splunk
add-on for osquery
Overview
Details
Provides a data input and CIM-compliant field extractions for osquery (https://github.com/facebook/osquery). "Osquery is a SQL powered operating system instrumentation, monitoring, and analytics framework. Available for Linux, macOS, Windows and FreeBSD."
For the latest version of this TA, see: https://github.com/splunk/TA-osquery
For the latest version of this TA, see: https://github.com/splunk/TA-osquery
TA-osquery 
An Splunk technology add-on for osquery
- Original Author: Jose Hernandez
- Current maintainers:
- Sourcetype: osquery:results, osquery:snapshots, osquery:INFO, osquery:WARNING, osquery:ERROR
- Has index-time ops: false
Features
- Parses and extracts fields for the following logs:
osqueryd.INFO, osqueryd.WARNING, osqueryd.ERRORosqueryd.results.logosqueryd.snapshots.log
- Provides Datamodel Mapping for:
- Alerts Data Model base on alerts from packs
- Changes Data Model base on FIM events from packs
- Endpoint Data Model base on Splunks Query Pack (todo)
- Does correct time extraction
Deploying
- Remember to drop the TA in your indexers as well as your forwarders
- Do not forget to remove the example
default/inputs.conf - Add the Splunk query pack to your osquery agent (todo)
To Do's
- Test Changes Data model mapping for FIM events in the results log
- Create a splunk query pack
- Populate Endpoint DM with the results of the splunk query pack
Release Notes
Version 1.0.0
March 1, 2019
First release base feature set populates datamodels:
Alerts Data Model base on alerts from packs
Changes Data Model base on FIM events from packs
Endpoint Data Model base on Splunks Query Pack