{"type":"doc","content":[{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"2"},"type":{"value":"flat"}},"macroMetadata":{"macroId":{"value":"79a28522-a825-4b82-9cd6-919228a0ba13"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"094c9009-0104-471f-b941-fdf9e1d1ecf4"}},{"type":"paragraph","content":[{"text":"This document is intended to help Endpoint Agent users to perform the most common operations and maintenance actions with the product outside of those that can be performed directly in the EA Manager UI. Check the DEAM manual for specific information for the usage of the web UI.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Solution overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The Endpoint Agent solution is provided as a package with a set of Ansible playbooks to help with the deployment and operation of the platform.","type":"text"}]},{"type":"paragraph","content":[{"text":"Once the platform is deployed, and depending on the operation that an operator wants to achieve, there are typically several ways to acknowledge the desired result depending on the action that needs to be taken:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the Ansible playbooks:","type":"text","marks":[{"type":"strong"}]},{"text":" Changes to some configurations can also be applied using the provided playbooks. The playbooks are mainly oriented to change configurations in the packs or in the EA Manager configuration files. At deployment time, an inventory is created that represents the topology of the EA Manager system. Applying changes via Ansible playbooks using the proper inventory file makes sure that every node in the system takes the same configuration change.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Operation examples:","type":"text","marks":[{"type":"underline"}]},{"text":" Modification in default packs, modification of endpoint configuration, EA Manager configuration change.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Use the WEB UI: ","type":"text","marks":[{"type":"strong"}]},{"text":"Changes to configuration applied in the WEB UI take effect immediately. The changes made via the WEB UI live in the EA Manager MySQL DB","type":"text"},{"text":".","type":"text","marks":[{"type":"strong"}]},{"text":" Since the DB is shared, the change will be reflected in every EAM. Endpoints poll the configuration periodically based on the parameter ","type":"text"},{"text":"config_refresh","type":"text","marks":[{"type":"code"}]},{"text":" defined in the endpoint centralized configuration.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Operation examples","type":"text","marks":[{"type":"underline"}]},{"text":": New queries, new packs, endpoint configuration changes, server labeling","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Operations at OS level: ","type":"text","marks":[{"type":"strong"}]},{"text":"Mainly cases related to checking logs, or related to the status of the service (start/stop). It is possible to make changes in the EAM configuration files at OS level, but the use of Ansible playbooks is strongly advised to ensure the integrity of your system.","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Operation examples:","type":"text","marks":[{"type":"underline"}]},{"text":" Restart EAM service, journal check, environment variable change…","type":"text"}]}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"The Ansible playbooks","type":"text"}]},{"type":"paragraph","content":[{"text":"There are several playbooks included with the EA solution. The Ansible playbooks are a set of automatized tasks that help deploy and configure the system abstracting the operator of the way that configuration is applied","type":"text"},{"text":". ","type":"text","marks":[{"type":"strong"}]},{"text":"As an example, EA Manager uses a configuration file placed in ","type":"text"},{"text":"/etc/devo-ea-manager/","type":"text","marks":[{"type":"code"}]},{"text":". While it is possible to change the configuration manually in the configuration file, the Ansible playbook will allow you to make the change across all the EA Managers in your topology and keep the system in sync with a single command.","type":"text"}]},{"type":"paragraph","content":[{"text":"The playbooks are based on YAML files, and every time a YAML file is modified, it is necessary to run a playbook to deploy the changes to the system. To run a playbook, run the command: ","type":"text"},{"text":"ansible-playbook -i inventories/ playbooks/","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"devo-endpoint-agent","type":"text"}]},{"type":"paragraph","content":[{"text":"This playbook encloses the whole deployment of the EA solution. This playbook is used during the first deployment and subsequent upgrades. ","type":"text"}]},{"type":"paragraph","content":[{"text":"From an operation standpoint we should only run this playbook when there is a change in the inventory file parameters that we want to propagate to the live environment, for example:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Entrypoint change","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Certificate change","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"FQDN change","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Password changes","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"deam-packs","type":"text"}]},{"type":"paragraph","content":[{"text":"This playbook addresses changes in:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Centralized endpoint configuration. This configuration is located in the inventory file we used for the deployment (in ","type":"text"},{"text":"$HOME/devo-ea-deployer/inventories","type":"text","marks":[{"type":"code"}]},{"text":") and it defines the parameters that apply to the endpoints. Every endpoint polls periodically to get the configuration from the EA Manager.