osqueryを使用してLinuxでファイル整合性監視（FIM）を設定する方法

export OSQUERY_KEY=1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B  
sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys $OSQUERY_KEY

sudo add-apt-repository 'deb [arch=amd64] https://pkg.osquery.io/deb deb main'  
sudo apt install osquery -y

curl -L https://pkg.osquery.io/rpm/GPG | sudo tee /etc/pki/rpm-gpg/RPM-GPG-KEY-osquery

sudo yum-config-manager --add-repo https://pkg.osquery.io/rpm/osquery-s3-rpm.repo  
sudo yum-config-manager --enable osquery-s3-rpm  
sudo yum install osquery -y

sudo: yum-config-manager: command not found

yum -y install yum-utils

sudo apt install rsyslog -y

sudo yum install rsyslog -y

cd /etc/rsyslog.d/  
vim osquery.conf

template(
  name="OsqueryCsvFormat"
  type="string"
  string="%timestamp:::date-rfc3339,csv%,%hostname:::csv%,%syslogseverity:::csv%,%syslogfacility-text:::csv%,%syslogtag:::csv%,%msg:::csv%\n"
)
*.* action(type="ompipe" Pipe="/var/osquery/syslog_pipe" template="OsqueryCsvFormat")

cd /etc/osquery/  
vim osquery.conf

{
    "options": {
        "config_plugin": "filesystem",
        "logger_plugin": "filesystem",
        "logger_path": "/var/log/osquery",
        "disable_logging": "false",
        "log_result_events": "true",
        "schedule_splay_percent": "10",
        "pidfile": "/var/osquery/osquery.pidfile",
        "events_expiry": "3600",
        "database_path": "/var/osquery/osquery.db",
        "verbose": "false",
        "worker_threads": "2",
        "enable_monitor": "true",
        "disable_events": "false",
        "disable_audit": "false",
        "audit_allow_config": "true",
        "host_identifier": "hakase-labs",
        "enable_syslog": "true",
        "syslog_pipe_path": "/var/osquery/syslog_pipe",
        "force": "true",
        "audit_allow_sockets": "true",
        "schedule_default_interval": "3600"
    },

    "schedule": {
        "crontab": {
            "query": "SELECT * FROM crontab;",
            "interval": 300
        },
        "system_info": {
            "query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
            "interval": 3600
        },
        "ssh_login": {
            "query": "SELECT username, time, host FROM last WHERE type=7",
            "interval": 360
        }
    },

    "decorators": {
        "load": [
            "SELECT uuid AS host_uuid FROM system_info;",
            "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
        ]
    },

    "packs": {
        "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf"
    }
}

systemctl start osqueryd  
systemctl enable osqueryd

systemctl restart rsyslog

cd /usr/share/osquery/packs  
vim fim.conf

{
  "queries": {
    "file_events": {
      "query": "SELECT * FROM file_events;",
      "removed": false,
      "interval": 300
    }
  },
  "file_paths": {
    "homes": [
      "/root/.ssh/%%",
      "/home/%/.ssh/%%"
    ],
      "etc": [
      "/etc/%%"
    ],
      "home": [
      "/home/%%"
    ],
      "tmp": [
      "/tmp/%%"
    ],
      "www": [
      "/var/www/%%"
      ]
  }
}

cd /etc/osquery/  
vim osquery.conf

    "packs": {
        "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
        "fim": "/usr/share/osquery/packs/fim.conf"
    }

systemctl restart osqueryd

cd /var/www/  
touch howtoforge.md

cd /home/vagrant/  
touch hakase-labs.md

osqueryi --config-path /etc/osquery/osquery.conf

select * from file_events;

select target_path, category, action, atime, ctime, mtime from file_events WHERE category="home";

select target_path, category, action, atime, ctime, mtime from file_events WHERE category="www";

cd /var/log/osquery/  
ls -lah osqueryd.results.log

grep -rin howtoforge.md osqueryd.results.log  
grep -rin hakase-labs.md osqueryd.results.log