cookbook 'osquery', '= 1.4.0'
osquery
(17) Versions
1.4.0
-
Follow4
Install and configure osquery (osquery.io)
cookbook 'osquery', '= 1.4.0', :supermarket
knife supermarket install osquery
knife supermarket download osquery
osquery chef cookbook
- Installs, configures, and starts osquery.
- Configurations are generated based on node attributes.
Requirements
- Chef >= 12.1.0
- OS X
- Ubuntu
- 12.04
- 14.04
- Centos/Redhat
- 6.5+
- 7.0+
General Attributes
attributes/default.rb
:
name | type | default | description |
---|---|---|---|
['osquery']['version'] |
String |
1.7.4 |
osquery version to install |
['osquery']['packs'] |
Array |
%w(incident-response osx-attacks) |
osquery packs found in files/default/packs/
|
['osquery']['pack_source'] |
String |
osquery |
cookbook to load osquery packs from |
['osquery']['repo']['el6_checksum'] |
String |
- | SHA256 Hash of the centos6 repo |
['osquery']['repo']['el7_checksum'] |
String |
- | SHA256 Hash of the centos7 repo |
['osquery']['repo']['osx_checksum'] |
String |
- | SHA256 Hash of the os x pkg file |
['osquery']['audit']['enabled'] |
Boolean |
true |
flag to enable/disable chef audits |
Configuration Attributes
attributes/config.rb
:
name | type | default | description |
---|---|---|---|
['osquery']['options']['config_plugin'] |
String |
filesystem |
configuration plugin |
['osquery']['options']['logger_plugin'] |
String |
filesystem |
logger plugin |
['osquery']['options']['schedule_splay_percent'] |
Fixnum |
10 |
query schedule splay percentage |
['osquery']['options']['events_expiry'] |
Fixnum |
3600 |
timeout to expire eventing pubsub results |
['osquery']['options']['verbose'] |
Boolean |
false |
enable verbose informational messages |
['osquery']['options']['worker_threads'] |
Fixnum |
2 |
number of work dispatch threads |
['osquery']['options']['enable_monitor'] |
Boolean |
false |
enable schedule monitor |
['osquery']['syslog']['enabled'] |
Boolean |
true |
enable syslog tables |
['osquery']['syslog']['filename'] |
String |
/etc/rsyslog.d/60-osquery.conf |
syslog conf file path |
Query Schedule Attributes
attributes/schedule.rb
:
name | type | default | description |
---|---|---|---|
['osquery']['schedule'] |
Hash |
osquery_info and file_events | osquery schedule |
File Integrity Monitoring Attributes
attributes/file_paths.rb
:
name | type | default | description |
---|---|---|---|
['osquery']['file_paths'] |
Hash |
homes, etc, and tmp | file paths to monitor events from |
['osquery']['fim_enabled'] |
Boolean |
false | enable/disable file event tracking in config |
Custom Resources
osquery_conf
: creates osquery config from selected options and packs.
create
:
osquery_conf osquery_config_path do action :create schedule node['osquery']['schedule'] fim_paths node['osquery']['file_paths'] packs node['osquery']['packs'] pack_source node['osquery']['pack_source'] end
delete
:
osquery_conf 'delete osquery config' do action :delete end
osquery_conf attributes:
* action: :create
or :delete
* schedule: (required) Hash of scheduled queries to run
* fim_paths: (optional) Hash of file integrity monitoring path descriptions and array of their paths
* packs: (optional) List of osquery packs to install. Based on filenames ending in *.conf
in pack_source/packs
* pack_source: (optional) Cookbook source for osquery packs
* The daemon configuration is compiled from the node['osquery']['options']
attributes.
Testing
Run $ rake
to execute:
* foodcritic
* rubocop
* chefspec
Requirements: VirtualBox with Extension Pack (for the OS X vm)
* $ kitchen list
to show integration test suites <br />
* $ kitchen converge
to run test suites
Note: Audit mode is enabled in the Kitchen yaml by default. The tests are found in ./recipes/audit.rb
and run post converge. To disable, override the node['osquery']['audit']['enabled']
attribute to false
.
Usage
- Include
osquery
in your node'srun_list
- Override attributes to fit your desired setup
Contributing
- Fork the repository on Github.
- Create a named feature branch (like
add_component_x
). - Write your change.
- Write tests for your change.
- Run the tests, ensuring they all pass (
rubocop; rspec
). - Submit a Pull Request using Github.
License and Authors
- Authors: Jack Naglieri (jacknagzdev@gmail.com)
Copyright 2013-2014 Jack Naglieri <jacknagzdev@gmail.com> Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
Dependent cookbooks
apt >= 0.0.0 |
Contingent cookbooks
There are no cookbooks that are contingent upon this one.
osquery CHANGELOG
This file is used to list changes made in each version of the osquery cookbook.
0.1.0
- [jack naglieri] - Initial release of osquery
0.2.0
- [jack naglieri] - Dynamic osquery config template
Check the Markdown Syntax Guide for help with Markdown.
The Github Flavored Markdown page describes the differences between markdown on github and standard markdown.
Collaborator Number Metric
1.4.0 failed this metric
Failure: Cookbook has 0 collaborators. A cookbook must have at least 2 collaborators to pass this metric.
Foodcritic Metric
1.4.0 failed this metric
FC024: Consider adding platform equivalents: /tmp/37f88020b9dab7bfe300e838/osquery/libraries/helpers.rb:19
FC024: Consider adding platform equivalents: /tmp/37f88020b9dab7bfe300e838/osquery/libraries/helpers.rb:28
FC024: Consider adding platform equivalents: /tmp/37f88020b9dab7bfe300e838/osquery/libraries/helpers.rb:37
FC024: Consider adding platform equivalents: /tmp/37f88020b9dab7bfe300e838/osquery/recipes/audit.rb:45
1.4.0 failed this metric
1.4.0 failed this metric
FC024: Consider adding platform equivalents: /tmp/37f88020b9dab7bfe300e838/osquery/libraries/helpers.rb:19
FC024: Consider adding platform equivalents: /tmp/37f88020b9dab7bfe300e838/osquery/libraries/helpers.rb:28
FC024: Consider adding platform equivalents: /tmp/37f88020b9dab7bfe300e838/osquery/libraries/helpers.rb:37
FC024: Consider adding platform equivalents: /tmp/37f88020b9dab7bfe300e838/osquery/recipes/audit.rb:45