osquery chef cookbook

• Installs, configures, and starts osquery.
• Configurations are generated based on node attributes.

Requirements

• Chef >= 12.1.0
• OS X
• Ubuntu
  • 12.04
  • 14.04
• Centos/Redhat
  • 6.5+
  • 7.0+

General Attributes

attributes/default.rb:

Configuration Attributes

attributes/config.rb:

Query Schedule Attributes

attributes/schedule.rb:

File Integrity Monitoring Attributes

attributes/file_paths.rb:

Custom Resources

osquery_conf: creates osquery config from selected options and packs.

create:

osquery_conf osquery_config_path do
  action :create
  schedule node['osquery']['schedule']
  fim_paths node['osquery']['file_paths']
  packs node['osquery']['packs']
  pack_source node['osquery']['pack_source']
end

delete:

osquery_conf 'delete osquery config' do
  action :delete
end

osquery_conf attributes:
* action: :create or :delete
* schedule: (required) Hash of scheduled queries to run
* fim_paths: (optional) Hash of file integrity monitoring path descriptions and array of their paths
* packs: (optional) List of osquery packs to install. Based on filenames ending in *.conf in pack_source/packs
* pack_source: (optional) Cookbook source for osquery packs
* The daemon configuration is compiled from the node['osquery']['options'] attributes.

Testing

Run $ rake to execute:
* foodcritic
* rubocop
* chefspec

Requirements: VirtualBox with Extension Pack (for the OS X vm)
* $ kitchen list to show integration test suites <br />
* $ kitchen converge to run test suites

Note: Audit mode is enabled in the Kitchen yaml by default. The tests are found in ./recipes/audit.rb and run post converge. To disable, override the node['osquery']['audit']['enabled'] attribute to false.

Usage

• Include osquery in your node's run_list
• Override attributes to fit your desired setup

Contributing

1. Fork the repository on Github.
2. Create a named feature branch (like add_component_x).
3. Write your change.
4. Write tests for your change.
5. Run the tests, ensuring they all pass (rubocop; rspec).
6. Submit a Pull Request using Github.

License and Authors

• Authors: Jack Naglieri (jacknagzdev@gmail.com)

Copyright 2013-2014 Jack Naglieri <jacknagzdev@gmail.com>

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.