osquery operator

A Juju charm deploying and managing osquery on virtual machines and bare-metal hosts.

The osquery agent exposes an operating system as a high-performance relational database, letting security and operations teams query the state of a host with SQL. This charm deploys the Canonical SecOps fork of osquery as a subordinate agent that runs alongside a principal application on the same machine. It installs osquery from the c-osquery snap, runs it in daemon mode, and connects it over TLS to a centrally managed osquery controller that supplies the agent’s configuration and collects its logs.

Like any Juju charm, this charm supports one-line deployment, configuration, integration, scaling, and more. For osquery, this includes:

  • Installing and running the osqueryd daemon on any principal machine.

  • Translating Juju configuration into the osquery flagfile and reconciling the daemon whenever the configuration changes.

  • Enrolling the agent with an osquery controller over TLS, with the enrollment secret and client certificates delivered through Juju secrets.

This charm makes operating osquery fleets simple and consistent for security, DevOps, and SRE teams through Juju’s clean interface.

In this documentation

Get started

Deploy the osquery charm | Enroll an osquery controller

Deployment

Configurations | Relation endpoints

Operations

Upgrade | Redeploy | Back up and restore | Troubleshoot | Metrics | Terraform

osquery controller

Overview | Enroll the agent

Design

Architecture | Design

Security

Overview | Cryptography

How this documentation is organized

This documentation uses the Diátaxis documentation structure.

  • The Tutorial takes you step-by-step through a basic deployment of the osquery charm.

  • How-to guides assume you have basic familiarity with the osquery charm. Learn more about setting up, using, maintaining, and contributing to this charm.

  • Reference provides a guide to configurations, relations, and other technical details.

  • Explanation includes topic overviews, background and context and detailed discussion.

  • Release notes holds all the release notes for the charm, including any system or upgrade requirements.

Contributing to this documentation

Documentation is an important part of this project, and we take the same open-source approach to the documentation as the code. As such, we welcome community contributions, suggestions, and constructive feedback on our documentation. See How to contribute for more information.

If there’s a particular area of documentation that you’d like to see that’s missing, please file a bug.

Project and community

The osquery Operator is a member of the Ubuntu family. It’s an open-source project that warmly welcomes community projects, contributions, suggestions, fixes, and constructive feedback.

Governance and policies

Get involved

Releases

Thinking about using the osquery Operator for your next project? Get in touch!