trinitor/DetectionLab
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Merge pull request #36 from clong/snapshot_splitting

Browse Source 
Adding SQL to enable snapshot event splitting in Fleet
This commit is contained in:
Chris Long
2017-12-17 16:01:44 -08:00
committed by GitHub
parent c4f364fd48 a99d9d4c9b
commit fb7c8aa1af
2 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
README.md
View File

@@ -19,6 +19,7 @@ NOTE: This lab has not been hardened in any way and runs with default vagrant cr
## Requirements ## Requirements
* 55GB+ of free disk space * 55GB+ of free disk space
* 16GB+ of RAM
* Packer 1.0.0 or newer * Packer 1.0.0 or newer
* Vagrant 1.9.2 or newer * Vagrant 1.9.2 or newer
* Virtualbox or VMWare Fusion/Workstation * Virtualbox or VMWare Fusion/Workstation

2
Vagrant/bootstrap.sh
View File

@@ -61,6 +61,8 @@ sed -i 's/ -it//g' demo.sh
./demo.sh up simple ./demo.sh up simple
# Set the enrollment secret to match what we deploy to Windows hosts # Set the enrollment secret to match what we deploy to Windows hosts
docker run --rm --network=kolidequickstart_default mysql:5.7 mysql -h mysql -u kolide --password=kolide -e 'update app_configs set osquery_enroll_secret = "enrollmentsecret" where id=1;' --batch kolide docker run --rm --network=kolidequickstart_default mysql:5.7 mysql -h mysql -u kolide --password=kolide -e 'update app_configs set osquery_enroll_secret = "enrollmentsecret" where id=1;' --batch kolide
# Set snapshot events to be split into multiple events
docker run --rm --network=kolidequickstart_default mysql:5.7 mysql -h mysql -u kolide --password=kolide -e 'insert into options (name, type, value) values ("logger_snapshot_event_type", 2, "true");' --batch kolide
echo "Updated enrollment secret" echo "Updated enrollment secret"
cd /home/vagrant cd /home/vagrant