osquery.conf

{
	"options": {
		"config_plugin": "filesystem",
		"logger_plugin": "filesystem",
		"utc": "true"
	},

	"schedule": {
		"system_info": {
			"query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
			"interval": 3600
		},
		"high_load_average": {
			"query": "SELECT period, average, '70%' AS 'threshold' FROM load_average WHERE period = '15m' AND average > '0.7';",
			"interval": 900,
			"description": "Report if load charge is over 70 percent."
		},
		"low_free_memory": {
			"query": "SELECT memory_total, memory_free, CAST(memory_free AS real) / memory_total AS memory_free_perc, '10%' AS threshold FROM memory_info WHERE memory_free_perc < 0.1;",
			"interval": 1800,
			"description": "Free RAM is under 10%."
		},
		"crontab": {
			"query": "SELECT * FROM crontab;",
			"interval": 900
		},
		"running": {
			"query": "SELECT * FROM processes;",
			"interval": 300
		},
		"users": {
			"query": "SELECT * FROM users;",
			"interval": 86400
		},
		"behavioral_reverse_shell": {
			"query": "SELECT DISTINCT(processes.pid), processes.parent, processes.name, processes.path, processes.cmdline, processes.cwd, processes.root, processes.uid, processes.gid, processes.start_time, process_open_sockets.remote_address, process_open_sockets.remote_port, (SELECT cmdline FROM processes AS parent_cmdline WHERE pid=processes.parent) AS parent_cmdline FROM processes JOIN process_open_sockets USING (pid) LEFT OUTER JOIN process_open_files ON processes.pid = process_open_files.pid WHERE (name='sh' OR name='bash') AND remote_address NOT IN ('0.0.0.0', '::', '') AND remote_address NOT LIKE '10.%' AND remote_address NOT LIKE '192.168.%';",
			"interval": 600,
			"description": "Find shell processes that have open sockets"
		},
		"shell_history": {
			"query": "SELECT * FROM users CROSS JOIN shell_history USING (uid);",
			"interval": 60,
			"description": "Record shell history for all users on system (instead of just root)"
		}

	},


	"packs": {
		"osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
		"incident-response": "/usr/share/osquery/packs/incident-response.conf",
		"it-compliance": "/usr/share/osquery/packs/it-compliance.conf",
		"vuln-management": "/usr/share/osquery/packs/vuln-management.conf",
		"hardware-monitoring": "/usr/share/osquery/packs/hardware-monitoring.conf",
		"ossec-rootkit": "/usr/share/osquery/packs/ossec-rootkit.conf"
	}
}