osquery fleet management suite work in progress, not suitable for production
[osquery clients] -> [osqonnector]
\ \
\ [db] <- [osqmanager]
[redis] -> [osqprocessor] -> [redis] -> [ES+Kibana]
This repo contains the following submodules:
osqmanager
- django based admin panel to easily manage databaseosqonnector
- bottle.py based application providing webservices for osquery clientsosqprocessor
- osquery messages processor with pluggable workers
and stuff like:
- haproxy container configuration
- redis container configuration
- utils for testing and development
- clone this repo with submodules:
git clone --recursive https://github.com/srozb/osq.git
- generate tls certificates and deploy it to your osquery clients (
haproxy/gen-certs.sh
might help) - generate enrollment secret and flagfile and deploy it to your clients
- run haproxy container (or any other LB/reverse proxy)
- run DB (like postgresql or sqlite)
- run redis container
- configure database backend in django
settings.py
and make sure it works for your DB - make django migrations
./manage.py makemigrations && ./manage.py migrate
- install default dataset with
./manage.py install
- create django superuser
./manage.py createsuperuser
- run
osqmanager
container - run
osqonnector
container and make sure it uses the same database asosqmanager
- you may also create some tags and tag assignment rules to auto-assign new clients (in osqmanager admin panel)
- configure and run
osqprocessor
- inspect all the logs for errors
- deploy osquery to your clients (consult osquery configuration for more info)