{
  "options": {
    "config_plugin": "filesystem",

    "logger_plugin": "filesystem",

    "logger_path": "/var/log/osquery",

    // logs. If a logging plugin is selected it will still write query results.
    //"disable_logging": "false",

    // Query differential results are logged as change-events to assist log
    // aggregation operations like searching and transactons.
    // Set 'log_results_events' to log differentials as transactions.
    //"log_result_events": "true",

    // Splay the scheduled interval for queries.
    // This is very helpful to prevent system performance impact when scheduling
    // large numbers of queries that run a smaller or similar intervals.
    //"schedule_splay_percent": "10",

    // Write the pid of the osqueryd process to a pidfile/mutex.
    //"pidfile": "/var/osquery/osquery.pidfile",

    // Clear events from the osquery backing store after a number of seconds.
    "events_expiry": "86000",

    // A filesystem path for disk-based backing storage used for events and
    // and query results differentials. See also 'use_in_memory_database'.
    "database_path": "/var/osquery/osquery.db",

    // Comma-delimited list of table names to be disabled.
    // This allows osquery to be launched without certain tables.
    //"disable_tables": "foo_bar,time",

    // Enable debug or verbose debug output when logging.
    "debug": "false",
    "verbose_debug": "false",

    // The number of threads for concurrent query schedule execution.
    "worker_threads": "4"
  },

  // Define a schedule of queries */
  "schedule": {
    // This is a simple example query that outputs information about osquery.
        "file_events": {
          "query": "SELECT * from file_events;",
          "interval": 30
        },
        "users": {
          "query": "SELECT * from users;",
          "interval": 30
        },
        "listening_ports": {
          "query": "SELECT uid, name, port, protocol FROM listening_ports l, processes p WHERE l.pid=p.pid;",
          "interval": 30
        },
        "crontab": {
          "query": "SELECT * from crontab;",
          "interval": 30
        },
        "kernel_modules": {
          "query": "SELECT name,size,status from kernel_modules;",
          "interval": 30
        },
        "processes": {
          "query": "SELECT pid, name, path, cmdline from processes;",
          "interval": 30
        },
        "yara_events": {
          "query": "SELECT * from yara_events;",
          "interval": 5
        },
        "suid_bin": {
          "query": "select * from suid_bin;",
          "interval": 60
        },
        "outbound_connections": {
          "query": "select user.username, proc.name, hash.md5, socket.pid, proc.path, proc.cmdline, socket.local_port, socket.remote_port, socket.remote_address from process_open_sockets as socket, processes as proc, users as user, hash as hash where socket.local_port not in (select port from listening_ports) and socket.local_port != 0 and socket.pid = proc.pid and user.uid = proc.uid and hash.path = proc.path;",
          "interval": 120
        }
  },
  "file_paths": {
    "etc": [
      "/etc/%%"
    ],
    "homes": [
      "/root/%%",
      "/home/%/%%"
    ],
    "system_binaries": [
      "/usr/bin/%", "/usr/sbin/%"
    ]
  },
  "decorators": {
    "load": [
      "SELECT uuid AS host_uuid FROM system_info;",
      "SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
    ]
  },
  "packs": {
    "osquery-monitoring": "/usr/share/osquery/packs/osquery-monitoring.conf",
    "incident-response": "/usr/share/osquery/packs/incident-response.conf",
    "it-compliance": "/usr/share/osquery/packs/it-compliance.conf",
    "vuln-management": "/usr/share/osquery/packs/vuln-management.conf",
    "hardware-monitoring": "/usr/share/osquery/packs/hardware-monitoring.conf"
  }
}