Osquery

Prompts and answers

• Ready to learn Osquery!
  No answer needed
• Attached VM was started. Ready to proceed.
  No answer needed
• What is the Osquery version?
  4.6.0.2
• What is the SQLite version?
  3.34.0
• What is the default output mode?
  pretty
• What is the meta-command to set the output to show one value per line?
  .mode line
• What are the 2 meta-commands to exit osqueryi?
  .quit,.exit
• What table would you query to get the version of Osquery installed on the Windows endpoint?
  osquery_info
• How many tables are compatible with Linux?
  155
• What is the Osquery Enroll Secret?
  k3hFh30bUrU7nAC3DmsCCyb1mT8HoDkt
• What is the Osquery version?
  4.2.0
• According to the polylogyx readme, how many 'features' does the plug-in add to the Osquery core?
  25
• What is the 'current_value' for kernel.osrelease?
  4.4.0-17763-Microsoft
• What is the uid for the bravo user?
  1002
• ```
  notsus
• ```
  3df6a21c6d0c554719cffa6ee2ae0df7
• ```
  fleet.zip
• ```
  notes
• What were the 'matches'?
  eicar_av_test,eicar_substring_test
• ```
  $eicar_substring:1b
• ```
  Helps protect users from malware and other potentially unwanted software
• ```
  AlienVault Agent
• What is required with win_event_log_data?
  source
• ```
  1076
• What is the query to find the first Sysmon event? Select only the event id, order by date/time, and limit the output to only 1 entry.
  select eventid from win_event_log_data where source="Microsoft-Windows-Sysmon/Operational" ORDER BY datetime LIMIT 1;
• What is the Sysmon event id?
  16
• Leveled up with Osquery!
  No answer needed