Skip to content

Latest commit

 

History

History
163 lines (143 loc) · 10.4 KB

File metadata and controls

163 lines (143 loc) · 10.4 KB

Osquery File Carve Server

Network diagram

Build project

  1. cd osquery-file-carve-server/
  2. go mod init github.com/CptOfEvilMinions/osquery-file-carve-server
  3. go build

Assumptions

  • All blocks of data sent by Osquery will arrive in order
  • All data block sizes for NGINX, Osquery, and Mongo have appropriate settings

Setup

Block size configuration

The default setting for all the configs in this repo is to set the data block size at 10MB (10000000 bytes). Osquery has carver_block_size set to 10000000 (10MB).

Generate your own root CA

  1. Generate your own root CA

Spin up stack

  1. docker-compose build
  2. docker-compose run --rm kolide fleet prepare db --config /etc/kolide/kolide.yml
  3. docker-compose up -d
  4. Setup Kolide
  5. Install Osquery
  6. Enroll Osquery with Kolide

Tested Osquery versions

  • osquery version 4.3.0
  • osquery version 4.4.0

To do

  • Update/finish docs/*
  • Update/finish tests/*
  • Add the ability to clean up unsucessful uploads

Refernces

NGINX

Kolide

Mongo + GridFS

File I/O

net/http + HTTP client

Docker

JWT tokens

Vault

GoLang