Import/Export pack configuration?

[juju4]

Hello,

Any way to import an existing pack configuration file either through gui or cli? More generally, would want to import/export queries, pack or osqueryd standalone config.

Thanks

[headmin]

Did you check out the probe feeds ? You add an osquery pack to probe feeds, then import to a new probe. Updates in the original pack will be indicated, you see a diff and decide to update your probe case by case.

Probes can be saved as a gist, i.e. you can share this with others or just store.

[juju4]

No, I don't think so. But can I import through command line? where are the corresponding files?

File/Templates are easier to integrate in an orchestrated deployment.

[np5]

There is a django management command to add a probe feed:

python server/manage.py add_probe_feed

There is actually no way to export and import the full zentral configuration via files, but we are currently trying to find a solution.

[np5]

There is an API endpoint now to import Osquery packs.