT departments who just want to know when someone plugs in a malware ridden USB device. Rather than digging through log files and the Windows Registry osquery can also help with monitoring for hardware changes. | /usr/lib/systemd/systemd-resolved | 53 | osquery> SELECT p.path, local_port FROM process_open_sockets s JOIN processes p ON s.pid = p.pid WHERE s.state = 'LISTEN' JOIN Example Showing LISTENING services with Executable PathĪn example that shows the value of a SQL JOIN statement combining data from two tables. | path | gb_free | percent_used | device | type | osquery> SELECT path, ROUND( (10e-10 * blocks_available * blocks_size), 1) AS gb_free, 100 - ROUND ((blocks_available * 1.0 / blocks * 1.0) * 100, 1) AS percent_used, device, type FROM mounts WHERE path = '/'

#KOLIDE OSQUERY FREE#

Getting slightly more complicated with a query to calculate the free space on a partition.

Show processes running from container that matches the id SELECT pid, cmdline FROM docker_container_processes WHERE id = '$container_id' Gather information on running containers (docker) SELECT containers, containers_running, containers_paused, containers_stopped FROM docker_info SELECT name, path, pid FROM processes WHERE on_disk = 0 Ī well documented example to show running process where binary has been deleted from disk (common in malware) SELECT * FROM file WHERE path = '/etc/passwd' Retrieve certificate information using curl and dump json output to shell Osqueryi -json 'SELECT * FROM curl_certificate WHERE hostname = ':443' '

Show open socket / network connections similar to netstat Retrieve commands from process event table that match filter (audit events) SELECT * FROM process_events WHERE cmd_line LIKE 'nmap%' Show usb, hard drive changes and other hardware state changes SELECT md5 FROM hash WHERE path = '/etc/passwd'

#KOLIDE OSQUERY CODE#

SELECT url, round_trip_time, response_code FROM curl WHERE url = '' Įxecute curl and report time / HTTP response code SELECT * FROM deb_packages WHERE name LIKE 'python3%' SELECT hostname, cpu_brand, cpu_physical_cores, cpu_logical_cores, physical_memory FROM system_info Get operating system type, version and architecture | 998 | 100 | 998 | 100 | lxd | | /var/snap/lxd/common/lxd | /bin/false | |Īnother example this time with fields selected and a LIMIT: osquery> select uid, username, directory from users LIMIT 5 | 2 | 2 | 2 | 2 | bin | bin | /bin | /usr/sbin/nologin | | | 1 | 1 | 1 | 1 | daemon | daemon | /usr/sbin | /usr/sbin/nologin | | | uid | gid | uid_signed | gid_signed | username | description | directory | shell | uuid | In the below query, we get a list of users (example has been snipped). Using SQL (sqlite is the basis for the SQL syntax) queries, we can query tables to gather information about the operating system. Interactive Shell for Immediate Testing (osqueryi)īefore doing any configuration, we can load the interactive shell to perform test queries. ~$ sudo add-apt-repository 'deb deb main'įollowing this installation the /etc/osquery location will be created for configuration files but these will not be populated at this stage. ~$ sudo apt-key adv -keyserver hkp://:80 -recv-keys $OSQUERY_KEY

#KOLIDE OSQUERY UPGRADE#

The regular system level apt upgrade will upgrade the package as required in the future.

#KOLIDE OSQUERY INSTALL#

It will add the apt repository to the system and install the package. These steps can be used on Debian or Ubuntu based systems. If you are using Fedora or other Linux distros the initial steps are well documented. In this tutorial, we will focus on installation on Ubuntu from the official repository. It has straightforward installation steps for a variety of operating systems and Linux distributions. Originally developed by Facebook, osquery is a well-supported and documented tool.

Kolide osquery