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Devo default packs and queries. EA Manager provides a number of default packages and queries that are automatically added to the system after the first deployment. This definitions are located in ","type":"text"},{"text":"$HOME/devo-ea-deployer/playbooks/roles/deam-packs/files/optional-devo-packs/","type":"text","marks":[{"type":"code"}]},{"text":" and can be changed in future versions of the packs along with the evolution of the product. ","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Note that executing the playbook ","type":"text"},{"text":"deam-packs","type":"text","marks":[{"type":"code"}]},{"text":" will deploy both the configuration and the packs. In case that the operator wants to use its own version of the packs (for example, change intervals, or remove queries from the pack) it is recommended to create your own pack (easily created using the WEB UI) or modify the packs using the ansible playbook every time to avoid overriding the data. ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"dea-backup","type":"text"}]},{"type":"paragraph","content":[{"text":"This playbook takes a backup of the relevant items composing the EA Manager solution.","type":"text"}]},{"type":"paragraph","content":[{"text":"Run this playbook to obtain a backup of:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"OS and System configurations","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"FleetDM current configuration","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Docker volumes backup (REDIS and MySQL)","type":"text"}]}]}]},{"type":"paragraph","content":[{"text":"Note that in the event of the topology using its own separate databases and not the self-generated docker volumes, those backups need to be taken manually by the operator.","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Common uses guide","type":"text"}]},{"type":"table","attrs":{"layout":"default","width":760.0,"localId":"17276e0a-16a3-446f-840b-ec3a5d4e575a"},"content":[{"type":"tableRow","content":[{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Symptoms / Actions","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Recommended action","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Recommended way of action","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Alternative action","type":"text","marks":[{"type":"strong"}]}]}]},{"type":"tableHeader","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Help","type":"text","marks":[{"type":"strong"}]}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"UI is not available, service is not responding.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Restart the service, check the logs and search for errors.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"OS level action, to be done in every EAM (or in the faulty ones).","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://devodocs.atlassian.net/wiki/pages/resumedraft.action?draftId=119669984"}},{"text":" ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Change intervals, modify queries or packs in the Devo packs.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Create a new pack and modify it. Enable the new pack and disable the provided by Devo.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"WEB UI action. Effect immediate, after propagation time.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://devodocs.atlassian.net/wiki/spaces/LAD/pages/1052967602"}},{"text":" ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Addition of new data sources, by using new queries and new packs.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Create new packs to gather the desired information and enable it.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"WEB UI action. Effect immediate, after propagation time.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph"}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://devodocs.atlassian.net/wiki/spaces/LAD/pages/1052968308"}},{"text":" ","type":"text"}]}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Modifications to deployment parameters configurations. (YAML inventory file) Change of entrypoint, change of certificates, EA Manager specific configurations.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Modify the values in the inventory files and run the ansible playbook.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Ansible playbook. After modifying the parameters, it is required to run a playbook for it to take effect in the system.