Skip to content

Instantly share code, notes, and snippets.

@groob

groob/osquery.conf

Last active June 5, 2018 03:14
Show Gist options
  • Save groob/13a4036c1e74d9259503d4905e9dc919 to your computer and use it in GitHub Desktop.
Save groob/13a4036c1e74d9259503d4905e9dc919 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. groob revised this gist Jun 5, 2018. 1 changed file with 6 additions and 0 deletions.
    6 changes: 6 additions & 0 deletions osquery.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -1,4 +1,10 @@
    {
    "decorators": {
    "load": [
    "SELECT uuid AS host_uuid FROM system_info;",
    "SELECT hostname AS hostname FROM system_info;"
    ]
    },
    "options": {
    "logger_plugin": "gcs",
    "host_identifier": "hostname",
  2. groob revised this gist Jun 5, 2018. 1 changed file with 0 additions and 6 deletions.
    6 changes: 0 additions & 6 deletions osquery.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -15,11 +15,5 @@
    }
    }
    }
    },
    "schedule": {
    "foobar": {
    "query": "SELECT * from os_version",
    "interval": 10
    }
    }
    }
  3. groob revised this gist Jun 5, 2018. 1 changed file with 1 addition and 0 deletions.
    1 change: 1 addition & 0 deletions osquery.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -2,6 +2,7 @@
    "options": {
    "logger_plugin": "gcs",
    "host_identifier": "hostname",
    "pack_delimiter": "/",
    "schedule_splay_percent": 10
    },
    "packs": {
  4. groob revised this gist Jun 5, 2018. 1 changed file with 12 additions and 1 deletion.
    13 changes: 12 additions & 1 deletion osquery.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -4,10 +4,21 @@
    "host_identifier": "hostname",
    "schedule_splay_percent": 10
    },
    "packs": {
    "server_windows": {
    "queries": {
    "agn_time-query": {
    "query": "select * from time;",
    "interval": 1,
    "platform": ""
    }
    }
    }
    },
    "schedule": {
    "foobar": {
    "query": "SELECT * from os_version",
    "interval": 10
    }
    }
    }
    }
  5. groob revised this gist Jun 5, 2018. 1 changed file with 1 addition and 2 deletions.
    3 changes: 1 addition & 2 deletions osquery.conf
    View file
    Original file line number Diff line number Diff line change
    @@ -7,8 +7,7 @@
    "schedule": {
    "foobar": {
    "query": "SELECT * from os_version",
    "interval": 10,
    "snapshot": true
    "interval": 10
    }
    }
    }
  6. groob renamed this gist Jun 1, 2018. 1 changed file with 0 additions and 0 deletions.
    0 gistfile1.txt → osquery.conf
    View file
    File renamed without changes.
  7. groob created this gist Jun 1, 2018.
    14 changes: 14 additions & 0 deletions gistfile1.txt
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,14 @@
    {
    "options": {
    "logger_plugin": "gcs",
    "host_identifier": "hostname",
    "schedule_splay_percent": 10
    },
    "schedule": {
    "foobar": {
    "query": "SELECT * from os_version",
    "interval": 10,
    "snapshot": true
    }
    }
    }