如何使用golang从osquery的process_events和file_events表中获取信息?

huangapple go评论95阅读模式
英文:

How to fetch information from process_events and file_events tables from osquery using golang?

问题

我是新手 osquery。我想使用 osquery 获取实时的操作系统信息(从这两个表:process_eventsfile_events)。我了解到可以使用 osquery 的守护进程模式来检索这些信息。我甚至已经成功做到了。

我的问题是,“我该如何在 Golang 中实现同样的功能?”

我不想创建一个扩展程序。简单地说,我想启动 osquery 守护进程并获取信息并存储。

英文:

I am new to osquery. I want to fetch real-time OS information using osquery (from these two tables: process_events and file_events). I understood that we could retrieve this information using osquery in daemon mode. I was even able to do the same.

My question now is, "How do I do the same thing in Golang?"

I do not want to create an extension. Simply, I want to start the osquery daemon and fetch information and store it.

答案1

得分: 2

为了澄清一些事情... Osquery从各种API中收集事件。根据操作系统和版本的不同,这些事件可能来自Auditd、BPF、OpenBSM、EndpointSecurity、ETW等。要用golang实现相同的功能,你需要实现一个与这些API进行通信的组件。

但是,我认为你问题中更有趣的部分是如何利用osquery将这些数据传输到其他地方,最好是使用golang。有(至少)三种方法可以尝试。

首先,如果你要在节点群上执行此操作,通常会将osquery作为代理与远程TLS服务器进行通信。远程TLS服务器负责分发配置和收集日志。这是一种常见的情况,这个领域中有商业和开源工具。

其次,如果你在本地工作,可以通过thrift套接字查询正在运行的osquery。这与扩展使用的接口相同,但它不是一个扩展。在go SDK中,这被公开为ExtensionManagerClient

第三,也是在本地,你可以让osquery运行定期查询并将结果记录到本地文件中。Osquery的文件系统日志是以JSON格式记录的,可以进行摄取。

一般来说,我建议采用第一种或第二种方法。

请注意,要使用事件表,osquery必须作为守护进程运行,因此你需要将其单独运行,或以其他方式将其管理为持久进程。

英文:

To clarify something... Osquery gathers events from various APIs. Depending on the OS and version, those events might come from any of Auditd, BPF, OpenBSM, EndpointSecurity, ETW... To do the same thing with golang, you'd need to implement something that talks to those APIs.

But, I think the more interesting part of your question is how do you leverage osquery to get that data into something else, ideally with golang. There are (at least) 3 routes to pursue.

First, if you're doing this across a fleet on nodes, it is common to run osquery as an agent talking to a remote TLS server. The remote TLS server is responsible for distributing configuration and collecting logs. This is a common scenario, and there are both commercial and OSS tools in this space.

Second, if you're working locally, you can query a running osquery over the thrift socket. This is same interface the extensions would use, but it is not an extension. In the go SDK this is exposed as ExtensionManagerClient

Third, also local, you can have osquery run scheduled queries and log to a local file. Osquery filesystem logging is in json, and this could be ingested.

Generally speaking, I'd recommend towards the first or second approach.

Note that to use the events tables, osquery has to be running as a daemon, so you'll need to either have it running on it's own, or otherwise manage it as a persistent process.

huangapple
  • 本文由 发表于 2023年1月23日 17:59:37
  • 转载请务必保留本文链接:https://go.coder-hub.com/75207924.html
匿名

发表评论

匿名网友

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen:

确定