kolide-pipeline-bot

Send notifications from osquery differential logs uploaded to GCP storage by Kolide

Features

Support for Kolide differential logs
Rich Slack notifications
VirusTotal annotation
Google Cloud Storage
CLI and HTTP server modes
Duplicate event suppression
Threading of related events

Usage

Compile:

go build .

Setup your local credentials:

gcloud auth application-default login

Inspect output without sending notifications:

kolide-pipeline-bot \
  --bucket=your-kolide-logs \
  --prefix=kolide/results/threat_hunting \
  --max-age=8h

To send notifications, set a SLACK_ACCESS_TOKEN to a Bot User OAuth Token for your Workspace, which typically starts with xoxb-.

Webserver mode

This will run a web server, that will scan the bucket every time /refreshz is hit, as well as send notifications:

kolide-pipeline-bot \
  --bucket=your-osquery-logs \
  --prefix=kolide/results/threat_hunting \
  --serve

This allows the kolide-pipeline-bot to be run in environments that assume an HTTP frontend, such as Google Cloud Run. You can then use a scheduler service to hit /refreshz as often as you want to poll for results.

Environment Variables

For your deployment, you may find it more useful to use environment variables than arguments. The kolide-pipeline-bot supports a handful of them:

PORT
BUCKET_NAME
BUCKET_PREFIX
SLACK_ACCESS_TOKEN
VIRUSTOTAL_KEY

Google Cloud Run

Using ko, it is easy to build kolide-pipeline-notifier to your local repo and deploy it straight into production:

export KO_DOCKER_REPO="gcr.io/<your project>/pipeline-notifier"

gcloud run deploy pipeline-notifier \
  --image="$(ko publish .)" \
  --args=-serve \
  --region us-central1 \
  --project "<your project>"