Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 19 Packages Projects Releases Wiki Activity

Add RHEL 8/9/10 simulated hosts to osquery-perf (#44453)

Browse Source
This commit is contained in:
Tim Lee
2026-04-30 11:01:04 -06:00
committed by GitHub
parent b80b2e1050
commit 13cec63bd1
8 changed files with 915 additions and 25 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/osquery-perf/README.md
+5 -1
View File
@@ -54,7 +54,11 @@ By default, all hosts will simulate macOS hosts (specifically, macOS 10.14). To
go run agent.go --enroll_secret hgh4hk3434l2jjf --os_templates ubuntu_22.04,windows_11 --host_count 6
```
would start 3 Ubuntu hosts and 3 Windows hosts. See the `os_templates` flag description in `go run agent.go --help` for the list of supported template names.
would start 3 Ubuntu hosts and 3 Windows hosts.
Supported Linux templates: `ubuntu_22.04`, `rhel_8`, `rhel_9`, `rhel_10`. RHEL templates report `platform=rhel`, RPM-style kernels (e.g., `kernel-core 5.14.0-503.26.1.el9_5`), and (when `--software_db_path` points at a populated database) additional RPM packages from the software library. See the `os_templates` flag description in `go run agent.go --help` for the full list of supported template names.
The software database (`cmd/osquery-perf/software-library/software.db`) is optional — macOS, Windows, and Ubuntu have embedded fallback fixtures, and RHEL kernels are embedded too. The DB only adds non-kernel software variety. If the DB isn't present at `--software_db_path`, osquery-perf logs a warning and falls back to the embedded fixtures.
## Controlling Agent Behavior From the Fleet UI
cmd/osquery-perf/agent.go
+181 -24
View File
@@ -63,6 +63,12 @@ var (
ubuntuSoftwareFS embed.FS
//go:embed ubuntu_2204-kernels.json
ubuntuKernelsFS embed.FS
//go:embed rhel_8-kernels.json
rhel8KernelsFS embed.FS
//go:embed rhel_9-kernels.json
rhel9KernelsFS embed.FS
//go:embed rhel_10-kernels.json
rhel10KernelsFS embed.FS
//go:embed windows_11-software.json.bz2
windowsSoftwareFS embed.FS
@@ -70,7 +76,15 @@ var (
vsCodeExtensionsVulnerableSoftware []fleet.Software
windowsSoftware []map[string]string
ubuntuSoftware []map[string]string
ubuntuKernels []string
ubuntuKernels []map[string]string
rhel8Kernels []map[string]string
rhel9Kernels []map[string]string
rhel10Kernels []map[string]string
// softwareDBRPM caches a one-time filtered slice of softwareDB.Ubuntu where
// Source == "rpm_packages", reused by RHEL agents.
softwareDBRPMOnce sync.Once
softwareDBRPM []softwaredb.UbuntuSoftware
// Software library database (loaded from SQLite if --software_db_path is specified)
softwareDB *softwaredb.DB
@@ -153,17 +167,114 @@ func loadSoftwareItems(fs embed.FS, path string, source string) []map[string]str
return softwareRows
}
func loadKernelList(fs embed.FS, path string) []string {
// loadDebKernelList reads a JSON array of deb-style kernel package names
// (e.g., "linux-image-6.8.0-51-generic") and returns kernel records with
// name, version (the suffix after "linux-image-"), and source="deb_packages".
func loadDebKernelList(fs embed.FS, path string) []map[string]string {
data, err := fs.ReadFile(path)
if err != nil {
panic(err)
}
var kernels []string
if err := json.Unmarshal(data, &kernels); err != nil {
var names []string
if err := json.Unmarshal(data, &names); err != nil {
panic(err)
}
kernels := make([]map[string]string, 0, len(names))
for _, name := range names {
kernels = append(kernels, map[string]string{
"name": name,
"version": strings.TrimPrefix(name, "linux-image-"),
"source": "deb_packages",
})
}
return kernels
}
// loadSoftwareDBRPM returns a one-time filtered slice of softwareDB.Ubuntu
// where Source == "rpm_packages". Returns nil if no software DB is loaded.
