Monitoring

Aquilon DLP exposes findings through osquery tables, enabling powerful querying, alerting, and integration with existing security infrastructure.

osquery Tables

Aquilon DLP provides the following table for monitoring:

For complete table schema and triage workflow, see OSQuery Integration.

Querying Alerts

Basic Queries

View recent alerts:

<!--SETUP
/init-services.sh && cp /var/test-data/sample-data.csv /var/watch/test1.csv
-->
SELECT * FROM aquilon_dlp_alerts
ORDER BY timestamp DESC
LIMIT 10;
<!--ASSERT 
rows >= 0 
-->

View alerts for specific file:

<!--SETUP
/init-services.sh && cp /var/test-data/sample-data.csv /var/watch/specific-file-test.csv
-->
SELECT policy, severity, data_type, pattern
FROM aquilon_dlp_alerts
WHERE path LIKE '%specific-file-test%';
<!--ASSERT
rows >= 0
-->

View alerts from last 24 hours:

<!--SETUP
/init-services.sh
-->
SELECT * FROM aquilon_dlp_alerts
WHERE timestamp > (strftime('%s', 'now') - 86400);
<!--ASSERT 
rows >= 0 
-->

Analyzing Patterns

Count alerts by policy:

<!--SETUP
/init-services.sh
-->
SELECT policy, COUNT(*) as alert_count
FROM aquilon_dlp_alerts
GROUP BY policy
ORDER BY alert_count DESC;
<!--ASSERT
rows >= 0
-->

Count alerts by severity:

<!--SETUP
/init-services.sh
-->
SELECT severity, COUNT(*) as count
FROM aquilon_dlp_alerts
GROUP BY severity
ORDER BY
  CASE severity
    WHEN 'critical' THEN 1
    WHEN 'high' THEN 2
    WHEN 'medium' THEN 3
    WHEN 'low' THEN 4
  END;
<!--ASSERT 
rows >= 0 
-->

Find most affected directories:

<!--SETUP
/init-services.sh
-->
SELECT
  rtrim(path, replace(path, '/', '')) as directory,
  COUNT(*) as alert_count
FROM aquilon_dlp_alerts
GROUP BY directory
ORDER BY alert_count DESC
LIMIT 10;
<!--ASSERT 
rows >= 0 
-->

View data types found:

<!--SETUP
/init-services.sh
-->
SELECT data_type, COUNT(*) as count
FROM aquilon_dlp_alerts
GROUP BY data_type
ORDER BY count DESC;
<!--ASSERT 
rows >= 0 
-->

Investigation Queries

Find all alerts for a specific user:

<!--SETUP
/init-services.sh
-->
SELECT * FROM aquilon_dlp_alerts
WHERE path LIKE '/var/watch/%'
ORDER BY timestamp DESC;
<!--ASSERT 
rows >= 0 
-->

Find files with multiple policy violations:

<!--SETUP
/init-services.sh
-->
SELECT path, COUNT(DISTINCT policy) as policy_count
FROM aquilon_dlp_alerts
GROUP BY path
HAVING policy_count > 1
ORDER BY policy_count DESC;
<!--ASSERT
rows >= 0
-->

Find high-severity alerts with multiple findings:

<!--SETUP
/init-services.sh
-->
SELECT path, policy, data_type, confidence
FROM aquilon_dlp_alerts
WHERE severity IN ('critical', 'high')
ORDER BY timestamp DESC
LIMIT 20;
<!--ASSERT
rows >= 0
-->

Alert Fields

The aquilon_dlp_alerts table contains these fields:

For details on the JSON column structure and querying, see OSQuery Integration.

<!--SETUP
/init-services.sh
-->
SELECT id, timestamp, path, scanner, severity, policy, data_type,
       pattern, confidence, match_count, frameworks, triage_status,
       triage, context
FROM aquilon_dlp_alerts LIMIT 0;

Alert Triage

Aquilon DLP supports updating alert triage status directly through OSQuery UPDATE statements. This allows security analysts to acknowledge, investigate, and resolve alerts.

Triage Status Values

Example Triage Queries

View alerts needing review:

<!--SETUP
/init-services.sh && cp /var/test-data/sample-data.csv /var/watch/triage-test.csv
-->
SELECT path, scanner, severity, policy
FROM aquilon_dlp_alerts
WHERE triage_status = 'new'
ORDER BY severity DESC;
<!--ASSERT
rows >= 0
-->

Acknowledge an alert:

<!--SETUP
/init-services.sh && cp /var/test-data/sample-data.csv /var/watch/ack-test.csv
-->
UPDATE aquilon_dlp_alerts
SET triage_status = 'acknowledged',
    triage = JSON_OBJECT('owner', 'analyst@company.com')
WHERE path LIKE '%ack-test%';

Resolve an alert:

<!--SETUP
/init-services.sh
-->
UPDATE aquilon_dlp_alerts
SET triage_status = 'resolved',
    triage = JSON_OBJECT('comment', 'File removed from system')
WHERE path LIKE '%ack-test%';

For complete triage workflow documentation, see OSQuery Integration.

