MACOS INSTALL OSQUERY WINDOWS

This configuration has process and network auditing enabled, so expect an exponentially higher volume of logs to be returned from the agent. Servers: The contents of this folder are tailored towards monitoring Linux servers.We purposely set the interval to this value because the interval timer only moves forward when a host is online and we would only expect an endpoint to be online for about 8 hours, or 28800 seconds, per day. You may notice the interval of many queries in this folder set to 28800.

MACOS INSTALL OSQUERY WINDOWS

Endpoints: The contents of this folder are tailored towards monitoring MacOS and Windows endpoints that are not expected to be online at all times.Within each of those folders, you will find the following subdirectories:

The Fleet directory contains YAML files to be imported into Kolide's Fleet osquery management tool.

The Classic directory contains configuration files for a standard osquery deployment.

At the top level, there are two directories titled 'Classic' and 'Fleet'.

In order to ensure you receive the most up to date version of the pack, please view them using the links below: Note: We also utilize packs that are maintained in the official osquery project. Operators have carefully considered the datasets to be collected and the potential use-cases for that data. That are more tailored to our specific environment that may be useful to some or at least serve as a reference to other organizations. However, we have included additional query packs Our belief that queries which are likely to have a high level of utility for a large percentage of users should be committed directly to the osquery project, which isĮxactly what we have done with our unwanted-chrome-extensions query pack and additions to the windows-attacks pack. The goal of this project is to provide a baseline template for any organization considering a deployment of osquery in a production environment. This repository is the companion to the osquery Across the Enterprise blog post. Palantir osquery Configuration About This Repository

Macos install osquery