-
Version2.4.90 Installation MethodSecurity Onion ISO image Descriptionconfiguration Installation TypeDistributed Locationairgap Hardware SpecsExceeds minimum requirements CPU8 RAM128 Storage for /4 TB Storage for /nsm4 TB Network Traffic Collectionspan port Network Traffic Speeds1Gbps to 10Gbps StatusYes, all services on all nodes are running OK Salt StatusNo, there are no failures LogsNo, there are no additional clues DetailHi, I am loving the product. However, before going to 2.4.x was working perfectly the osquery scheduling. Now, when there is no schedule tab it's just the query you put in and I put in 3600s. I do not see it ever kicking off as a schedule by itself. I come in next day it never ran by itself. I can manually run and it's fine. Any ideas why as to it's not working as interval configuration is set? Thanks guys. Guidelines
|
Beta Was this translation helpful? Give feedback.
Replies: 1 comment
-
|
In OSQUERY under packs click on "Add pack" and then "Add Query". Then under "Scheduled agent policies" You can add for example "endpoint-initial" policy if you're using the default endpoint policy for your elastic agents. I created a test pack and I can see the data coming in every 30 seconds (I set my queries to 30s for testing). I am looking at SOC -> Hunt -> OSQUERY - Live Query. It is a default dashboard included in Security Onion for Hunt. You could then create a new Sigma Detection to monitor the incoming OSQUERY data and generate an alert when it meets your criteria |
Beta Was this translation helpful? Give feedback.
In OSQUERY under packs click on "Add pack" and then "Add Query". Then under "Scheduled agent policies" You can add for example "endpoint-initial" policy if you're using the default endpoint policy for your elastic agents.
I created a test pack and I can see the data coming in every 30 seconds (I set my queries to 30s for testing). I am looking at SOC -> Hunt -> OSQUERY - Live Query. It is a default dashboard included in Security Onion for Hunt.
You could then create a new Sigma Detection to monitor the incoming OSQUERY data and generate an alert when it meets your criteria