forked from osquery/osquery
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Add hardware/internal (monitoring) packs and reduce FPs, duplicate qu…
…eries
- Loading branch information
Teddy Reed
committed
Nov 27, 2015
1 parent
96b6956
commit 44286eb
Showing
7 changed files
with
142 additions
and
63 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,88 @@ | ||
| { | ||
| "queries": { | ||
| "acpi_tables": { | ||
| "query": "select * from acpi_tables;", | ||
| "interval": 86400, | ||
| "description": "General reporting and heuristics monitoring." | ||
| }, | ||
| "cpuid": { | ||
| "query": "select feature, value, output_register, output_bit, input_eax from cpuid;", | ||
| "interval": 86400, | ||
| "description": "General reporting and heuristics monitoring." | ||
| }, | ||
| "smbios_tables": { | ||
| "query": "select * from smbios_tables;", | ||
| "interval": 86400, | ||
| "description": "General reporting and heuristics monitoring." | ||
| }, | ||
| "nvram": { | ||
| "query": "select * from nvram where name not in ('backlight-level', 'SystemAudioVolumeDB', 'SystemAudioVolume');", | ||
| "interval": 1200, | ||
| "platform": "darwin", | ||
| "description": "Report on crashes, alternate boots, and boot arguments." | ||
| }, | ||
| "kernel_info": { | ||
| "query": "select * from kernel_info join hash using (path);", | ||
| "interval": 7200, | ||
| "description": "Report the booted kernel, potential arguments, and the device." | ||
| }, | ||
| "pci_devices": { | ||
| "query": "select * from pci_devices;", | ||
| "interval": 7200, | ||
| "description": "Report an inventory of PCI devices. Attaches and detaches will show up in hardware_events." | ||
| }, | ||
| "usb_devices": { | ||
| "query": "select * from usb_devices;", | ||
| "interval": 7200, | ||
| "description": "Report an inventory of USB devices. Attaches and detaches will show up in hardware_events." | ||
| }, | ||
| "hardware_events": { | ||
| "query" : "select * from hardware_events where path <> '' or model <> '';", | ||
| "interval" : 7200, | ||
| "removed": false, | ||
| "version" : "1.4.5", | ||
| "description" : "Retrieves all the hardware related events in the target OSX system.", | ||
| "value" : "Determine if a third party device was attached to the system." | ||
| }, | ||
| "darwin_kernel_system_controls": { | ||
| "query": "select * from system_controls where subsystem = 'kern' and (name like '%boot%' or name like '%secure%' or name like '%single%');", | ||
| "interval": 7200, | ||
| "platform": "darwin", | ||
| "description": "Double check the information reported in kernel_info and report the kernel signature." | ||
| }, | ||
| "iokit_devicetree": { | ||
| "query": "select * from iokit_devicetree;", | ||
| "interval": 86400, | ||
| "platform": "darwin", | ||
| "descriptor": "General inventory of IOKit's devices on OS X." | ||
| }, | ||
| "efi_file_hashes": { | ||
| "query": "select file.path, uid, gid, mode, 0 as atime, mtime, ctime, md5, sha1, sha256 from (select * from file where pattern = '/System/Library/CoreServices/*.efi' union select * from file where pattern = '/System/Library/LaunchDaemons/com.apple*{EFI,efi}*') file join hash using (path);", | ||
| "interval": 7200, | ||
| "removed": false, | ||
| "version": "1.6.1", | ||
| "platform": "darwin", | ||
| "description": "Hash files related to EFI platform updates and EFI bootloaders on primary boot partition. This does not hash bootloaders on the EFI/boot partition." | ||
| }, | ||
| "kernel_extensions": { | ||
| "query" : "select * from kernel_extensions;", | ||
| "interval" : "3600", | ||
| "platform" : "darwin", | ||
| "version" : "1.4.5", | ||
| "description" : "Retrieves all the information about the current kernel extensions for the target OSX system." | ||
| }, | ||
| "kernel_modules": { | ||
| "query" : "select * from kernel_modules;", | ||
| "interval" : "3600", | ||
| "platform" : "linux", | ||
| "version" : "1.4.5", | ||
| "description" : "Retrieves all the information for the current kernel modules in the target Linux system." | ||
| }, | ||
| "device_nodes": { | ||
| "query": "select file.path, uid, gid, mode, 0 as atime, mtime, ctime, block_size, mode, type from file where directory = '/dev/';", | ||
| "interval": "600", | ||
| "version": "1.6.0", | ||
| "description": "Inventory all 'device' nodes in /dev/." | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| { | ||
| "queries": { | ||
| "schedule": { | ||
| "query": "select name, interval, executions, output_size, wall_time, (user_time/executions) as avg_user_time, (system_time/executions) as avg_system_time, average_memory, last_executed from osquery_schedule;", | ||
| "interval": 7200, | ||
| "removed": false, | ||
| "version": "1.6.0", | ||
| "description": "Report performance for every query within packs and the general schedule." | ||
| }, | ||
| "events": { | ||
| "query": "select name, publisher, type, subscriptions, events, active from osquery_events;", | ||
| "interval": 86400, | ||
| "removed": false, | ||
| "description": "Report event publisher health and track event counters." | ||
| }, | ||
| "osquery_info": { | ||
| "query": "select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;", | ||
| "interval": 600, | ||
| "removed": false, | ||
| "description": "A heartbeat counter that reports general performance (CPU, memory) and version." | ||
| } | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters