This is the documentation for Wazuh 3.7. Check out the docs for the latest version of Wazuh!

wodle name=”osquery”

XML section name

<wodle name="osquery">

Configuration options of the osquery wodle.


Osquery is not installed by default. It is a open source software that you have to obtain for using this module.


Options Allowed values
disabled yes, no
run_daemon yes, no
bin_path Any valid path
log_path Any valid path
config_path Any valid path
add_labels yes, no
pack Any available pack


Disable the osquery wodle.

Default value no
Allowed values yes, no


Makes the module run osqueryd as a subprocess or lets the module monitor the results log without running Osquery.

Default value yes
Allowed values yes, no


Full path to the folder that contains the osqueryd executable.

Default value on Linux Empty
Default value on Windows C:\ProgramData\osquery\osqueryd
Allowed values Any valid path


Full path to the results log written by Osquery.

Default value on Linux /var/log/osquery/osqueryd.results.log
Default value on Windows C:\ProgramData\osquery\log\osqueryd.results.log
Allowed values Any valid path


Path to the Osquery configuration file. This path can be relative to the folder where the Wazuh agent is running.

Default value on Linux /etc/osquery/osquery.conf
Default value on Windows C:\ProgramData\osquery\osquery.conf
Allowed values Any valid path


Add the agent labels defined as decorators.

Default value yes
Allowed values yes, no


Add a query pack to the configuration. This option can be defined multiple times.

Default value Empty
Allowed values Path to pack configuration file


name Name for this pack
Allowed values Any

Example of configuration

<wodle name="osquery">
    <pack name="custom_pack">/path/to/custom_pack.conf</pack>