osquery.go

// Copyright Elasticsearch B.V. and/or licensed to Elasticsearch B.V. under one
// or more contributor license agreements. Licensed under the Elastic License;
// you may not use this file except in compliance with the Elastic License.

package config

import (
	"encoding/json"
)

// ElasticOptions contains Beat-specific options that are not part of
// osquery's native config schema.
type ElasticOptions struct {
	Install             *InstallConfig             `config:"install" json:"-"`
	QueryProfileStorage *QueryProfileStorageConfig `config:"query_profile_storage" json:"-"`
}

// QueryProfileStorageConfig controls local storage of live query profiles.
type QueryProfileStorageConfig struct {
	Enabled     *bool `config:"enabled" json:"-"`
	MaxProfiles int   `config:"max_profiles" json:"-"`
}

func (c QueryProfileStorageConfig) EnabledOrDefault() bool {
	if c.Enabled == nil {
		return true
	}
	return *c.Enabled
}

func (c QueryProfileStorageConfig) MaxProfilesOrDefault() int {
	if c.MaxProfiles <= 0 {
		return DefaultQueryProfileMaxProfiles
	}
	return c.MaxProfiles
}

type Query struct {
	Query string `config:"query" json:"query"`
	// Native schedule fields.
	Interval int `config:"interval" json:"interval"`
	// ScheduleID is the policy-defined schedule identifier for this scheduled query.
	// Stored in the policy and used in result/response documents for correlation.
	// If empty, the query name is used as the schedule_id when publishing.
	ScheduleID string `config:"schedule_id,omitempty" json:"schedule_id,omitempty"`
	// StartDate is the optional start date for native (interval-based) schedules (RFC3339).
	// Used as the reference for schedule_execution_count.
	StartDate string `config:"start_date,omitempty" json:"start_date,omitempty"`
	// SpaceID is the optional policy space identifier for this scheduled query.
	SpaceID string `config:"space_id,omitempty" json:"space_id,omitempty"`

	Platform    string `config:"platform" json:"platform,omitempty"`
	Version     string `config:"version" json:"version,omitempty"`
	Shard       int    `config:"shard" json:"shard,omitempty"`
	Description int    `config:"description" json:"description,omitempty"`

	// Optional ECS mapping for the query, not rendered into osqueryd configuration
	ECSMapping map[string]interface{} `config:"ecs_mapping" json:"-"`

	// A boolean to set 'snapshot' mode, default true
	// This is different from the default osquery behavior where the missing value defaults to false
	Snapshot *bool `config:"snapshot,omitempty" json:"snapshot,omitempty"`

	// A boolean to determine if "removed" actions should be logged, default true
	// This is the same as osquery behavior
	Removed *bool `config:"removed,omitempty" json:"removed,omitempty"`

	// Optional internal flag to emit per-query profiling for this scheduled query.
	// This is consumed by osquerybeat and not rendered into osqueryd configuration.
	Profile bool `config:"profile" json:"-"`
}

type Pack struct {
	// PackID is the policy-defined pack identifier; used in result/response documents for correlation.
	// If empty, the pack map key (pack name) is used when publishing.
	PackID string `config:"pack_id,omitempty" json:"pack_id,omitempty"`
	// PackName is the policy-defined human-readable pack name; emitted as pack_name in
	// result/response documents alongside pack_id. Optional and not sent to osqueryd.
	PackName  string           `config:"pack_name,omitempty" json:"-"`
	Discovery []string         `config:"discovery" json:"discovery,omitempty"`
	Platform  string           `config:"platform" json:"platform,omitempty"`
	Version   string           `config:"version" json:"version,omitempty"`
	Shard     int              `config:"shard" json:"shard,omitempty"`
	Queries   map[string]Query `config:"queries" json:"queries,omitempty"`
}

// > SELECT * FROM osquery_events where type = 'subscriber';
// +---------------------+---------------------+------------+---------------+--------+-----------+--------+
// | name                | publisher           | type       | subscriptions | events | refreshes | active |
// +---------------------+---------------------+------------+---------------+--------+-----------+--------+
// | apparmor_events     | auditeventpublisher | subscriber | 0             | 0      | 0         | 0      |
// | bpf_process_events  | BPFEventPublisher   | subscriber | 0             | 0      | 0         | 0      |
// | bpf_socket_events   | BPFEventPublisher   | subscriber | 0             | 0      | 0         | 0      |
// | file_events         | inotify             | subscriber | 0             | 0      | 0         | 0      |
// | hardware_events     | udev                | subscriber | 0             | 0      | 0         | 0      |
// | process_events      | auditeventpublisher | subscriber | 0             | 0      | 0         | 0      |
// | process_file_events | auditeventpublisher | subscriber | 0             | 0      | 0         | 0      |
// | seccomp_events      | auditeventpublisher | subscriber | 0             | 0      | 0         | 0      |
// | selinux_events      | auditeventpublisher | subscriber | 0             | 0      | 0         | 0      |
// | socket_events       | auditeventpublisher | subscriber | 0             | 0      | 0         | 0      |
// | syslog_events       | syslog              | subscriber | 0             | 0      | 0         | 0      |
// | user_events         | auditeventpublisher | subscriber | 0             | 0      | 0         | 0      |
// | yara_events         | inotify             | subscriber | 0             | 0      | 0         | 0      |
// +---------------------+---------------------+------------+---------------+--------+-----------+--------+

// The configuration supports a method to explicitly allow and deny events subscribers.
// If you choose to explicitly allow subscribers, then all will be disabled except for those specificied in the allow list.
// If you choose to explicitly deny subscribers, then all will be enabled except for those specificied in the deny list.
type Events struct {
	EnableSubscribers  []string `config:"enable_subscribers" json:"enable_subscribers,omitempty"`
	DisableSubscribers []string `config:"disable_subscribers" json:"disable_subscribers,omitempty"`
}

type OsqueryConfig struct {
	Options               map[string]interface{} `config:"options" json:"options,omitempty"`
	ElasticOptions        *ElasticOptions        `config:"elastic_options" json:"-"`
	Schedule              map[string]Query       `config:"schedule" json:"schedule,omitempty"`
	Packs                 map[string]Pack        `config:"packs" json:"packs,omitempty"`
	Filepaths             map[string][]string    `config:"file_paths" json:"file_paths,omitempty"`
	Views                 map[string]string      `config:"views" json:"views,omitempty"`
	Events                *Events                `config:"events" json:"events,omitempty"`
	Yara                  map[string]interface{} `config:"yara" json:"yara,omitempty"`
	PrometheusTargets     map[string]interface{} `config:"prometheus_targets" json:"prometheus_targets,omitempty"`
	AutoTableConstruction map[string]interface{} `config:"auto_table_construction" json:"auto_table_construction,omitempty"`
}

// Render serializes the OsqueryConfig to JSON for osqueryd configuration.
func (c OsqueryConfig) Render() ([]byte, error) {
	return json.MarshalIndent(c, "", "    ")
}