diff --git a/osquery/setupOSqueryPacks.yml b/osquery/setupOSqueryPacks.yml new file mode 100644 index 00000000..58d2a927 --- /dev/null +++ b/osquery/setupOSqueryPacks.yml @@ -0,0 +1,47 @@ +--- +# Copyright 2018, Rackspace US, Inc. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +- name: Setup osquery packs + hosts: "{{ kolide_fleet_host | default(groups['kolide-fleet_all'][0]) }}" + become: false + vars_files: + - vars/variables.yml + tags: + - always + + environment: "{{ deployment_environment_variables | default({}) }}" + + gather_facts: "{{ osa_gather_facts | default(True) }}" + + tasks: + - name: Find osquery packs + find: + paths: "/usr/share/osquery/packs" + patterns: '*.conf' + register: _osquery_packs + + - name: Set pack fact + set_fact: + osquery_packs: "{{ _osquery_packs.files | map(attribute='path') | list }}" + + - name: Covert osquery packs + shell: >- + /usr/local/bin/fleetctl convert -f {{ item }} > /tmp/{{ item | basename }}.yaml + with_items: "{{ osquery_packs }}" + + - name: Apply osquery packs + shell: >- + /usr/local/bin/fleetctl apply -f /tmp/{{ item | basename }}.yaml + with_items: "{{ osquery_packs }}" diff --git a/osquery/site-osquery.yml b/osquery/site-osquery.yml index 686affbd..edb22cf4 100644 --- a/osquery/site-osquery.yml +++ b/osquery/site-osquery.yml @@ -12,3 +12,4 @@ # limitations under the License. - import_playbook: installOSquery.yml +- import_playbook: setupOSqueryPacks.yml