9 Commits

Author SHA1 Message Date
Kevin Carter
88bf46c65c
Add osquery testing
Change-Id: Ia8249da40bf5eb0e09b5d7811eb126b60dc5dc73
Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
2018-10-17 13:58:03 -05:00
Kevin Carter
a86a9dc416
Add osquery pack setup
osquery supply quite a few query packs that may be useful from within
the fleet UI. This change adds a playbook to convert the native query
packs into fleet configs and applys them.

Change-Id: Ifef741d2c7aca147e5ac327a84cfdc20551df441
Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
2018-10-16 18:16:23 -05:00
Kevin Carter
1e40cef199
More cleanup of the osquery role
This cleanup should make things easier to integrate with OSA
while also better supporting a stand alone deployment.

Change-Id: I7321981a9ced7bf2e807a25cadde5463b39eef8f
Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
2018-10-16 17:38:04 -05:00
Kevin Carter
5aff0b59f4
Cleanup the osquery tooling and vendor roles
The osquery tooling needed a little work to be fully automated and
repeatable. This change tunes up the tools and makes the entire
deployment process multi-node capable and repeatable.

The osquery role was vendored because of bugs within their use of aarmor
profiles and there was no way to disable them.

The fleet use of commands for ssl creation have been removed. The ssl
modules are now being used to generate all of the certificates.

New pre-tasks have been added to check for required variables. If the
required variables are not set the playbooks will fail early and notify
the user of the issue.

Change-Id: I88c2b40ed9d9a88a39bdf07b0dce2900fda50151
Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
2018-10-15 22:47:10 -05:00
Victor Palma
3aa5fcd8fc multiple updates to osquery
* move playbooks to roles
   * update documentation
   * update haproxy
     - set 6443 as default port for kolide fleet
   * add galera support

Change-Id: I2fdefcb6bec98486c16b54cf33e2b7940b88d50b
2018-10-01 14:20:08 -05:00
Victor Palma
86a2402da9 change osquery defaults
* do not install debuging osquery packages
   * log to filesystem
   * turn off rsyslog

Change-Id: Iae91959847fc7bfd5184d157a44cd994dab397f3
2018-09-11 11:29:44 -05:00
Kevin Carter
393fe9d42a
correct typo
The fleet env.d config had a typo in it which would causing a failure
within OSA dynamic inventory. This corrects the issue.

Change-Id: I36016f4733a8800adbcce71abbb290ab4a24798b
Signed-off-by: Kevin Carter <kevin.carter@rackspace.com>
2018-08-02 09:42:28 -05:00
Victor Palma
5ddbde3310 adding kolide fleet
* adds kolide fleet
  * integrates osquery to kolide fleet server

Change-Id: I646364c44bb99d4397bb35068600c49b7bfd62c2
2018-07-17 18:45:56 -05:00
Victor Palma
d98fec1a54 add osquery
* install osquery
   * add filebeat integration

Change-Id: Ia93595482512460ebdd287cf091cb5fe51b00de4
2018-07-10 11:00:48 -05:00