wodle name="osquery"

Configuration options of the osquery wodle.

Warning

Osquery is not installed by default. It is a open source software that you have to obtain for using this module.

Options

disabled
run_daemon
bin_path
log_path
config_path
add_labels
pack

Options	Allowed values
disabled	yes, no
run_daemon	yes, no
bin_path	Any valid path
log_path	Any valid path
config_path	Any valid path
add_labels	yes, no
pack	Any available pack

disabled

Disable the osquery wodle.

Default value	no
Allowed values	yes, no

run_daemon

Makes the module run osqueryd as a subprocess or lets the module monitor the results log without running Osquery.

Default value	yes
Allowed values	yes, no

bin_path

Full path to the folder that contains the osqueryd executable.

Default value on Linux	Empty
Default value on Windows	C:\ProgramData\osquery\osqueryd
Allowed values	Any valid path

log_path

Full path to the results log written by Osquery.

Default value on Linux	/var/log/osquery/osqueryd.results.log
Default value on Windows	C:\ProgramData\osquery\log\osqueryd.results.log
Allowed values	Any valid path

config_path

Path to the Osquery configuration file. This path can be relative to the folder where the Wazuh agent is running.

Default value on Linux	/etc/osquery/osquery.conf
Default value on Windows	C:\ProgramData\osquery\osquery.conf
Allowed values	Any valid path

add_labels

Add the agent labels defined as decorators.

Default value	yes
Allowed values	yes, no

pack

Add a query pack to the configuration. This option can be defined multiple times.

Default value	Empty
Allowed values	Path to pack configuration file

Attributes:

name	Name for this pack
	Allowed values	Any

Example of configuration

<wodle name="osquery">
    <disabled>no</disabled>
    <run_daemon>yes</run_daemon>
    <bin_path>/usr/bin</bin_path>
    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
    <config_path>/etc/osquery/osquery.conf</config_path>
    <add_labels>no</add_labels>
    <pack name="custom_pack">/path/to/custom_pack.conf</pack>
</wodle>