Turbot > Workspace

Turbot > Workspace > osquery

Turbot > Workspace > osquery > Enroll Secret Expiration

Turbot > Workspace > osquery > Secrets

Turbot > Workspace > osquery > Secrets > Expiration Period

Turbot > Workspace > osquery > Secrets > Rotation

This control is responsible for the automatic rotation of the osquery secret, enhancing security by periodically updating the key used for osquery operations.&#92;nEnabling this feature ensures that your osquery integrations maintain robust security through updated authentication credentials.&#92;n

Turbot

Turbot > Workspace > osquery > Secret Rotation

osquery

osquery1

A calculated policy that contains the osquery configuration that is sent to the osquery node. This configuration often contains options, scheduled queries, decorator queries, and more.&#92;n

Turbot > osquery

osquery Node

Turbot > osquery > Configuration

The osquery policy in your workspace plays a crucial role in controlling access and functionality related to the osquery integration.&#92;nThis policy directly influences the generation of JWT tokens and the availability of specific osquery-related APIs.&#92;n&#92;nIf the policy is set to **Disabled**, the APIs will not be operational, and the system will not generate JWT tokens. This means that you won&#39;t be able to enroll new agents, alter configurations, or log data via osquery until the policy is re-enabled.&#92;n&#92;nEnsure that this policy is enabled if you need to use osquery features within your workspace.&#92;n

The policy specifies the duration after which the JWT token issued by osquery will expire.&#92;n&#92;nThe expiration time is critical for security, ensuring that tokens are not valid indefinitely and reducing the risk of unauthorized access.&#92;n&#92;nYou can set the duration in `Hours` to determine how long before the entity expires. If you require that the entity never expires, you can set the policy to `Never`.&#92;n

The JWT token is signed by Turbot using a secret from `osquery &gt; Secrets`, as set by this&#92;npolicy. This ensures that fake tokens cannot be generated or used.&#92;n&#92;nTurbot sets this policy on installation to complex password unique to your&#92;nworkspace. This is a secure, effective default.&#92;n&#92;nTo ensure secrets work, even during rotation, this policy is defined as an&#92;narray. The first item is the current secret and is used to sign all newly&#92;nissued tokens. Other secrets in the array are used for verifying existing&#92;ntokens only.&#92;n&#92;nosquery Secrets are generally either distributed manually, making them difficult&#92;nto rotate, or managed by Turbot (e.g. with Stacks) and automatically rotated&#92;nper the `Turbot &gt; Workspace &gt; osquery Secrets &gt; Rotation` policy.&#92;n&#92;nIf you wish or need to rotate this secret manually, you should:&#92;n1. Add a new secret as the first item in the array, leaving existing secrets below.&#92;n2. Update the policy to remove old secrets that are no longer valid.&#92;n&#92;nThis policy defines a list of objects, including creation, expiration and&#92;nactive information for each secret. For example:&#92;n```&#92;n[&#92;n  {&#92;n    &quot;secret&quot;: &quot;E!TJ8x4!P15ic=DN&quot;,&#92;n    &quot;created&quot;: &quot;2020-07-28T21:32:27.537Z&quot;,&#92;n    &quot;expiration&quot;: &quot;2021-03-31T00:00:00.000Z&quot;,&#92;n    &quot;isActive&quot;: true&#92;n  }&#92;n]&#92;n```&#92;n

Rotation of osquery JWT tokens should be performed to ensure the `Expiration&#92;nPeriod` is never exceeded. For example, if `osquery &gt; Secrets &gt; Rotation`&#92;nis set to `Enforce: ...` and this policy is set to `1 year`, then osquery&#92;nsecrets will actually be rotated every 6 months or so (half the period).&#92;n

Check or Enforce that `Turbot &gt; Workspace &gt; osquery &gt; Secrets` are being&#92;nper the `Turbot &gt; Workspace &gt; osquery &gt; Secrets &gt; Expiration Period` policy.&#92;nFor example, secrets must be rotated every year.&#92;n&#92;nThis policy is very useful when combined with Turbot&#39;s automatic management&#92;nof event handlers across cloud providers.&#92;n&#92;n&#92;nIf your organization requires continuous rotation of secrets, then use Turbot&#92;nautomation combined with `Enforce: Rotate osquery secret`.&#92;n&#92;nA common (and practical) policy position is having the ability to rotate secrets&#92;nwhen required - as opposed to continuous rotating them. In that case you could&#92;nset this policy to `Check` combined with an expiration period of `Never`.&#92;n

Mod: osquery

Recommended Version

Resource Types

Controls

Policies