mirror of
https://github.com/Security-Onion-Solutions/securityonion.git
synced 2026-01-25 01:13:28 +01:00
47 lines
1.5 KiB
YAML
47 lines
1.5 KiB
YAML
apiVersion: v1
|
|
kind: options
|
|
spec:
|
|
config:
|
|
decorators:
|
|
always:
|
|
- SELECT hostname AS hostname FROM system_info;
|
|
- SELECT codename FROM os_version;
|
|
- SELECT uuid AS LiveQuery FROM system_info;
|
|
- SELECT address AS EndpointIP1 FROM interface_addresses where address not
|
|
like '%:%' and address not like '127%' and address not like '169%' order by
|
|
interface desc limit 1;
|
|
- SELECT address AS EndpointIP2 FROM interface_addresses where address not
|
|
like '%:%' and address not like '127%' and address not like '169%' order by
|
|
interface asc limit 1;
|
|
- SELECT hardware_serial FROM system_info;
|
|
file_paths:
|
|
binaries:
|
|
- /usr/bin/%%
|
|
- /usr/sbin/%%
|
|
- /bin/%%
|
|
- /sbin/%%
|
|
- /usr/local/bin/%%
|
|
- /usr/local/sbin/%%
|
|
- /opt/bin/%%
|
|
- /opt/sbin/%%
|
|
configuration:
|
|
- /etc/%%
|
|
efi:
|
|
- /System/Library/CoreServices/boot.efi
|
|
options:
|
|
decorations_top_level: true
|
|
disable_distributed: false
|
|
disable_tables: windows_events
|
|
distributed_interval: 10
|
|
distributed_plugin: tls
|
|
distributed_tls_max_attempts: 3
|
|
distributed_tls_read_endpoint: /api/v1/osquery/distributed/read
|
|
distributed_tls_write_endpoint: /api/v1/osquery/distributed/write
|
|
logger_plugin: tls
|
|
logger_snapshot_event_type: true
|
|
logger_tls_endpoint: /api/v1/osquery/log
|
|
logger_tls_period: 10
|
|
pack_delimiter: /
|
|
schedule_splay_percent: 10
|
|
overrides: {}
|