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Change environment variables at OS level and restart the service. Needs to be done in every UAM.","type":"text"}]},{"type":"paragraph","content":[{"text":"(Keeping changes consistent with inventory file is strongly recommended)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph"}]}]},{"type":"tableRow","content":[{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Modification of a parameter in the endpoints via the centralized configuration.","type":"text"}]},{"type":"paragraph","content":[{"text":"Examples:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Include new Windows Event Channels","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Include new File Fetcher patterns","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Change other parameter that affect osquery behavior","type":"text"}]}]}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Modify the values in the inventory file and run ","type":"text"},{"text":"deam-packs","type":"text","marks":[{"type":"code"}]},{"text":" playbook.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Ansible playbook. After modifying the fields, it is required to run a playbook for it to take effect in the system. Need to wait propagation time until the configuration is available in the endpoint.","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"text":"Use WEB UI, with backend site. Changes are effective immediately in the manager, need to wait propagation time until the configuration is available in the endpoint.","type":"text"}]},{"type":"paragraph","content":[{"text":"(Keeping changes consistent in the inventory is strongly recommended)","type":"text"}]}]},{"type":"tableCell","attrs":{"colspan":1,"rowspan":1,"colwidth":[152.0]},"content":[{"type":"paragraph","content":[{"type":"inlineCard","attrs":{"url":"https://devodocs.atlassian.net/wiki/pages/resumedraft.action?draftId=119669984"}},{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"}]},{"type":"paragraph","content":[{"text":" ","type":"text"},{"type":"hardBreak"},{"text":" ","type":"text"}]}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"EA Manager operations","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Start/Stop EA Manager","type":"text"}]},{"type":"paragraph","content":[{"text":"To stop the service:","type":"text"}]},{"type":"paragraph","content":[{"text":"sudo systemctl stop devo-ea-manager","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"To start the service:","type":"text"}]},{"type":"paragraph","content":[{"text":"sudo systemctl start devo-ea-manager","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"To check status of the service:","type":"text"}]},{"type":"paragraph","content":[{"text":"sudo systemctl status devo-ea-manager","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Check EA Manager logs","type":"text"}]},{"type":"paragraph","content":[{"text":"To check the logs that the manager is writing to the disk, run:","type":"text"}]},{"type":"paragraph","content":[{"text":"sudo journalctl -u devo-ea-manager","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"To see the logs flowing in real time:","type":"text"}]},{"type":"paragraph","content":[{"text":"sudo journalctl -fu devo-ea-manager","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Change configurations","type":"text"}]},{"type":"paragraph","content":[{"text":"There are several type of options that can be changed in Devo Endpoint Agent product. Each of these configurations have a different way to be applied. ","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Change EA Manager options","type":"text"}]},{"type":"paragraph","content":[{"text":"Options related to the way that EA Manager behaves","type":"text"},{"text":".","type":"text","marks":[{"type":"strong"}]},{"text":" They should not be changed unless you have the expertise and know exactly how your changes are going to affect the platform.","type":"text"}]},{"type":"paragraph","content":[{"text":"To see a list of what parameters can be applied to the EA manager, run the command: ","type":"text"},{"text":"fleet --help","type":"text","marks":[{"type":"code"}]},{"text":". The output will show the environment variables that the EA manager accepts.","type":"text"}]},{"type":"paragraph","content":[{"text":"To modify/add any parameter:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Edit the file ","type":"text"},{"text":"/etc/devo-ea-manager/devo-ea-manager","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Change/add the parameter you are looking to modify","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart EA Manager service: ","type":"text"},{"text":"sudo systemctl restart devo-ea-manager","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Modify EA client configuration flags via ansible roles","type":"text"}]},{"type":"paragraph","content":[{"text":"Configuration related to the way EA Client behaves. The configuration is centralized in the EA Manager, and then pulled from every endpoint periodically.","type":"text"}]},{"type":"paragraph","content":[{"text":"To make changes in the configuration file, follow the process in Redeploy default options / packs .","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Modify EA client configuration flags via EA Manager WEB UI","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"When making changes in the configuration of osquery, it is recommended that you do it via the ansible roles. However, changes can be done also “on-the-fly” via the EA Manager Web UI. Changes done on the Web UI can be easily overwritten if an ansible playbook is ran (i.e: during upgrades).","type":"text"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Access the osquery configuration in ","type":"text"},{"text":"https:///","type":"text","marks":[{"type":"code"}]},{"text":" -> settings -> Global agent