fbpx

Sign Up For Your Free Account Today

Get your free account with Blumira and secure your Microsoft 365 environment in minutes. No credit card required.

Free Trial

Integrating Osquery With Blumira’s Cloud SIEM

Note: Commands listed in this document are Linux flavor-agnostic and should work on all tested OSes, including Ubtunu, CentOS and RHEL.

There are two ways to send logs from Osquery to Blumira, manually or automatically (via a script). Do one of the following, depending on how you want to send logs:

  • For manual deployment, follow steps 1-5 in Section 1 below.
  • For automated deployment, skip to Section 2 below.

Section 1

1. Set Up Rsyslog For Blumira

Follow the steps in this document: https://www.blumira.com/integration/linux/

2. Install Osquery

Go to the following link and download the most recent version of Osquery for your respective OS:  https://osquery.io/downloads/ 

3. Download Osquery Config

Run the following commands: 

git clone https://github.com/palantir/osquery-configuration.git

sudo cp -av osquery-configuration/Classic/Servers/Linux/* /etc/osquery/
sudo chown -R root. /etc/osquery/

sudo systemctl enable osqueryd.service

sudo systemctl start osqueryd.service

4. Create Osquery Rsyslog Config File

Run the following command: 

sudo vim /etc/rsyslog.d/osquery.conf

or

sudo nano /etc/rsyslog.d/osquery.conf

Copy and paste the following code into the osquery.conf:

# Prep
$ModLoad imfile
$InputFilePollInterval 10
$PrivDropToGroup adm
$WorkDirectory /var/spool/rsyslog

 

# Apache Access File:
$InputFileName /var/log/osquery/osqueryd.results.log
$InputFileTag osqueryd:
$InputFileStateFile stat-osquery
$InputFileSeverity info
$InputFilePersistStateInterval 20000
$InputRunFileMonitor

 

# Tag, Forward to BLUNIX System Logger then Stop
if $programname == 'osqueryd' then stop

5. Ensure Rsyslog Can Read the File and then Restart

Run the following commands: 

sudo chown syslog. /var/log/osquery/osqueryd.results.log
sudo systemctl restart rsyslog.service

Section 2

Automated Deployment Option: Run OSquery Autodeploy Script

If you need to support larger deployments, Blumira has a script that will automate the process listed in Section 1.

Before you begin:

  1. Install git 
  2. Disable auditd 

After you’ve met the Section 2 prerequisites, follow the steps below:

1. Download the Config File From Github

To download, visit: https://github.com/Blumira/blumira-osquery-config

2. Run Commands

Run the command: >./osquery-deploy.sh -h

sudo osquery-deploy.sh -d [select OS: ubuntu|rhel|centos] -s <IP of Blumira Sensor>

For example: sudo osquery-deploy.sh -d ubuntu -s 172.16.1.100

Troubleshooting:

On RedHat/Centos systems in AWS auditd is enabled, which will prevent osquery process monitoring.

To disable this, run the following commands:
sudo systemctl stop auditd.service
sudo systemctl disable auditd.service
sudo systemctl restart osqueryd.service

Troubleshooting For Automated Script (Section 2)

===== Blumira Osquery Deployment Utility =====

   -h –help: View this help menu

   -d –distro: Provides the linux distro to deploy osquery on (supported options: ubuntu|rhel|centos)

   -s –server: Provides the server IP of the Blumira sensor to send syslog forwarding to