Osquery is an operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive. Osquery exposes an operating system as a high-performance relational database. Infrastructure reliability, or compliance, osquery gives you the ability to empower and inform a broad set of organizations within your company. Osquery is a multi-platform software, can be installed on Linux, Windows, MacOS, and FreeBSD. Osquery allows us to explore the operating system profile, performance, security and many more metrics by using SQL-based queries. In this tutorial, I will show you how to install osquery on the Linux distributions Ubuntu 18.04 LTS and CentOS 7. Osquery Description. Osquery is an operating system instrumentation framework for Windows, OS X (macOS), Linux, and FreeBSD. The tools make low-level operating system analytics and monitoring both performant and intuitive.
Osquery is an operating system instrumentation framework for Linux that exposes this operating system as a high-performance relational database so that SQL queries can explore the operating system data. With osquery, SQL tables represent abstract concepts such as running processes, loaded kernel modules, open network connections, browser plugins, hardware events, or file hashes.
AT&T Cybersecurity recommends that you install the AlienVault Agent on your Linux hosts to monitor endpoints and collect logs. Alternatively, you can use osquery to collect data and send them to USM Anywhere through syslog.
Osquery
Note: Do not run osquery in parallel with the AlienVault Agent because it will interfere with the agent and cause USM Anywhere not to parse the data it receives.
You must have sudoA program for UNIX-like computer operating systems that allows users to run programs with the security privileges of another user, by default the superuser. privileges to complete the following procedure.
To collect logs from Linux using osquery
Osquery Daemon And Shell
- If you do not yet have osquery, download it and follow the instructions appropriate for your operating system.
Create a text file called osquery.conf and copy-paste the contents of this file into it.
Important: After you copy-paste the text, make sure to edit it so that all strings with equals signs (=) in them remain on the same line. Otherwise, this procedure will fail.
- Save osquery.conf and copy it to /etc/osquery/.
Note: We recommend leaving the queries created by default, but you can create your own osquery configuration.
- Start the osquery daemon:
If you have not already done so, configure syslog to send data to the USM Anywhere Sensor. See Linux Log Collection with Syslog for instructions.
This should include restarting the syslog service.
Verify that you can see osquery events in USM Anywhere.