Add YARA configuration to documentation (#1428)
- Add example YARA config to the configuration-files documentation - Update `single-file-configuration.yml`
This commit is contained in:
noahtalerman
@@ -5,7 +5,6 @@
|
||||
- [Labels](#labels)
|
||||
- [Enroll secrets](#enroll-secrets)
|
||||
- [Organization settings](#organization-settings)
|
||||
- [Auto table construction](#auto-table-construction)
|
||||
|
||||
Entities in Fleet, such as queries, packs, labels, agent options, and enroll secrets, can be managed with configuration files in yaml syntax.
|
||||
|
||||
@@ -319,12 +318,12 @@ spec:
|
||||
interval:
|
||||
3600: "SELECT total_seconds AS uptime FROM uptime"
|
||||
host_expiry_settings:
|
||||
...
|
||||
# ...
|
||||
```
|
||||
|
||||
#### Auto table construction
|
||||
|
||||
You can use Fleet to query local SQLite databases as tables. For more information on creating ATC configuration from a SQLite database, see the [Osquery Automatic Table Construction documentation](https://osquery.readthedocs.io/en/stable/deployment/configuration/#automatic-table-construction)
|
||||
You can use Fleet to query local SQLite databases as tables. For more information on creating ATC configuration from a SQLite database, check out the [Automatic Table Construction section](https://osquery.readthedocs.io/en/stable/deployment/configuration/#automatic-table-construction) of the osquery documentation.
|
||||
|
||||
If you already know what your ATC configuration needs to look like, you can add it to an options config file:
|
||||
|
||||
@@ -335,7 +334,7 @@ spec:
|
||||
agent_options:
|
||||
config:
|
||||
options:
|
||||
...
|
||||
# ...
|
||||
overrides:
|
||||
platforms:
|
||||
darwin:
|
||||
@@ -351,6 +350,36 @@ spec:
|
||||
- "last_modified"
|
||||
```
|
||||
|
||||
#### YARA configuration
|
||||
|
||||
You can use Fleet to configure the `yara` and `yara_events` osquery tables. Fore more information on YARA configuration and continuous monitoring using the `yara_events` table, check out the [YARA-based scanning with osquery section](https://osquery.readthedocs.io/en/stable/deployment/yara/) of the osquery documentation.
|
||||
|
||||
The following is an example Fleet configuration file with YARA configuration. The values are taken from an example config supplied in the above link to the osquery documentation.
|
||||
|
||||
```yaml
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: config
|
||||
spec:
|
||||
agent_options:
|
||||
config:
|
||||
# ...
|
||||
yara:
|
||||
file_paths:
|
||||
system_binaries:
|
||||
- sig_group_1
|
||||
tmp:
|
||||
- sig_group_1
|
||||
- sig_group_2
|
||||
signatures:
|
||||
sig_group_1:
|
||||
- /Users/wxs/sigs/foo.sig
|
||||
- /Users/wxs/sigs/bar.sig
|
||||
sig_group_2:
|
||||
- /Users/wxs/sigs/baz.sig
|
||||
overrides: {}
|
||||
```
|
||||
|
||||
#### SMTP authentication
|
||||
|
||||
**Warning:** Be careful not to store your SMTP credentials in source control. It is recommended to set the password through the web UI or `fleetctl` and then remove the line from the checked in version. Fleet will leave the password as-is if the field is missing from the applied configuration.
|
||||
|
||||
@@ -1,86 +1,66 @@
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: options
|
||||
kind: config
|
||||
spec:
|
||||
config:
|
||||
options:
|
||||
distributed_interval: 3
|
||||
distributed_tls_max_attempts: 3
|
||||
logger_plugin: tls
|
||||
logger_tls_endpoint: /api/v1/osquery/log
|
||||
logger_tls_period: 10
|
||||
decorators:
|
||||
load:
|
||||
- "SELECT version FROM osquery_info"
|
||||
- "SELECT uuid AS host_uuid FROM system_info"
|
||||
always:
|
||||
- "SELECT user AS username FROM logged_in_users WHERE user <> '' ORDER BY time LIMIT 1"
|
||||
interval:
|
||||
3600: "SELECT total_seconds AS uptime FROM uptime"
|
||||
overrides:
