Endpoint Logging and Monitoring
Osquery
Based on our findings in the Literature Review, we determined that Osquery would be a useful service to include with the deployment of our endpoint agents to have structured information on hosts. Osquery would allow us to gather operating system information using queries in SQL format, which can be useful for checking to see if the OS, system security, and services are up to date. Additionally, having this system information would help us to monitor the status of our endpoint devices and can be used to trigger alerts if a system's resources exceed a certain threshold for a period of time.
Additional Documentation on Osquery can be found --> Here
Integration
For this project, Osquery will be used to gather specific logs of system information via a scheduled task which can then be sent back to the backend server to be collected and stored on a database server (SQLite Database Server or similar alternate format).
Overview Diagram
Osquery Data Formatting
Example of system information obtained by Osquery would include a format similar to below:
| System Info gathered by Osquery | |||||||
|---|---|---|---|---|---|---|---|
| Hostname | IP | OS + Version | Services + Version | CPU Usage | RAM Usage | Storage Usage | Timestamp YYYY-MM-DDTHH:mm:ss (UTC) |
Collecting Osquery Log Data
From here the collected Osquery log entries can be used by the backend server to send alerts on system performance as well as schedule tasks for system and service updates as needed. The backend server can also update the configuration of osquery running on the endpoint system as needed through our custom endpoint management API. This can allow for a more custom system monitoring setup if needed by the system administrator.
Bundling installer
For our proof of concept, we plan to look into including osquery as part of our endpoint agent installation as this would help to simplify deployment. Once the agent installer is run on the endpoint system, osquery would initialize and enroll to our backend server. The enrollment process will make use of a TLS logger plugin which will help to ensure that system and logging information gathered by the Agent is able to be sent to the backend server via a secure HTTPS connection.