func loadSoftwareDBRPM() []softwaredb.UbuntuSoftware {
if softwareDB == nil {
return nil
}
softwareDBRPMOnce.Do(func() {
filtered := make([]softwaredb.UbuntuSoftware, 0, len(softwareDB.Ubuntu)/4)
for _, s := range softwareDB.Ubuntu {
if s.Source == "rpm_packages" {
filtered = append(filtered, s)
}
}
softwareDBRPM = filtered
})
return softwareDBRPM
}
// rpmSliceToMaps converts UbuntuSoftware entries at the given indices to
// osquery result maps. Mirrors softwaredb.DB.UbuntuToMaps but operates on a
// caller-provided slice (the RPM-only filtered subset).
func rpmSliceToMaps(pool []softwaredb.UbuntuSoftware, indices []uint32) []map[string]string {
results := make([]map[string]string, 0, len(indices))
for _, idx := range indices {
if int(idx) >= len(pool) {
continue
}
s := pool[idx]
m := map[string]string{
"name": s.Name,
"source": s.Source,
"version": s.Version,
}
if s.Vendor != nil {
m["vendor"] = *s.Vendor
}
if s.Arch != nil {
m["arch"] = *s.Arch
}
if s.Release != nil {
m["release"] = *s.Release
}
results = append(results, m)
}
return results
}
// loadRPMKernelList reads a JSON array of objects with name/version/release
// (and optional vendor/arch) and returns kernel records stamped with
// source="rpm_packages".
func loadRPMKernelList(fs embed.FS, path string) []map[string]string {
data, err := fs.ReadFile(path)
if err != nil {
panic(err)
}
var entries []struct {
Name string `json:"name"`
Version string `json:"version"`
Release string `json:"release"`
Vendor string `json:"vendor"`
Arch string `json:"arch"`
}
if err := json.Unmarshal(data, &entries); err != nil {
panic(err)
}
kernels := make([]map[string]string, 0, len(entries))
for _, e := range entries {
entry := map[string]string{
"name": e.Name,
"version": e.Version,
"release": e.Release,
"source": "rpm_packages",
}
if e.Vendor != "" {
entry["vendor"] = e.Vendor
}
if e.Arch != "" {
entry["arch"] = e.Arch
}
kernels = append(kernels, entry)
}
return kernels
}
@@ -172,7 +283,10 @@ func init() {
loadExtraVulnerableSoftware()
windowsSoftware = loadSoftwareItems(windowsSoftwareFS, "windows_11-software.json.bz2", "programs")
ubuntuSoftware = loadSoftwareItems(ubuntuSoftwareFS, "ubuntu_2204-software.json.bz2", "deb_packages")
ubuntuKernels = loadKernelList(ubuntuKernelsFS, "ubuntu_2204-kernels.json")
ubuntuKernels = loadDebKernelList(ubuntuKernelsFS, "ubuntu_2204-kernels.json")
rhel8Kernels = loadRPMKernelList(rhel8KernelsFS, "rhel_8-kernels.json")
rhel9Kernels = loadRPMKernelList(rhel9KernelsFS, "rhel_9-kernels.json")
rhel10Kernels = loadRPMKernelList(rhel10KernelsFS, "rhel_10-kernels.json")
}
type nodeKeyManager struct {
@@ -521,9 +635,10 @@ func newAgent(
// validTemplateNames below for the list of possible names, the OS is always
// the part before the underscore). Note that it is the OS and not the
// "normalized" platform, so "ubuntu" and not "linux", "macos" and not
// "darwin".
agentOS := strings.TrimRight(templates.Name(), ".tmpl")
agentOS, _, _ = strings.Cut(agentOS, "_")
// "darwin". osVariant is the part after the underscore, e.g., "8" / "9" /
// "10" for RHEL templates, used to pick the right kernel list.