options","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":80.0},"content":[{"type":"media","attrs":{"width":3456,"id":"09892d72-0d89-427a-a87f-0d5fca7090a6","collection":"contentId-1052968222","type":"file","height":836}}]},{"type":"mediaSingle","attrs":{"layout":"center","width":80.0},"content":[{"type":"media","attrs":{"width":3212,"id":"38fd9d68-cc3c-42fa-a826-5277bee5c78f","collection":"contentId-1052968222","type":"file","height":944}}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"The configuration shown in this screenshot is the same that the default one included in the ","type":"text"},{"text":"deam-packs/defaults/main.yml","type":"text","marks":[{"type":"code"}]},{"text":" file in the ansible playbooks. However, the ansible files are collapsed to ease the usage. If you want to make a change here make sure that you make changes in the proper section. Since all the configurations are expanded, each platform will have its own kind of configurations. Please make sure that changes are made in the correct sections:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"config : Linux","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"overrides->platforms->darwin: macOS","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"overrides->platforms->windows: Windows","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"In order to verify that the changes are applied to a specific endpoint once the ","type":"text"},{"text":"config_refresh","type":"text","marks":[{"type":"code"}]},{"text":" time has passed, the following query can be run: ","type":"text"},{"text":"SELECT * FROM osquery_flags","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Change shell only flags at packaging time","type":"text"}]},{"type":"paragraph","content":[{"text":"Options related to the way the EA Client behaves that are not centralized. These flags are used by the EA client at boot time and need to live in a file in the endpoint. These flags are stored in the file ","type":"text"},{"text":"osquery.flags","type":"text","marks":[{"type":"code"}]},{"text":" in the EA Client installation folder.","type":"text"}]},{"type":"paragraph","content":[{"text":"The flags can be modified manually client by client for testing purposes. To make configurations in the flags that will be available for download in the manager, follow the process in Repackage EA Client.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Redeploy default options / packs via ansible","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To make changes in the configuration options, update the inventory file used in the deployment ","type":"text"},{"text":"$HOME/devo-ea-deployer/inventories","type":"text","marks":[{"type":"code"}]},{"text":" under the ","type":"text"},{"text":"vars","type":"text","marks":[{"type":"code"}]},{"text":" level.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"To make changes in the default packs, so the changes persist in successive deployments, modify the corresponding file inside ","type":"text"},{"text":"$HOME/devo-ea-deployer/playbooks/roles/deam-packs/files/devo-packs/","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Once modifications are done, enable your virtual environment and re-deploy the ","type":"text"},{"text":"deam-packs","type":"text","marks":[{"type":"code"}]},{"text":" role playbook by running:","type":"text"}]},{"type":"codeBlock","content":[{"text":"source \"/opt/ansible-2.9/venv/bin/activate\"\nansible-playbook -i inventories/.yaml playbooks/deam-packs.yaml","type":"text"}]}]}]},{"type":"panel","attrs":{"panelType":"info"},"content":[{"type":"paragraph","content":[{"text":"NOTE: ","type":"text","marks":[{"type":"strong"}]},{"text":"Redeploying the ","type":"text"},{"text":"deam-packs","type":"text","marks":[{"type":"code"}]},{"text":" role deploys both the ","type":"text"},{"text":"options","type":"text","marks":[{"type":"code"}]},{"text":" and the ","type":"text"},{"text":"packs","type":"text","marks":[{"type":"code"}]},{"text":". If you made changes to the default packs delivered with the Devo EA, the changes will be overwritten. Other packs will not be affected.","type":"text"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Repackage EA Client","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Make your changes in the ","type":"text"},{"text":"osquery.flags","type":"text","marks":[{"type":"code"}]},{"text":" file in ","type":"text"},{"text":"$HOME/devo-ea-deployer/playbooks/roles/dea-agent-packager/templates/","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enable your viertual envrionment using: ","type":"text"},{"text":"source \"/opt/ansible-2.9/venv/bin/activate\"","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Re-package the clients using: ","type":"text"},{"text":"ansible-playbook -i inventories/.yaml playbooks/dea-agent-packager.yaml","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Access https://:8081/ , the new agents should be available from download.","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Add new log files to be parsed by the EA Client (Files Fetcher)","type":"text"}]},{"type":"paragraph","content":[{"text":"The Endpoint Agent includes the ability to parse flat log files and upload them to Devo","type":"text"},{"text":".","type":"text","marks":[{"type":"strong"}]},{"text":" Only a handful of files are configured by default, so to add new logs to the processing list, have a look at the configuration options of ","type":"text"},{"text":"Files fetcher","type":"text","marks":[{"type":"link","attrs":{"href":"#"}}]},{"text":". Once your changes to the configuration file are ready, deploy them by following the redeploy procedure.","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Add new Windows Event Channels to be available to the EA Client","type":"text"}]},{"type":"paragraph","content":[{"text":"Windows event log capturing is supported in Devo Endpoint Agent. However, due to the huge amount of channels in where Windows OS stores the event logs, only some of them are configured by default as a comma-separated list, you can modify them under the tag ","type":"text"},{"text":"deam_fleet_config_agent_opts_win_windows_event_channels","type":"text","marks":[{"type":"code"}]},{"text":" in the inventory we used for deployment.","type":"text"}]},{"type":"mediaSingle","attrs":{"layout":"center","width":65.0},"content":[{"type":"media","attrs":{"width":1886,"id":"aa17e047-7f0b-4d73-8cb5-3b6603a34947","collection":"contentId-1052968222","type":"file","height":98}}]},{"type":"paragraph"},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"If you add the ","type":"text"},{"text":"deam_fleet_config_agent_opts_win_windows_event_channels","type":"text","marks":[{"type":"code"}]},{"text":" key, ensure to add all the channels that are in use. Adding this key will overwrite the default one.","type":"text"},{"type":"hardBreak"},{"text":"Default ","type":"text"},{"text":"deam_fleet_config_agent_opts_win_windows_event_channels","type":"text","marks":[{"type":"code"}]},{"text":" values → ","type":"text"},{"text":"System,Application,Setup,Security,Microsoft-Windows-PowerShell/Operational,ForwardedEvents","type":"text","marks":[{"type":"code"}]}]}]},{"type":"paragraph","content":[{"text":"In order to add a new channel, add the full name of the event channel that you want to add in ","type":"text"},{"text":"windows_event_channels","type":"text","marks":[{"type":"code"}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"To know what is the Full Name of a event log channel:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the Event Viewer","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Navigate to the channel that you want to capture.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Right click on it and copy the Full Name field.","type":"text"}]}]}]},{"type":"mediaSingle","attrs":{"layout":"center"},"content":[{"type":"media","attrs":{"width":950,"id":"b7da0913-14d0-4707-8c2d-122b22d040a1","collection":"contentId-1052968222","type":"file","height":715}}]},{"type":"paragraph"},{"type":"paragraph","content":[{"text":"Once the channel is added, redeploy the ","type":"text"},{"text":"deam-packs","type":"text","marks":[{"type":"code"}]},{"text":" playbook (keep in mind that default packs will be overwritten when doing so).","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Known limitation","type":"text","marks":[{"type":"strong"}]},{"text":": EA cannot subscribe to Analytic/Debug channels. These type of channels, which are based in ","type":"text"},{"text":".ETL","type":"text","marks":[{"type":"code"}]},{"text":" files instead of ","type":"text"},{"text":".EVTX","type":"text","marks":[{"type":"code"}]},{"text":" files, cannot be subscribed due to a limitation included in the Windows OS. EA will not gather events included in those channels even if they are included in the configuration.","type":"text"}]},{"type":"paragraph","content":[{"text":"If you are experiencing issues while adding new event channels, perform a EA backing store refresh to ensure the new configurations take effect.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Change password of root user in MySQL service (self creating dockerized MySQL service by deployment)","type":"text"}]},{"type":"paragraph","content":[{"text":"We strongly recommend that you change the default root password of MySQL service for security reasons.","type":"text"}]},{"type":"paragraph","content":[{"text":"The default value for the password of the root user configured in MySQL service when it is deployed as docker container is very insecure.","type":"text"}]},{"type":"paragraph","content":[{"text":"If this value is not changed during deployment configuration then replace it now with a more robust one.","type":"text"}]},{"type":"paragraph","content":[{"text":"The next steps are designed to do it without redeploying the EA manager and related components.","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Check if the MySQL service has configured the default password. Run the command in the server where MySQL container was deployed.","type":"text"}]},{"type":"codeBlock","content":[{"text":"sudo /usr/local/bin/docker-compose -f /srv/deam-internal-services/docker-compose.yaml exec mysql mysql -u root --password=toor","type":"text"}]},{"type":"paragraph","content":[{"text":"If the login action ended without an error with a similar output such as:","type":"text"}]},{"type":"codeBlock","content":[{"text":"mysql: [Warning] Using a password on the command line interface can be insecure.\nWelcome to the MySQL monitor. Commands end with ; or \\g.\nYour MySQL connection id is 10\nServer version: 5.7.37 MySQL Community Server (GPL)\n\nCopyright (c) 2000, 2022, Oracle and/or its affiliates.\n\nOracle is a registered trademark of Oracle Corporation and/or its\naffiliates. Other names may be trademarks of their respective\nowners.