All right, and welcome to the first lab in the course.
What we're going to do here is install osquery really
quickly in our Linux workstation,
and we're just going to follow the instructions on
the osquery documentation page.
We'll then go ahead and walk through the example
configuration that comes with it and then copy/paste our
configuration for this course into there.
We'll start it up and then just validate that the data is coming in.
So, hopping over to the website,
we're on the Downloading & Installing Osquery page.
And what I'm going to do is I'm just going to do an easy install.
I'm going to use the repository install option for Debian.
Let's get started with this.
Since this is an Ubuntu box, this will work for us.
So, I'm just going to start copy/pasting the commands in.
The first one is importing the key and then configuring the key server for it.
And you can customize this based on how you want to install it.
You can download the packages yourselves and install
them as well if you wanted to.
And then, depending on your Linux flavor,
we have all these repository installation methods as well.
And then, so I'm just going to do the apt‑get update command next.
All right,
and this is just kicking it back saying that we have the
repositories configured several times in here.
I'll do the update, and then let's install it, apt‑get install osquery.
All right.
Now that that's installed,
we have a couple different directories that we can actually
go look into to validate that it's installed correctly and
to look at that example config.
So, the first one is the opt directory, and we have /opt/osquery.
And what I'm going to navigate to is the share directory.
And then inside of this, we have a couple different options.
And as you can see, we have this example.conf file.
So, this is a great way to get started with osquery if you're unfamiliar with it,
so you can kind of see what some of the options are
when you're configuring them,
so you can look at some of the packs that can get installed or be
used as well and then some of the features.
We're going to be creating our own configuration file instead and using
custom configurations just so we can make sure that we can track the
techniques that we're specifically looking for.
What we want to do is navigate to the etc/osquery directory.
And as you can see, there's nothing in here.
But this is the directory that, by default,
on Ubuntu with the repository install method,
this is the default directory that it looks in for the conf file.
You can either copy over that example conf and
customize the configuration in here,
or you can just do what we're going to do and build your own.
I'm using nano to create the osquery.conf file.
And then, I already have my configuration copied.
So, I'm just going to paste it in here,
and then we'll hop up and look at some of it.
So, scrolling to the top of it,
we have some options that we have preconfigured in here.
We're enabling file events, and we'll talk about that later.
Our platform is Linux,
and then we're looking for specific events in the operating system.
So, we're looking for process events.
We're looking for socket events, file events, CPU events.
We're interested in the listening ports, the memory info, so on and so forth.
So,
each one of these is looking for a different component
for us to be able to pull data from.
We have some additional options below that as well.
So, we're going to save that and exit.
And then, one other file that we need to create is the osquery.flags file,
and this gives us additional options as well.
It gives us options like the watchdog memory limits and the
persistence for the audits and everything like that.
And now that that configuration is done, all we need to do is start up osquery.
So,
we're going to do the systemctl enable osquery to make sure
that it starts up with the operating system.
And, as you can see, it's not a service.
So, we actually have to use the osqueryd service instead.
Now, when you install osquery, it splits it up between osqueryd and osqueryi.
I is if you want to run it for testing purposes or an individual instance of it,
and then the d is if you want to run it as a daemon.
And then, we'll just start it up,
and then let's check on it to make sure that it's good to go.
As you can see, everything started and it's good.
And after a couple more seconds,
we can validate that it's still running and there were no errors.
All right.
Now, the next step that we need is we need to be able to see the actual data.
So,
the data is coming in in the var/log/osquery and then the osquery results.log.
And as you can see, we're already starting to get some data here.
Now, if we go back to the actual configuration file,
if we look at something like the user's queries that we're doing,
the interval is set to 60 seconds,
so that means it's going to pull the user events and the
user snapshots every 60 seconds for us,
and you can customize this however you feel like you
need to in your own environment.
I have most of them set to 60 for the purposes of this lab just to make
sure that we can get the data in a decent amount of time.
The final component to our setup specifically is going to be Filebeat.
No,
I'm not going to walk through how to configure Filebeat and then Elastic Stack.
Pluralsight has many different courses on how to do so.
And also,
the Elastic Stack website is a great tool to be able to walk you through it.
But just to validate that we do have it configured and enabled,
we have Filebeat running.
And if we go into the Filebeat modules,
we're actually using an osquery module for Filebeat to be able to
help us normalize the data as we're ingesting it and sending it over
to the Elastic Stack so we can view it.
So, if we look at the osquery.yml file inside of the modules folder, we
have our var path set and the module enabled is true.
So, everything should be up and running. We should
be getting our data into Kibana.
So, let's go check that out real quick as our validation. Here we are in our
Kibana instance, and I'm going to go to the Discover tab. I already have my
index pattern built for it. As you can see here, we have some logs coming in.
So osquery is already querying the operating system, and we're getting our logs
into Kibana, so we can actually view them and sort through them and search them
and use them for identifying those tactics that we're looking for in this
specific course.