|
||||
# Note configs in overrides take precedence over the default config defined
|
||||
# under the config key above. Hosts receive overrides based on the platform
|
||||
# returned by `SELECT platform FROM os_version`. In this example, the base
|
||||
# config would be used for Windows and CentOS hosts, while Mac and Ubuntu
|
||||
# hosts would receive their respective overrides.
|
||||
platforms:
|
||||
darwin:
|
||||
options:
|
||||
distributed_interval: 10
|
||||
distributed_tls_max_attempts: 10
|
||||
logger_plugin: tls
|
||||
logger_tls_endpoint: /api/v1/osquery/log
|
||||
logger_tls_period: 300
|
||||
disable_tables: chrome_extensions
|
||||
docker_socket: /var/run/docker.sock
|
||||
file_paths:
|
||||
users:
|
||||
- /Users/%/Library/%%
|
||||
- /Users/%/Documents/%%
|
||||
etc:
|
||||
- /etc/%%
|
||||
ubuntu:
|
||||
options:
|
||||
distributed_interval: 10
|
||||
distributed_tls_max_attempts: 3
|
||||
logger_plugin: tls
|
||||
logger_tls_endpoint: /api/v1/osquery/log
|
||||
logger_tls_period: 60
|
||||
schedule_timeout: 60
|
||||
docker_socket: /etc/run/docker.sock
|
||||
file_paths:
|
||||
homes:
|
||||
- /root/.ssh/%%
|
||||
- /home/%/.ssh/%%
|
||||
etc:
|
||||
- /etc/%%
|
||||
tmp:
|
||||
- /tmp/%%
|
||||
exclude_paths:
|
||||
homes:
|
||||
- /home/not_to_monitor/.ssh/%%
|
||||
tmp:
|
||||
- /tmp/too_many_events/
|
||||
decorators:
|
||||
load:
|
||||
- "SELECT * FROM cpuid"
|
||||
- "SELECT * FROM docker_info"
|
||||
interval:
|
||||
3600: "SELECT total_seconds AS uptime FROM uptime"
|
||||
agent_options:
|
||||
config:
|
||||
decorators:
|
||||
load:
|
||||
- SELECT uuid AS host_uuid FROM system_info;
|
||||
- SELECT hostname AS hostname FROM system_info;
|
||||
options:
|
||||
disable_distributed: false
|
||||
distributed_interval: 10
|
||||
distributed_plugin: tls
|
||||
distributed_tls_max_attempts: 3
|
||||
logger_plugin: tls
|
||||
logger_tls_endpoint: /api/v1/osquery/log
|
||||
logger_tls_period: 10
|
||||
pack_delimiter: /
|
||||
overrides: {}
|
||||
host_expiry_settings:
|
||||
host_expiry_enabled: false
|
||||
host_expiry_window: 0
|
||||
host_settings:
|
||||
additional_queries: null
|
||||
org_info:
|
||||
org_logo_url: ""
|
||||
org_name: org
|
||||
server_settings:
|
||||
enable_analytics: true
|
||||
live_query_disabled: false
|
||||
server_url: https://localhost:8080
|
||||
smtp_settings:
|
||||
authentication_method: authmethod_plain
|
||||
authentication_type: authtype_username_password
|
||||
configured: false
|
||||
domain: ""
|
||||
enable_smtp: false
|
||||
enable_ssl_tls: true
|
||||
enable_start_tls: true
|
||||
password: "********"
|
||||
port: 587
|
||||
sender_address: ""
|
||||
server: ""
|
||||
user_name: ""
|
||||
verify_ssl_certs: true
|
||||
sso_settings:
|
||||
enable_sso: false
|
||||
enable_sso_idp_login: false
|
||||
entity_id: ""
|
||||
idp_image_url: ""
|
||||
idp_name: ""
|
||||
issuer_uri: ""
|
||||
metadata: ""
|
||||
metadata_url: ""
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: enroll_secret
|
||||
spec:
|
||||
secrets:
|
||||
- active: true
|
||||
name: default
|
||||
secret: RzTlxPvugG4o4O5IKS/HqEDJUmI1hwBoffff
|
||||
- active: true
|
||||
name: new_one
|
||||
secret: reallyworks
|
||||
- active: false
|
||||
name: inactive_secret
|
||||
secret: thissecretwontwork!
|
||||
- secret: RzTlxPvugG4o4O5IKS/HqEDJUmI1hwBoffff
|
||||
- secret: reallyworks
|
||||
- secret: thissecretwontwork!
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: label
|
||||
|
||||
Reference in New Issue
Block a user