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nmysql>\n","type":"text"}]},{"type":"paragraph","content":[{"text":"Then the default password (","type":"text"},{"text":"toor","type":"text","marks":[{"type":"code"}]},{"text":") was configured for the root user of MySQL. Continue with next steps to change it.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Change the password in docker-compose file. Run the commands in the server where the MySQL container was deployed.","type":"text"},{"type":"hardBreak"},{"text":"Edit ","type":"text"},{"text":"/srv/deam-internal-services/docker-compose.yaml","type":"text","marks":[{"type":"code"}]},{"text":" file","type":"text"}]},{"type":"codeBlock","content":[{"text":"sudo vim /srv/deam-internal-services/docker-compose.yaml","type":"text"}]},{"type":"paragraph","content":[{"text":"Find the configuration property with the MySQL root password:","type":"text"}]},{"type":"codeBlock","content":[{"text":"version: '3'\n\n...\n\nservices:\n mysql:\n\n ...\n\n environment:\n MYSQL_ROOT_PASSWORD: \"toor\"","type":"text"}]},{"type":"paragraph","content":[{"text":"Replace the value of the password with a stronger value (","type":"text"},{"text":"<>","type":"text","marks":[{"type":"code"}]},{"text":" in the code snipped bellow). Be carefully to maintain line indentation.","type":"text"}]},{"type":"codeBlock","content":[{"text":" MYSQL_ROOT_PASSWORD: \"<>\"","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Change the password in running MySQL service. Run the commands in the server where MySQL container was deployed.","type":"text"},{"type":"hardBreak"},{"text":"Log in to the MySQL service as the root user using the default password:","type":"text"}]},{"type":"codeBlock","content":[{"text":"sudo /usr/local/bin/docker-compose -f /srv/deam-internal-services/docker-compose.yaml exec mysql mysql -u root --password=toor","type":"text"}]},{"type":"paragraph","content":[{"text":"Change the root password using the same value selected in the previous step (replacing ","type":"text"},{"text":"<>","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]},{"type":"codeBlock","content":[{"text":"ALTER USER 'root'@'localhost' IDENTIFIED BY '<>';","type":"text"}]},{"type":"paragraph","content":[{"text":"Press ","type":"text"},{"text":"Ctrl + D","type":"text","marks":[{"type":"code"}]},{"text":" to exit from MySQL-client session","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Additionally you should edit your inventory file and add ","type":"text"},{"text":"deam_mysql_root_password","type":"text","marks":[{"type":"code"}]},{"text":" var with the value of the password previously chosen, to prevent changes to the default password during future aplatform upgrade or similar procedure.","type":"text"}]},{"type":"codeBlock","content":[{"text":"all:\n vars:\n deam_mysql_root_password: <> ","type":"text"}]}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"EA Client operations","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Start/Stop EA Client","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Windows","type":"text"}]},{"type":"paragraph","content":[{"text":"Stop the service:","type":"text"}]},{"type":"paragraph","content":[{"text":"Stop-Service -Force -Name \"osqueryd\"","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"Start the service:","type":"text"}]},{"type":"paragraph","content":[{"text":"Start-Service -Force -Name \"osqueryd\"","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Linux/macOS","type":"text"}]},{"type":"paragraph","content":[{"text":"Stop the service:","type":"text"}]},{"type":"paragraph","content":[{"text":"sudo osqueryctl stop","type":"text","marks":[{"type":"code"}]}]},{"type":"paragraph","content":[{"text":"Start the service:","type":"text"}]},{"type":"paragraph","content":[{"text":"sudo osqueryctl start","type":"text","marks":[{"type":"code"}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"EA backing store refresh","type":"text"}]},{"type":"paragraph","content":[{"text":"The Endpoint Agent uses RocksDB to ensure resiliency and buffer data. Data in the backstore is persistent in memory and in the disk. In case you need to flush the data in the RocksDB (i.e: to re-enable denylisted queries), use the following procedure:","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Windows","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Windows menu → Run → services.msc","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Stop service osqueryd","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Delete the DB folder: ","type":"text"},{"text":"C:\\Program Files\\osquery\\osquery.db","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Start service osqueryd","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Linux / macOS","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Stop osqueryd service: ","type":"text"},{"text":"sudo osqueryctl stop","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Delete the DB folder: ","type":"text"},{"text":"sudo rm /var/osquery/osquery.db -r","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Start the service: ","type":"text"},{"text":"sudo osqueryctl start","type":"text","marks":[{"type":"code"}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Enable native support for syslog linux events","type":"text"}]},{"type":"paragraph","content":[{"text":"There are two ways to send linux events to Devo using the Endpoint Agent:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Configure the specific files to be monitored in the File Fetcher.","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Enable osquery native syslog capabilities (requires rsyslog or equivalent installed):","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add pipe configuration in rsyslog:","type":"text"}]},{"type":"orderedList","attrs":{"order":1},"content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Add a new file (i.e 60-osquery.conf) to /etc/rsyslog.d:","type":"text"}]},{"type":"codeBlock","content":[{"text":"$template OsqueryCsvFormat, \"%timestamp:::date-rfc3339,csv%,%hostname:::csv%,%syslogseverity:::csv%,%syslogfacility-text:::csv%,%syslogtag:::csv%,%msg:::csv%\\n\"\n*.