templateBase := strings.TrimSuffix(templates.Name(), ".tmpl")
agentOS, osVariant, _ := strings.Cut(templateBase, "_")
var (
macMDMClient *mdmtest.TestAppleMDMClient
@@ -619,9 +734,19 @@ func newAgent(
AgentIndex: agentIndex,
}, useHTTPSig, httpMessageSignatureP384Prob)
// Pre-select kernels for Ubuntu agents to ensure consistency across queries
if agentOS == "ubuntu" {
// Pre-select kernels for Linux agents to ensure consistency across queries
switch agentOS {
case "ubuntu":
agent.linuxKernels = selectKernels(ubuntuKernels)
case "rhel":
switch osVariant {
case "8":
agent.linuxKernels = selectKernels(rhel8Kernels)
case "9":
agent.linuxKernels = selectKernels(rhel9Kernels)
case "10":
agent.linuxKernels = selectKernels(rhel10Kernels)
}
}
return agent
@@ -2212,7 +2337,7 @@ func (a *agent) softwareVSCodeExtensions() []map[string]string {
return software
}
func selectKernels(kernelList []string) []map[string]string {
func selectKernels(kernelList []map[string]string) []map[string]string {
// Determine number of kernels based on probability distribution
r := rand.Float64()
var numKernels int
@@ -2242,15 +2367,11 @@ func selectKernels(kernelList []string) []map[string]string {
kernels := make([]map[string]string, 0, numKernels)
for i := 0; i < numKernels && i < len(indices); i++ {
kernelName := kernelList[indices[i]]
// Extract version from name (remove "linux-image-" prefix)
version := strings.TrimPrefix(kernelName, "linux-image-")
kernels = append(kernels, map[string]string{
"name": kernelName,
"version": version,
"source": "deb_packages",
})
// Copy the map so callers cannot mutate the shared package-level slice.
src := kernelList[indices[i]]
entry := make(map[string]string, len(src))
maps.Copy(entry, src)
kernels = append(kernels, entry)
}
return kernels
@@ -3111,7 +3232,7 @@ func (a *agent) processQuery(name, query string, cachedResults *cachedResults) (
ss = fleet.OsqueryStatus(1)
}
if ss == fleet.StatusOK {
switch a.os { //nolint:gocritic // ignore singleCaseSwitch
switch a.os {
case "ubuntu":
// Use database software 80% of the time if available, otherwise use embedded data
if softwareDB != nil && len(softwareDB.Ubuntu) > 0 && rand.Float64() < 0.8 { // nolint:gosec,G404 // load testing, not security-sensitive
@@ -3160,6 +3281,34 @@ func (a *agent) processQuery(name, query string, cachedResults *cachedResults) (
results = append(results, value.(map[string]string))
return true
})
case "rhel":
// RHEL agents use the rpm_packages rows from the software DB
// (filtered once on first use). When the DB is unavailable, only
// kernels and per-host installed software are reported, which is
// sufficient for kernel-CVE load testing.
rpmPool := loadSoftwareDBRPM()
if len(rpmPool) > 0 {
if a.cachedSoftwareIndices == nil {
count := min(softwaredb.RandomSoftwareCount("ubuntu"), len(rpmPool))
perm := rand.Perm(len(rpmPool))
a.cachedSoftwareIndices = make([]uint32, count)
for i := range count {
a.cachedSoftwareIndices[i] = uint32(perm[i]) //nolint:gosec // perm[i] is bounded by len(rpmPool)
}
} else {
a.cachedSoftwareIndices = softwaredb.MaybeMutateSoftware(a.cachedSoftwareIndices, len(rpmPool))
}
results = rpmSliceToMaps(rpmPool, a.cachedSoftwareIndices)
}
// Add pre-selected kernels for this agent
results = append(results, a.linuxKernels...)
a.installedSoftware.Range(func(key, value any) bool {
results = append(results, value.(map[string]string))
return true
})
}
}
return true, results, &ss, nil, nil
@@ -3505,6 +3654,9 @@ func main() {
"windows_11_22H2_2861.tmpl": true,
"windows_11_22H2_3007.tmpl": true,
"ubuntu_22.04.tmpl": true,
"rhel_8.tmpl": true,
"rhel_9.tmpl": true,
"rhel_10.tmpl": true,
"iphone_14.6.tmpl": true,
"ipad_13.18.tmpl": true,
}
@@ -3618,13 +3770,18 @@ func main() {
flag.Parse()
rand.Seed(*randSeed)
// Load software from database if path provided
// Load software from database if path provided. macOS / Windows / Ubuntu
// have embedded fallback fixtures, and RHEL kernels are embedded too — the
// DB only adds non-kernel RPM/DEB variety. Treat load failure as a warning
// rather than fatal so running from the repo root (where the default
// relative path doesn't resolve) still works.
