Skip to content

CptOfEvilMinions/osquerey-file-carve-server

Repository files navigation

Osquery File Carve Server

Network diagram

Build project

  1. cd osquery-file-carve-server/
  2. go mod init github.com/CptOfEvilMinions/osquery-file-carve-server
  3. go build

Assumptions

  • All blocks of data sent by Osquery will arrive in order
  • All data block sizes for NGINX, Osquery, and Mongo have appropriate settings

Setup

Block size configuration

The default setting for all the configs in this repo is to set the data block size at 10MB (10000000 bytes). Osquery has carver_block_size set to 10000000 (10MB).

Generate your own root CA

  1. Generate your own root CA

Spin up stack

  1. docker-compose build
  2. docker-compose run --rm kolide fleet prepare db --config /etc/kolide/kolide.yml
  3. docker-compose up -d
  4. Setup Kolide
  5. Install Osquery
  6. Enroll Osquery with Kolide

Tested Osquery versions

  • osquery version 4.3.0
  • osquery version 4.4.0

To do

  • Update/finish docs/*
  • Update/finish tests/*
  • Add the ability to clean up unsucessful uploads

Refernces

NGINX

Kolide

Mongo + GridFS

File I/O

net/http + HTTP client

Docker

JWT tokens

Vault

GoLang

About

Osquerey file carve server written in Golang.

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published