-
Notifications
You must be signed in to change notification settings - Fork 36
Expand file tree
/
Copy pathMakefile
More file actions
201 lines (185 loc) · 6.43 KB
/
Makefile
File metadata and controls
201 lines (185 loc) · 6.43 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
include .env
EKS_CLUSTER_NAME=hubert-superset
topic:
confluent kafka topic --cluster $(CLUSTER_ID) create osquery-pinot
confluent kafka topic --cluster $(CLUSTER_ID) create suspicious_processes
pinot.table.config:
@mkdir -p tables
@jinja \
-D BOOTSTRAP $(BOOTSTRAP) \
-D CONFLUENT_KEY $(CONFLUENT_KEY) \
-D CONFLUENT_SECRET $(CONFLUENT_SECRET) \
-D CLUSTER_ID $(CLUSTER_ID) \
-D SCHEMA_REGISTRY $(SCHEMA_REGISTRY) \
-D CONFLUENT_SR_KEY $(CONFLUENT_SR_KEY) \
-D CONFLUENT_SR_SECRET $(CONFLUENT_SR_SECRET) \
-D TOPIC $(TOPIC) \
templates/osquery-table.json.j2 \
> tables/osquery-table.json
pinot.table: pinot.table.config
pinot-admin AddTable \
-tableConfigFile tables/osquery-table.json \
-schemaFile schemas/osquery-schema.json \
-controllerHost $(CONTROLLER_HOST) \
-controllerPort $(CONTROLLER_PORT) \
-exec
suspicious.pinot.table: pinot.table.config
pinot-admin AddTable \
-tableConfigFile tables/osquery-suspicious-table.json \
-schemaFile schemas/osquery-schema.json \
-controllerHost $(CONTROLLER_HOST) \
-controllerPort $(CONTROLLER_PORT) \
-exec
suspicious_osquery_cleansed:
@decodable stream create \
--name suspicious_osquery_cleansed \
--description "osquery cleansed processes" \
--field name=string \
--field hostIdentifier=string \
--field calendarTime=string \
--field unixTime=bigint \
--field epoch=bigint \
--field counter=int \
--field numerics=boolean \
--field cmdline=STRING \
--field cwd=STRING \
--field disk_bytes_read=BIGINT \
--field disk_bytes_written=BIGINT \
--field egid=INT \
--field euid=INT \
--field gid=INT \
--field process_name=STRING \
--field nice=INT \
--field on_disk=INT \
--field parent=BIGINT \
--field path=STRING \
--field pgroup=BIGINT \
--field pid=BIGINT \
--field resident_size=BIGINT \
--field root=STRING \
--field sgid=INT \
--field start_time=BIGINT \
--field state=INT \
--field suid=INT \
--field system_time=BIGINT \
--field threads=INT \
--field total_size=BIGINT \
--field uid=INT \
--field user_time=BIGINT \
--field wired_size=INT \
--field action=string
osquery_cleansed_sink:
@decodable conn create \
--name osquery_cleansed_sink \
--connector confluent-cloud \
--type sink \
--stream-id $(shell decodable stream list -o json | jq -sr '.[] |select(.name=="cleansed_processes")|.id ' ) \
--field name=string \
--field hostIdentifier=string \
--field calendarTime=string \
--field unixTime=bigint \
--field epoch=bigint \
--field counter=int \
--field numerics=boolean \
--field cmdline=STRING \
--field cwd=STRING \
--field disk_bytes_read=BIGINT \
--field disk_bytes_written=BIGINT \
--field egid=INT \
--field euid=INT \
--field gid=INT \
--field process_name=STRING \
--field nice=INT \
--field on_disk=INT \
--field parent=BIGINT \
--field path=STRING \
--field pgroup=BIGINT \
--field pid=BIGINT \
--field resident_size=BIGINT \
--field root=STRING \
--field sgid=INT \
--field start_time=BIGINT \
--field state=INT \
--field suid=INT \
--field system_time=BIGINT \
--field threads=INT \
--field total_size=BIGINT \