if *softwareDatabasePath != "" {
db, err := softwaredb.LoadFromDatabase(*softwareDatabasePath)
if err != nil {
log.Fatalf("Failed to load software database: %v", err)
log.Printf("WARNING: failed to load software database (%v); falling back to embedded software data", err)
} else {
softwareDB = db
}
softwareDB = db
} else {
log.Println("No software database specified (--software_db_path). Using embedded software data.")
}
cmd/osquery-perf/rhel_10-kernels.json
+27
View File
@@ -0,0 +1,27 @@
[
{"name": "kernel", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules-core", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules-extra", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "6.12.0", "release": "55.7.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules-core", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-devel", "version": "6.12.0", "release": "55.4.1.el10_0", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules-core", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-debug", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-debug-core", "version": "6.12.0", "release": "55.el10", "vendor": "Red Hat, Inc.", "arch": "x86_64"}
]
cmd/osquery-perf/rhel_10.tmpl
+207
View File
@@ -0,0 +1,207 @@
{{ define "enroll" -}}
{
"enroll_secret": "{{ .EnrollSecret }}",
"host_details": {
"os_version": {
"arch": "x86_64",
"build": "",
"codename": "",
"major": "10",
"minor": "0",
"name": "Red Hat Enterprise Linux",
"patch": "0",
"platform": "rhel",
"platform_like": "rhel",
"version": "Red Hat Enterprise Linux release 10.0 (Coughlan)"
},
"osquery_info": {
"build_distro": "centos7",
"build_platform": "linux",
"config_hash": "",
"config_valid": "0",
"extensions": "inactive",
"instance_id": "{{ .UUID }}",
"pid": "12947",
"platform_mask": "21",
"start_time": "1580931224",
"uuid": "{{ .UUID }}",
"version": "5.5.1",
"watcher": "-1"
},
"platform_info": {
},
"system_info": {
"computer_name": "{{ .CachedString "hostname" }}",
"cpu_brand": "AMD EPYC 9554 64-Core Processor",
"cpu_logical_cores": "16",
"cpu_physical_cores": "8",
"cpu_subtype": "AMD64",
"cpu_type": "x86_64",
"hardware_model": "PowerEdge R760",
"hardware_serial": "{{ .SerialNumber }}",
"hardware_vendor": "Dell Inc.",
"hardware_version": "1.0",
"hostname": "{{ .CachedString "hostname" }}",
"local_hostname": "{{ .CachedString "hostname" }}",
"physical_memory": "34359738368",
"uuid": "{{ .UUID }}"
}
},
"host_identifier": "{{ .UUID }}",
"platform_type": "16"
}
{{- end }}
{{ define "fleet_detail_query_network_interface_unix" -}}
[
{
"address":"fe80::8cb:112d:ff51:1e5d%en0",
"mac":"f8:2d:88:93:56:5c"
}
]
{{- end }}
{{ define "fleet_detail_query_os_version" -}}
[
{
"arch": "x86_64",
"build": "",
"codename": "",
"major": "10",
"minor": "0",
"name": "Red Hat Enterprise Linux",
"patch": "0",
"platform": "rhel",
"platform_like": "rhel",
"version": "Red Hat Enterprise Linux release 10.0 (Coughlan)"
}
]
{{- end }}
{{ define "fleet_detail_query_os_unix_like" -}}
[
{
"name":"Red Hat Enterprise Linux",
"version":"Red Hat Enterprise Linux release 10.0 (Coughlan)",
"major":"10",
"minor":"0",
"patch":"0",
"build":"",
"extra":"",
"platform":"rhel",
"arch":"x86_64",
"kernel_version":"6.12.0-55.7.1.el10_0.x86_64"
}
]
{{- end }}
{{ define "fleet_detail_query_osquery_flags" -}}
[
{
"name":"config_refresh",
"value":"{{ printf "%.0f" .ConfigInterval.Seconds }}"
