Skip to content

kolide_osquery.md

Latest commit

 

History

History
55 lines (50 loc) · 2.12 KB

kolide_osquery.md

File metadata and controls

55 lines (50 loc) · 2.12 KB
Raw

Kolide + Osquery docs

Init Kolide

  1. Open a browser to https://<Kolide FQDN>:8443/setup
  2. Setup user
  3. Enter admin for username
  4. Enter password
  5. Enter e-mail for admin
  6. Select submit
  7. Kolide User Setup
  8. Setup Organization
  9. Enter organization name
  10. Enter organization URL
  11. Select submit
  12. Kolide Org setup
  13. Setup Kolide URL
  14. Accept default
  15. Select Submit
  16. Kolide Org setup
  17. Select "Finish"

Install Osquery 4.4.0 on Ubuntu 20.04

  1. export OSQUERY_KEY=1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B
  2. sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys $OSQUERY_KEY
  3. sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'
  4. sudo apt-get update
  5. sudo apt-get install osquery -y
  6. wget https://raw.githubusercontent.com/CptOfEvilMinions/osquerey-file-carve-server/master/conf/osquery/osquery.flags -O /etc/osquery/osquery.flags
  7. sed -i 's/kolide.hackinglab.local:8443/<FQDN or IP addr of Kolide:<port> /g' /etc/osquery/osquery.flags
  8. scp <server cert> <user>@<ubuntu IP addr>:/etc/osquery/snakeoil.crt

Add Osquery host to Kolide

  1. Login into Kolide
  2. Select "Add New Host" in the top right
  3. Select "Show" above the secret text box
  4. Copy "Osquery Enroll Secret"
  5. Osquery Enroll Secret
  6. SSH into VM with osquery
  7. echo '<osquery enroll secret>' > /etc/osquery/osquery.key
  8. systemctl restart osqueryd
  9. Open a browser to https://<Kolide FQDN>:8443/hosts/manage

Test query

  1. Select new host via the Kolide webGUI
  2. Query: SELECT * FROM osquery_info
  3. Select "RUN"
  4. Within a few seconds the results pane at the bottom should populate with results

References

Kolide