mirror of https://github.com/avast/PurpleDome
You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
73 lines
1.9 KiB
Python
73 lines
1.9 KiB
Python
#!/usr/bin/env python3
|
|
|
|
# A plugin to experiment with Linux osquery
|
|
|
|
# https://github.com/osquery/osquery-python
|
|
|
|
from plugins.base.sensor import SensorPlugin
|
|
# import os
|
|
# from jinja2 import Environment, FileSystemLoader, select_autoescape
|
|
|
|
|
|
class LinuxOSQueryPlugin(SensorPlugin):
|
|
# Boilerplate
|
|
name = "osquery"
|
|
description = "Linux osquery plugin" # Can later be extended to support other OS-es as well
|
|
|
|
required_files = []
|
|
|
|
def __init__(self):
|
|
super().__init__()
|
|
self.plugin_path = __file__
|
|
|
|
self.debugit = False
|
|
|
|
def process_templates(self):
|
|
""" process jinja2 templates of the config files and insert own config """
|
|
|
|
pass
|
|
|
|
def prime(self):
|
|
""" Hard-core install. Requires a reboot """
|
|
|
|
# pg = self.get_playground()
|
|
|
|
self.vprint("Installing Linux OSQuery", 3)
|
|
|
|
self.run_cmd('echo "deb [arch=amd64] https://pkg.osquery.io/deb deb main" | sudo tee /etc/apt/sources.list.d/osquery.list')
|
|
self.run_cmd("sudo apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 1484120AC4E9F8A1A577AEEE97A80C63C9D8B80B")
|
|
self.run_cmd("sudo apt update")
|
|
self.run_cmd("sudo apt -y install osquery")
|
|
self.run_cmd("")
|
|
# sudo apt -y install python3-pip
|
|
# pip install osquery
|
|
|
|
return False
|
|
|
|
def install(self):
|
|
""" Installs the filebeat sensor """
|
|
|
|
return
|
|
|
|
def start(self):
|
|
self.run_cmd("osqueryi --ephemeral --disable_logging --disable_database --extensions_socket /home/vagrant/test.sock") # TODO: Find better socket name
|
|
|
|
"""
|
|
ec = osquery.ExtensionClient("/home/vagrant/test.sock")
|
|
ec.open()
|
|
c = ec.extension_client()
|
|
c.query("select timestamp from time")
|
|
"""
|
|
|
|
return None
|
|
|
|
def stop(self):
|
|
""" Stop the sensor """
|
|
return
|
|
|
|
def collect(self, path):
|
|
""" Collect sensor data """
|
|
|
|
dst = ""
|
|
return [dst]
|