},
{
"name":"distributed_interval",
"value":"{{ printf "%.0f" .QueryInterval.Seconds }}"
},
{
"name":"logger_tls_period",
"value":"99999"
}
]
{{- end }}
{{ define "fleet_detail_query_osquery_info" -}}
[
{
"pid":"11287",
"uuid":"{{ .UUID }}",
"instance_id":"{{ .UUID }}",
"version":"5.5.1",
"config_hash":"b01efbf375ac6767f259ae98751154fef727ce35",
"config_valid":"1",
"extensions":"inactive",
"build_platform":"linux",
"build_distro":"centos7",
"start_time":"1582857555",
"watcher":"-1",
"platform_mask":"9"
}
]
{{- end }}
{{ define "fleet_detail_query_system_info" -}}
[
{
"hostname":"{{ .CachedString "hostname" }}",
"uuid":"{{ .UUID }}",
"cpu_type":"x86_64",
"cpu_subtype":"AMD64",
"cpu_brand":"AMD EPYC 9554 64-Core Processor",
"cpu_physical_cores":"8",
"cpu_logical_cores":"16",
"cpu_microcode":"",
"physical_memory":"34359738368",
"hardware_vendor":"Dell Inc.",
"hardware_model":"PowerEdge R760",
"hardware_version":"1.0",
"hardware_serial":"{{ .SerialNumber }}",
"computer_name":"{{ .CachedString "hostname" }}",
"local_hostname":"{{ .CachedString "hostname" }}"
}
]
{{- end }}
{{ define "fleet_detail_query_uptime" -}}
[
{
"days":"0",
"hours":"4",
"minutes":"38",
"seconds":"11",
"total_seconds":"16691"
}
]
{{- end }}
{{/* all hosts */}}
{{ define "fleet_label_query_6" -}}
[
{
"1": "1"
}
]
{{- end }}
{{/* All macOS hosts */}}
{{ define "fleet_label_query_7" -}}
[]
{{- end }}
{{/* All Ubuntu hosts */}}
{{ define "fleet_label_query_8" -}}
[]
{{- end }}
{{/* All CentOS hosts */}}
{{ define "fleet_label_query_9" -}}
[]
{{- end }}
{{/* All Windows hosts */}}
{{ define "fleet_label_query_10" -}}
[]
{{- end }}
{{/* All Red Hat hosts */}}
{{ define "fleet_label_query_11" -}}
[
{
"1": "1"
}
]
{{- end }}
{{/* All Linux distributions */}}
{{ define "fleet_label_query_12" -}}
[
{
"1": "1"
}
]
{{- end }}
cmd/osquery-perf/rhel_8-kernels.json
+37
View File
@@ -0,0 +1,37 @@
[
{"name": "kernel", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules-extra", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "4.18.0", "release": "553.30.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-devel", "version": "4.18.0", "release": "553.27.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "4.18.0", "release": "553.22.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-debug", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-debug-core", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-debug-modules", "version": "4.18.0", "release": "553.16.1.el8_10", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "4.18.0", "release": "513.24.1.el8_9", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "4.18.0", "release": "477.27.1.el8_8", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "4.18.0", "release": "477.27.1.el8_8", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "4.18.0", "release": "477.27.1.el8_8", "vendor": "Red Hat, Inc.", "arch": "x86_64"}
]
cmd/osquery-perf/rhel_8.tmpl
+207
View File
@@ -0,0 +1,207 @@
{{ define "enroll" -}}
{
"enroll_secret": "{{ .EnrollSecret }}",
"host_details": {
"os_version": {
"arch": "x86_64",
"build": "",
"codename": "",
"major": "8",
"minor": "10",
"name": "Red Hat Enterprise Linux",
"patch": "0",
"platform": "rhel",
"platform_like": "rhel",
"version": "Red Hat Enterprise Linux release 8.10 (Ootpa)"
},
"osquery_info": {
"build_distro": "centos7",
"build_platform": "linux",
"config_hash": "",
"config_valid": "0",
"extensions": "inactive",
"instance_id": "{{ .UUID }}",
"pid": "12947",
"platform_mask": "21",
"start_time": "1580931224",
"uuid": "{{ .UUID }}",
"version": "5.5.1",
"watcher": "-1"
},
"platform_info": {
},
"system_info": {
"computer_name": "{{ .CachedString "hostname" }}",
"cpu_brand": "Intel(R) Xeon(R) CPU E5-2670 v3 @ 2.30GHz",
"cpu_logical_cores": "8",
"cpu_physical_cores": "4",
"cpu_subtype": "Intel x86-64h Haswell",
"cpu_type": "x86_64h",
"hardware_model": "PowerEdge R640",
"hardware_serial": "{{ .SerialNumber }}",
"hardware_vendor": "Dell Inc.",
"hardware_version": "1.0",
"hostname": "{{ .CachedString "hostname" }}",
"local_hostname": "{{ .CachedString "hostname" }}",
"physical_memory": "17179869184",
"uuid": "{{ .UUID }}"
}
},
"host_identifier": "{{ .UUID }}",
"platform_type": "16"
}
{{- end }}
{{ define "fleet_detail_query_network_interface_unix" -}}
[
{
"address":"fe80::8cb:112d:ff51:1e5d%en0",
"mac":"f8:2d:88:93:56:5c"
}
]
{{- end }}
{{ define "fleet_detail_query_os_version" -}}
[
{
"arch": "x86_64",
"build": "",
"codename": "",
"major": "8",
"minor": "10",
"name": "Red Hat Enterprise Linux",
"patch": "0",
"platform": "rhel",
"platform_like": "rhel",
"version": "Red Hat Enterprise Linux release 8.10 (Ootpa)"
}
]
{{- end }}
{{ define "fleet_detail_query_os_unix_like" -}}
[
{
"name":"Red Hat Enterprise Linux",
"version":"Red Hat Enterprise Linux release 8.10 (Ootpa)",
"major":"8",
"minor":"10",
"patch":"0",
"build":"",
"extra":"",
"platform":"rhel",
"arch":"x86_64",
"kernel_version":"4.18.0-553.30.1.el8_10.x86_64"
}
]
{{- end }}
{{ define "fleet_detail_query_osquery_flags" -}}
[
{
"name":"config_refresh",
"value":"{{ printf "%.0f" .ConfigInterval.Seconds }}"
},
{
"name":"distributed_interval",
"value":"{{ printf "%.0f" .QueryInterval.Seconds }}"
},
{
"name":"logger_tls_period",
"value":"99999"
}
]
{{- end }}
{{ define "fleet_detail_query_osquery_info" -}}
[
{
"pid":"11287",
"uuid":"{{ .UUID }}",
"instance_id":"{{ .UUID }}",
"version":"5.5.1",
"config_hash":"b01efbf375ac6767f259ae98751154fef727ce35",
"config_valid":"1",
"extensions":"inactive",
"build_platform":"linux",
"build_distro":"centos7",
"start_time":"1582857555",
"watcher":"-1",
"platform_mask":"9"
}
]
{{- end }}
{{ define "fleet_detail_query_system_info" -}}
[
{
"hostname":"{{ .CachedString "hostname" }}",
"uuid":"{{ .UUID }}",
"cpu_type":"x86_64h",
"cpu_subtype":"Intel x86-64h Haswell",
"cpu_brand":"Intel(R) Xeon(R) CPU E5-2670 v3 @ 2.30GHz",
"cpu_physical_cores":"4",
"cpu_logical_cores":"8",
"cpu_microcode":"",
"physical_memory":"17179869184",
"hardware_vendor":"Dell Inc.",
"hardware_model":"PowerEdge R640",
"hardware_version":"1.0",
"hardware_serial":"{{ .SerialNumber }}",
"computer_name":"{{ .CachedString "hostname" }}",
"local_hostname":"{{ .CachedString "hostname" }}"
}
]
{{- end }}
{{ define "fleet_detail_query_uptime" -}}
[
{
"days":"0",
"hours":"4",
"minutes":"38",
"seconds":"11",
"total_seconds":"16691"
}
]
{{- end }}
{{/* all hosts */}}
{{ define "fleet_label_query_6" -}}
[
{
"1": "1"
}
]
{{- end }}
{{/* All macOS hosts */}}
{{ define "fleet_label_query_7" -}}
[]
{{- end }}
{{/* All Ubuntu hosts */}}
{{ define "fleet_label_query_8" -}}
[]
{{- end }}
{{/* All CentOS hosts */}}
{{ define "fleet_label_query_9" -}}
[]
{{- end }}
{{/* All Windows hosts */}}
