Osquery also provides file integrity monitoring ( FIM), and process and socket auditing features and more, thus it is an intrusion detection tool, but this calls for certain configurations before you can deploy it for such a purpose. To display a list of all implemented tables in Linux, use the. If you are running osquery on a desktop and have Firefox or Chrome installed, you can list all your add-ons using the following query. osquery> SELECT DISTINCT processes.name, listening_ports.port, processes.pid FROM listening_ports JOIN processes USING (pid) WHERE listening_ports.address = '0.0.0.0' To get a informatin about running Linux processes, run the following query. To get a list of all installed RPM packages on CentOS, RHEL and Fedora, run the following query. To get a list of all Linux kernel modules and their status, run the following query. To get a well formated list of all users on the Linux system, run the following query. To get a summarized Linux system information run the following command. Once you have successfully installed Osquery on your system, launch the osqueryi shell to start querying the state of your OS as shown. How to Monitor and Analyze Linux Using Osquery $ sudo dnf config-manager -set-enabled osquery-s3-rpm $ dnf config-manager -add-repo -add-repo On Fedora 22+ $ curl -L | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-osquery $ sudo yum-config-manager -enable osquery-s3-rpm-repo On RHEL/CentOS $ curl -L | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-osquery $ sudo apt-key adv -keyserver -recv-keys $OSQUERY_KEY The Osquery can be installed from the official repository using apt yum or dnf package management tool on your respective Linux distribution as shown. Some tables can only be found on a specific operating system, for instance, you only find the kernel_modules table on Linux systems.Īdditionally, you can run queries to monitor and analyze OS state on a single host via the osqueryi shell, or on several hosts on a network via a scheduler or execute them from any of your custom applications using osquery Thrift APIs. Osquery use a simple plugin and extensions API to implement SQL tables, there is a collection of tables in existence ready for use, and more are being written. It combines a number of tools which perform low-level OS analytics and monitoring these tools reveal an operating system as a high-performance relational database such as MySQL/ MariaDB, PostgreSQL and more, where OS concepts are represented in tabular form, thus allowing users to employ SQL commands to carry out system monitoring and analytics. It is a simple and easy-to-use operating system explorer. Osquery is a free open source, powerful and cross-platform SQL-based operating system instrumentation, monitoring, and analytics framework for Linux, FreeBSD, Windows, and Mac/OS X systems, built by Facebook.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |