trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Update ESXi bootstrap too

Browse Source
This commit is contained in:
Chris Long
2020-06-01 22:53:36 -07:00
parent 7dc7e6916c
commit 74dda07942
2 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
ESXi/ansible/roles/logger/tasks/main.yml
View File

@@ -340,8 +340,11 @@
sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/MacOS/osquery.yaml sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/MacOS/osquery.yaml
sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml
# Don't log osquery INFO messages
# Fix snapshot event formatting
fleetctl get options > /tmp/options.yaml fleetctl get options > /tmp/options.yaml
/usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_min_status' '1' /usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_min_status' '1'
/usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_snapshot_event_type' '2'
fleetctl apply -f /tmp/options.yaml fleetctl apply -f /tmp/options.yaml
# Use fleetctl to import YAML files # Use fleetctl to import YAML files

1
Vagrant/bootstrap.sh
View File

@@ -267,6 +267,7 @@ import_osquery_config_into_fleet() {
sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml sed -i 's/interval: 28800/interval: 900/g' osquery-configuration/Fleet/Endpoints/Windows/osquery.yaml
# Don't log osquery INFO messages # Don't log osquery INFO messages
# Fix snapshot event formatting
fleetctl get options > /tmp/options.yaml fleetctl get options > /tmp/options.yaml
/usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_min_status' '1' /usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_min_status' '1'
/usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_snapshot_event_type' '2' /usr/bin/yq w -i /tmp/options.yaml 'spec.config.options.logger_snapshot_event_type' '2'