Adoptable Cookbooks List

Looking for a cookbook to adopt? You can now see a list of cookbooks available for adoption!
List of Adoptable Cookbooks

Supermarket Belongs to the Community

Supermarket belongs to the community. While Chef has the responsibility to keep it running and be stewards of its functionality, what it does and how it works is driven by the community. The chef/supermarket repository will continue to be where development of the Supermarket application takes place. Come be part of shaping the direction of Supermarket by opening issues and pull requests or by joining us on the Chef Mailing List.

Select Badges

Select Supported Platforms

Select Status


osquery (17) Versions 1.2.2

Install and configure osquery (

cookbook 'osquery', '= 1.2.2', :supermarket
cookbook 'osquery', '= 1.2.2'
knife supermarket install osquery
knife supermarket download osquery
Quality 0%

osquery chef cookbook

Build Status
Cookbook Version

  • Installs, configures, and starts osquery.
  • Configurations are generated based on node attributes.


  • Chef >= 12.1.0
  • OS X
  • Ubuntu
    • 12.04
    • 14.04
  • Centos/Redhat
    • 6.5+
    • 7.0+

General Attributes


name type default description
['osquery']['version'] String 1.7.4 osquery version to install
['osquery']['packs'] Array %w(incident-response osx-attacks) osquery packs found in files/default/packs/
['osquery']['pack_source'] String osquery cookbook to load osquery packs from
['osquery']['repo']['el6_checksum'] String - SHA256 Hash of the centos6 repo
['osquery']['repo']['el7_checksum'] String - SHA256 Hash of the centos7 repo
['osquery']['repo']['osx_checksum'] String - SHA256 Hash of the os x pkg file
['osquery']['audit']['enabled'] Boolean true flag to enable/disable chef audits

Configuration Attributes


name type default description
['osquery']['options']['config_plugin'] String filesystem configuration plugin
['osquery']['options']['logger_plugin'] String filesystem logger plugin
['osquery']['options']['schedule_splay_percent'] Fixnum 10 query schedule splay percentage
['osquery']['options']['events_expiry'] Fixnum 3600 timeout to expire eventing pubsub results
['osquery']['options']['verbose'] Boolean false enable verbose informational messages
['osquery']['options']['worker_threads'] Fixnum 2 number of work dispatch threads
['osquery']['options']['enable_monitor'] Boolean false enable schedule monitor
['osquery']['syslog']['enabled'] Boolean true enable syslog tables
['osquery']['syslog']['filename'] String /etc/rsyslog.d/60-osquery.conf syslog conf file path

Query Schedule Attributes


name type default description
['osquery']['schedule'] Hash osquery_info and file_events osquery schedule

File Integrity Monitoring Attributes


name type default description
['osquery']['file_paths'] Hash homes, etc, and tmp file paths to monitor events from
['osquery']['fim_enabled'] Boolean false enable/disable file event tracking in config

Custom Resources

osquery_conf: creates osquery config from selected options and packs.


osquery_conf osquery_config_path do
  action :create
  schedule node['osquery']['schedule']
  fim_paths node['osquery']['file_paths']
  packs node['osquery']['packs']
  pack_source node['osquery']['pack_source']


osquery_conf 'delete osquery config' do
  action :delete

osquery_conf attributes:
* action: :create or :delete
* schedule: (required) Hash of scheduled queries to run
* fim_paths: (optional) Hash of file integrity monitoring path descriptions and array of their paths
* packs: (optional) List of osquery packs to install. Based on filenames ending in *.conf in pack_source/packs
* pack_source: (optional) Cookbook source for osquery packs
* The daemon configuration is compiled from the node['osquery']['options'] attributes.


Run $ rake to execute:
* foodcritic
* rubocop
* chefspec

Requirements: VirtualBox with Extension Pack (for the OS X vm)
* $ kitchen list to show integration test suites <br />
* $ kitchen converge to run test suites

Note: Audit mode is enabled in the Kitchen yaml by default. The tests are found in ./recipes/audit.rb and run post converge. To disable, override the node['osquery']['audit']['enabled'] attribute to false.


  • Include osquery in your node's run_list
  • Override attributes to fit your desired setup


  1. Fork the repository on Github.
  2. Create a named feature branch (like add_component_x).
  3. Write your change.
  4. Write tests for your change.
  5. Run the tests, ensuring they all pass (rubocop; rspec).
  6. Submit a Pull Request using Github.

License and Authors

Copyright 2013-2014 Jack Naglieri <>

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
See the License for the specific language governing permissions and
limitations under the License.

Dependent cookbooks

apt >= 0.0.0
compat_resource >= 0.0.0

Contingent cookbooks

There are no cookbooks that are contingent upon this one.


This file is used to list changes made in each version of the osquery cookbook.


  • [jack naglieri] - Initial release of osquery


  • [jack naglieri] - Dynamic osquery config template

Check the Markdown Syntax Guide for help with Markdown.

The Github Flavored Markdown page describes the differences between markdown on github and standard markdown.

Foodcritic Metric

1.2.2 failed this metric

FC024: Consider adding platform equivalents: /tmp/cook/0c39e377655870d6e18637e7/osquery/libraries/helpers.rb:19
FC024: Consider adding platform equivalents: /tmp/cook/0c39e377655870d6e18637e7/osquery/libraries/helpers.rb:28
FC024: Consider adding platform equivalents: /tmp/cook/0c39e377655870d6e18637e7/osquery/libraries/helpers.rb:37
FC024: Consider adding platform equivalents: /tmp/cook/0c39e377655870d6e18637e7/osquery/recipes/audit.rb:45