Log Analysis

Log Locations

Viewing Logs

Real-time log monitoring:

# macOS/Linux
tail -f /var/log/aquilon/aquilon-dlp.log

Filter for errors:

grep -i error /var/log/aquilon/aquilon-dlp.log

Filter for specific file:

grep "document.pdf" /var/log/aquilon/aquilon-dlp.log

Log Levels

Configure log level using the RUST_LOG environment variable:

# Set log level
export RUST_LOG=info

# Available levels: error, warn, info, debug, trace

SIEM Integration

JSON Log Format

Configure JSON logs for SIEM ingestion using environment variables:

# Set log level and format
export RUST_LOG=info

# Logs are written to stdout in structured JSON format
# Redirect output as needed for your SIEM

The application uses the tracing crate which outputs structured JSON fields for easy parsing when configured appropriately in your init system.

osquery Fleet Management

Aquilon DLP integrates with osquery fleet management tools:

• Fleet - kolide/fleet or fleetdm
• Kolide - kolide.com
• osquery directly - via distributed queries

Example distributed query:

<!--SETUP
/init-services.sh
-->
SELECT * FROM aquilon_dlp_alerts
WHERE severity IN ('critical', 'high')
AND timestamp > (strftime('%s', 'now') - 3600);
<!--ASSERT 
rows >= 0 
-->

Splunk Integration

Forward osquery results to Splunk:

1. Configure osquery logger to file
2. Use Splunk Universal Forwarder to ingest logs
3. Create dashboards for DLP alerts

Example Splunk query:

index=osquery sourcetype=osquery:results name=aquilon_dlp_alerts
| stats count by policy, severity

Elastic Stack Integration

Forward to Elasticsearch:

1. Configure osquery with Kafka or file logger
2. Use Filebeat/Logstash to ingest
3. Create Kibana dashboards

Alerting

osquery Scheduled Queries

Schedule regular alert checks:

{
  "schedule": {
    "dlp_critical_alerts": {
      "query": "SELECT * FROM aquilon_dlp_alerts WHERE severity = 'critical' AND triage_status = 'new'",
      "interval": 300
    }
  }
}

External Alerting

Integrate with external systems by:

1. Using osquery scheduled queries to export results
2. Configuring SIEM to forward alerts to PagerDuty/Slack
3. Triggering SOAR playbooks on critical alerts

Performance Metrics

System Resource Usage

Monitor Aquilon DLP resource consumption:

• Memory usage: Check process memory
• CPU usage: Monitor during active scanning
• Disk I/O: Cache database writes

# macOS/Linux - find Aquilon DLP process
ps aux | grep aquilon

# Watch resource usage
top -p $(pgrep aquilon)

Operational Dashboards

Key Metrics to Track

Example Dashboard Queries

Alerts by policy:

<!--SETUP
/init-services.sh
-->
SELECT policy, COUNT(*) as count
FROM aquilon_dlp_alerts
GROUP BY policy
ORDER BY count DESC
LIMIT 5;
<!--ASSERT
rows >= 0
-->

Triage status summary:

<!--SETUP
/init-services.sh
-->
SELECT triage_status, COUNT(*) as count
FROM aquilon_dlp_alerts
GROUP BY triage_status;
<!--ASSERT 
rows >= 0 
-->

Health Checks

Verify Extension Loading

<!--SETUP
/init-services.sh
-->
SELECT * FROM osquery_extensions
WHERE name LIKE '%aquilon%';
<!--ASSERT 
rows >= 0 
-->

Verify Table Availability

<!--SETUP
/init-services.sh
-->
PRAGMA table_info(aquilon_dlp_alerts);
<!--ASSERT 
rows >= 0 
-->

Test Query

osqueryi --connect /var/osquery/osquery.sock 'SELECT COUNT(*) as alert_count FROM aquilon_dlp_alerts;'

Troubleshooting Monitoring

No Data in Tables

1. Verify extension is loaded:

   <!--SETUP
   /init-services.sh
   -->
   SELECT * FROM osquery_extensions;
   <!--ASSERT 
   rows >= 0
   -->
   

2. Check osquery logs:

   journalctl -u osqueryd -f
   

3. Verify configuration is loaded:

   cat /etc/aquilon/config.toml
   

Stale Data

1. Check if files are being monitored (watch paths configured)
2. Verify cache isn’t returning old results
3. Check system time is correct

Performance Issues

1. Reduce log verbosity
2. Increase cache TTL
3. Adjust concurrent scan limits
4. Review excluded paths

See Configuration for performance tuning options.