* |/var/osquery/syslog_pipe;OsqueryCsvFormat","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart rsyslogd to take the new configuration: ","type":"text"},{"text":"sudo systemctl restart rsyslogd","type":"text","marks":[{"type":"code"}]}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Restart osqueryd: ","type":"text"},{"text":"sudo osqueryctl restart","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Ensure that the query ","type":"text"},{"text":"SELECT *, \"events_linux\" as __devoSubTag FROM syslog_events;","type":"text","marks":[{"type":"code"}]},{"text":" exists in one of your packs (by default, it is included in the DevoEventsPack)","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Events will show automatically in ","type":"text"},{"text":"box.devo_ea.events_linux","type":"text","marks":[{"type":"code"}]}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Modify EA client configuration flags","type":"text"}]},{"type":"paragraph","content":[{"text":"OSQuery has also some options decentralized to make easier to adapt EA client to more demanding hosts.","type":"text"}]},{"type":"paragraph","content":[{"text":"To make changes in the configuration file, we need to move to the following path:","type":"text"}]},{"type":"paragraph","content":[{"text":"Linux:","type":"text"}]},{"type":"codeBlock","content":[{"text":"/etc/osquery/","type":"text"}]},{"type":"paragraph","content":[{"text":"Windows:","type":"text"}]},{"type":"codeBlock","content":[{"text":"C:\\Program Files\\osquery\\","type":"text"}]},{"type":"paragraph","content":[{"text":"Darwin:","type":"text"}]},{"type":"codeBlock","content":[{"text":"/private/var/osquery/","type":"text"}]},{"type":"paragraph","content":[{"text":"and modify the corresponding flags in ","type":"text"},{"text":"osquery.flags","type":"text","marks":[{"type":"code"}]},{"text":" file.","type":"text"}]},{"type":"paragraph","content":[{"text":"Once modifications are done, we need to stop and start the service following in Start/Stop EA Client section","type":"text"}]},{"type":"panel","attrs":{"panelType":"warning"},"content":[{"type":"paragraph","content":[{"text":"Be aware that this flags work the same way as the EAM configuration but with less priority. This means that if the same flag exists in both places, the EAM configuration one will be used.","type":"text"}]}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Uninstall EA","type":"text"}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Windows","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Open the Windows menu and go to “Add or Remove programs”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Select “osquery” and click in “Uninstall”","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Remove the installation folder (","type":"text"},{"text":"C:\\Program Files\\osquery","type":"text","marks":[{"type":"code"}]},{"text":")","type":"text"}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"Linux","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Stop osquery service: ","type":"text"},{"text":"sudo osqueryctl stop","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Uninstall the package using the repo manager. For ubuntu, for example: ","type":"text"},{"text":"sudo apt remove osquery","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Remove the installation and configuration folders:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"/var/osquery","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"/","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"opt/osquery","type":"text","marks":[{"type":"code"}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"/etc/osquery","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"}]}]}]}]}]},{"type":"heading","attrs":{"level":3},"content":[{"text":"macOS","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Unload and remove","type":"text"},{"text":" io.osquery.agent.plist","type":"text","marks":[{"type":"code"}]},{"text":" launchdaemon:","type":"text"}]},{"type":"codeBlock","content":[{"text":"sudo launchctl unload /Library/LaunchDaemons/io.osquery.agent.plist\nsudo rm /Library/LaunchDaemons/io.osquery.agent.plist","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Remove files/directories created by osquery installer pkg:","type":"text"}]},{"type":"codeBlock","content":[{"text":"sudo rm -rf /private/var/log/osquery\nsudo rm -rf /private/var/osquery\nsudo rm /usr/local/bin/osquery*\nsudo rm -rf /opt/osquery","type":"text"}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Execute the following command ","type":"text"},{"text":"sudo pkgutil --forget io.osquery.agent.plist ","type":"text","marks":[{"type":"code"}]}]}]}]}],"version":1}

Browser not supported