--field uid=INT \
--field user_time=BIGINT \
--field wired_size=INT \
--field action=string \
--prop cluster.api.endpoint=https://$(BOOTSTRAP) \
--prop cluster.id=$(CLUSTER_ID) \
--prop topic=osquery-pinot \
--prop format=json \
--prop cluster.api.key=$(CONFLUENT_KEY) \
--prop cluster.api.secret=$(CONFLUENT_SECRET)
suspicious_osquery_cleansed_sink:
@decodable conn create \
--name suspicious_osquery_cleansed_sink \
--connector confluent-cloud \
--type sink \
--stream-id $(shell decodable stream list -o json | jq -sr '.[] |select(.name=="suspicious_osquery_cleansed")|.id ' ) \
--field name=string \
--field hostIdentifier=string \
--field calendarTime=string \
--field unixTime=bigint \
--field epoch=bigint \
--field counter=int \
--field numerics=boolean \
--field cmdline=STRING \
--field cwd=STRING \
--field disk_bytes_read=BIGINT \
--field disk_bytes_written=BIGINT \
--field egid=INT \
--field euid=INT \
--field gid=INT \
--field process_name=STRING \
--field nice=INT \
--field on_disk=INT \
--field parent=BIGINT \
--field path=STRING \
--field pgroup=BIGINT \
--field pid=BIGINT \
--field resident_size=BIGINT \
--field root=STRING \
--field sgid=INT \
--field start_time=BIGINT \
--field state=INT \
--field suid=INT \
--field system_time=BIGINT \
--field threads=INT \
--field total_size=BIGINT \
--field uid=INT \
--field user_time=BIGINT \
--field wired_size=INT \
--field action=string \
--prop cluster.api.endpoint=https://$(BOOTSTRAP) \
--prop cluster.id=$(CLUSTER_ID) \
--prop topic=suspicious_processes \
--prop format=json \
--prop cluster.api.key=$(CONFLUENT_KEY) \
--prop cluster.api.secret=$(CONFLUENT_SECRET)
suspicious_osquery_cleansed_pipeline:
@decodable pipeline create \
--name suspicious_osquery_cleansed_pipeline \
--description "demo day osquery_cleanse" \
- < sql/suspicious.cleanse.sql
active:
decodable connection activate --force $(shell decodable connection list -o json | jq -sr '.[] |select(.name=="osquery_cleansed_sink")|.id ' )
decodable connection activate --force $(shell decodable connection list -o json | jq -sr '.[] |select(.name=="suspicious_osquery_cleansed_sink")|.id ' )
decodable pl activate --force $(shell decodable pl list -o json | jq -sr '.[] |select(.name=="suspicious_osquery_cleansed_pipeline")|.id ' )
flow: sink table
drop:
pinot-admin ChangeTableState \
-tableName osquery \
-state drop \
-controllerHost $(CONTROLLER_HOST) \
-controllerPort $(CONTROLLER_PORT)
clean:
decodable conn deactivate --force $(shell decodable connection list -o json | jq -sr '.[] |select(.name=="osquery_cleansed_sink")|.id ' )
decodable conn delete $(shell decodable connection list -o json | jq -sr '.[] |select(.name=="osquery_cleansed_sink")|.id ' )
decodable conn deactivate --force $(shell decodable connection list -o json | jq -sr '.[] |select(.name=="suspicious_osquery_cleansed_sink")|.id ' )
decodable conn delete $(shell decodable connection list -o json | jq -sr '.[] |select(.name=="suspicious_osquery_cleansed_sink")|.id ' )
decodable pl deactivate $(shell decodable pl list -o json | jq -sr '.[] |select(.name=="suspicious_osquery_cleansed_pipeline")|.id ' )
decodable pl delete $(shell decodable pl list -o json | jq -sr '.[] |select(.name=="suspicious_osquery_cleansed_pipeline")|.id ' )