osquery installed/enabled but missing from wazuh console

[John S. Galliano]

I have osquery installed on my agents and enabled within my manager config, but I do not see the module present. Any advice on how to resolve is appreciated!

From the manager config:

  <!-- Osquery integration -->
  <wodle name="osquery">
    <disabled>no</disabled>
    <run_daemon>yes</run_daemon>
    <bin_path>/usr/bin</bin_path>
    <log_path>/var/log/osquery/osqueryd.results.log</log_path>
    <config_path>/etc/osquery/osquery.conf</config_path>
    <add_labels>yes</add_labels>
    <pack name="custom_pack">/path/to/custom_pack.conf</pack>
  </wodle>

[Carlos Dams]

Hi John,

Thanks for using Wazuh!

If you already configured osquery, you may be just missing enabling the osquery module: 

1. Open Wazuh Dashabord (formerly Kibana)
2. Click on Wazuh -> Settings -> Modules Screenshot wazuh 
3. Scroll down and under Threat Detection and Response enable Osquery 
4. Go back to Wazuh menu and you will be able to see Osquery module 

I list here some documentation about Osquery that might help:

• https://documentation.wazuh.com/current/user-manual/capabilities/osquery.html
• https://documentation.wazuh.com/current/proof-of-concept-guide/integrate-osquery.html
  

I hope this information addresses your question, please let me know

Carlos D.