Hi @Deepika Jain
This is the single line installation command
# Install Agent Client Collector
# msiexec /i .\agent-client-collector-4.0.0-windows-x64.msi /quiet /qn /norestart ACC_API_KEY=******* ACC_MID=wss://<Ip address>:<port>/ws/events ACC_ALLOW_LIST=TRUE LOCALUSERNAME=SYSTEM
Start-Process msiexec.exe -Wait "/i agent-client-collector-4.0.0-windows-x64.msi /quiet /qn /norestart ACC_API_KEY=******* ACC_MID=wss://<Ip address>:<port>/ws/events ACC_ALLOW_LIST=TRUE LOCALUSERNAME=SYSTEM"
# Install OSQuery
# $msi = "osquery-5.7.0.msi"
# $url = "https://pkg.osquery.io/windows/$msi"
# $dst = "$PSScriptRoot\$msi"
# Write-Host $dst
# Invoke-WebRequest -Uri $url -OutFile $dst
# Start-Process msiexec.exe -Wait "/i $dst /quiet /qn /norestart"
# msiexec /i ".\osquery-5.7.0.msi" /quiet /qn /norestart
Start-Process msiexec.exe -Wait "/i osquery-5.7.0.msi /quiet /qn /norestart"
# Configure osqueryd service
$flags = "--logger_rotate=true
--logger_rotate_size=26214400
--logger_rotate_max_files=1
--watchdog_level=-1
--config_path=C:\Program Files\osquery\osquery-sam.conf"
Set-Content -Path 'C:\Program Files\osquery\osquery.flags.default' -Value "$flags"
$conf = @'
{
"options": {
"config_plugin": "filesystem",
"logger_plugin": "filesystem",
"utc": "true"
},
"schedule": {
"sam_process_info": {
"query": "SELECT name, pid, elapsed_time, start_time, user_time, system_time, username FROM processes p JOIN users u ON u.uid = p.uid WHERE p.elapsed_time != -1 AND u.type != 'special';",
"snapshot" : true,
"interval": 60
},
"system_info": {
"query": "SELECT hostname, cpu_brand, physical_memory FROM system_info;",
"interval": 3600
}
},
"decorators": {
"load": [
"SELECT uuid AS host_uuid FROM system_info;",
"SELECT user AS username FROM logged_in_users ORDER BY time DESC LIMIT 1;"
]
},
"packs": {
"sam-metering": "C:\\ProgramData\\ServiceNow\\agent-client-collector\\cache\\acc-visibility-modules\\bin\\sam-metering.conf"
}
}
'@
Set-Content -Path 'C:\Program Files\osquery\osquery-sam.conf' -Value "$conf"
cd 'C:\Program Files\osquery'
.\manage-osqueryd.ps1 -uninstall
.\manage-osqueryd.ps1 -install
Restart-Service osqueryd
To setup the monitoring, need to click on SetUp Acc monitoring related link.
Course link:-
https://learning.servicenow.com/lxp/en/it-operations-management/agent-client-collector-essentials?id...
Mark it Helpful and Accept Solution!! If this helps you to understand.
