1
2
3
4

sudo mkdir -p /etc/apt/keyrings
curl -L https://pkg.osquery.io/deb/pubkey.gpg | sudo tee /etc/apt/keyrings/osquery.asc
sudo add-apt-repository 'deb [arch=amd64 signed-by=/etc/apt/keyrings/osquery.asc] https://pkg.osquery.io/deb deb main'
sudo apt install osquery

1
2

deb [arch=amd64] https://pkg.osquery.io/deb deb main

1

The following signatures couldn't be verified because the public key is not available: NO_PUBKEY 97A80C63C9D8B80B

1

apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 97A80C63C9D8B80B

1
2

apt update
apt install osquery

1
2
3
4
5
6

root@ubuntu:~# osqueryd 
W1018 07:21:11.436761  5261 init.cpp:760] Error reading config: config file does not exist: /etc/osquery/osquery.conf
I1018 07:21:11.436888  5261 eventfactory.cpp:156] Event publisher not enabled: BPFEventPublisher: Publisher disabled via configuration
I1018 07:21:11.436990  5261 eventfactory.cpp:156] Event publisher not enabled: auditeventpublisher: Publisher disabled via configuration
I1018 07:21:11.437004  5261 eventfactory.cpp:156] Event publisher not enabled: inotify: Publisher disabled via configuration
I1018 07:21:11.437013  5261 eventfactory.cpp:156] Event publisher not enabled: syslog: Publisher disabled via configuration

1

cp /opt/osquery/share/osquery/osquery.example.conf /etc/osquery/osquery.conf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

root@ubuntu:~# osqueryctl restart
root@ubuntu:~# osqueryctl status
● osqueryd.service - The osquery Daemon
   Loaded: loaded (/usr/lib/systemd/system/osqueryd.service; disabled; vendor preset: enabled)
   Active: active (running) since Wed 2023-10-18 07:23:06 PDT; 3s ago
  Process: 5740 ExecStartPre=/bin/sh -c if [ -f $LOCAL_PIDFILE ]; then mv $LOCAL_PIDFILE $PIDFILE; fi (code=exited, status=0/SUCCESS)
  Process: 5729 ExecStartPre=/bin/sh -c if [ ! -f $FLAG_FILE ]; then touch $FLAG_FILE; fi (code=exited, status=0/SUCCESS)
 Main PID: 5743 (osqueryd)
    Tasks: 14
   Memory: 14.9M
      CPU: 79ms
   CGroup: /system.slice/osqueryd.service
           ├─5743 /opt/osquery/bin/osqueryd --flagfile /etc/osquery/osquery.flags --config_path /etc/osquery/osquery.conf
           └─5750 /opt/osquery/bin/osqueryd                                                                              

Oct 18 07:23:06 ubuntu systemd[1]: Starting The osquery Daemon...
Oct 18 07:23:06 ubuntu systemd[1]: Started The osquery Daemon.
Oct 18 07:23:06 ubuntu osqueryd[5743]: osqueryd started [version=5.9.1]
Oct 18 07:23:06 ubuntu osqueryd[5743]: I1018 07:23:06.520910  5750 eventfactory.cpp:156] Event publisher not enabled: BPFEventPublisher: Publisher disabled via configuratio
Oct 18 07:23:06 ubuntu osqueryd[5743]: I1018 07:23:06.571094  5750 eventfactory.cpp:156] Event publisher not enabled: auditeventpublisher: Publisher disabled via configurat
Oct 18 07:23:06 ubuntu osqueryd[5743]: I1018 07:23:06.571115  5750 eventfactory.cpp:156] Event publisher not enabled: inotify: Publisher disabled via configuration
Oct 18 07:23:06 ubuntu osqueryd[5743]: I1018 07:23:06.571126  5750 eventfactory.cpp:156] Event publisher not enabled: syslog: Publisher disabled via configuration

1

SELECT * from users;

1

SELECT * FROM logged_in_users;

1
2

SELECT * FROM listening_ports;
SELECT * FROM listening_ports WHERE port=3389;

1

select name from kernel_modules;