{{ define "fleet_label_query_10" -}}
[]
{{- end }}
{{/* All Red Hat hosts */}}
{{ define "fleet_label_query_11" -}}
[
{
"1": "1"
}
]
{{- end }}
{{/* All Linux distributions */}}
{{ define "fleet_label_query_12" -}}
[
{
"1": "1"
}
]
{{- end }}
cmd/osquery-perf/rhel_9-kernels.json
+44
View File
@@ -0,0 +1,44 @@
[
{"name": "kernel", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules-core", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules-extra", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "5.14.0", "release": "611.8.1.el9_7", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules-core", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-devel", "version": "5.14.0", "release": "570.39.1.el9_6", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules-core", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "5.14.0", "release": "503.38.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules-core", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-debug", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-debug-core", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-debug-modules", "version": "5.14.0", "release": "503.26.1.el9_5", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-tools-libs", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-headers", "version": "5.14.0", "release": "427.50.1.el9_4", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel", "version": "5.14.0", "release": "362.24.1.el9_3", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-core", "version": "5.14.0", "release": "362.24.1.el9_3", "vendor": "Red Hat, Inc.", "arch": "x86_64"},
{"name": "kernel-modules", "version": "5.14.0", "release": "362.24.1.el9_3", "vendor": "Red Hat, Inc.", "arch": "x86_64"}
]
cmd/osquery-perf/rhel_9.tmpl
+207
View File
@@ -0,0 +1,207 @@
{{ define "enroll" -}}
{
"enroll_secret": "{{ .EnrollSecret }}",
"host_details": {
"os_version": {
"arch": "x86_64",
"build": "",
"codename": "",
"major": "9",
"minor": "4",
"name": "Red Hat Enterprise Linux",
"patch": "0",
"platform": "rhel",
"platform_like": "rhel",
"version": "Red Hat Enterprise Linux release 9.4 (Plow)"
},
"osquery_info": {
"build_distro": "centos7",
"build_platform": "linux",
"config_hash": "",
"config_valid": "0",
"extensions": "inactive",
"instance_id": "{{ .UUID }}",
"pid": "12947",
"platform_mask": "21",
"start_time": "1580931224",
"uuid": "{{ .UUID }}",
"version": "5.5.1",
"watcher": "-1"
},
"platform_info": {
},
"system_info": {
"computer_name": "{{ .CachedString "hostname" }}",
"cpu_brand": "Intel(R) Xeon(R) Gold 6248R CPU @ 3.00GHz",
"cpu_logical_cores": "8",
"cpu_physical_cores": "4",
"cpu_subtype": "Intel x86-64h Haswell",
"cpu_type": "x86_64h",
"hardware_model": "PowerEdge R750",
"hardware_serial": "{{ .SerialNumber }}",
"hardware_vendor": "Dell Inc.",
"hardware_version": "1.0",
"hostname": "{{ .CachedString "hostname" }}",
"local_hostname": "{{ .CachedString "hostname" }}",
"physical_memory": "17179869184",
"uuid": "{{ .UUID }}"
}
},
"host_identifier": "{{ .UUID }}",
"platform_type": "16"
}
{{- end }}
{{ define "fleet_detail_query_network_interface_unix" -}}
[
{
"address":"fe80::8cb:112d:ff51:1e5d%en0",
"mac":"f8:2d:88:93:56:5c"
}
]
{{- end }}
{{ define "fleet_detail_query_os_version" -}}
[
{
"arch": "x86_64",
"build": "",
"codename": "",
"major": "9",
"minor": "4",
"name": "Red Hat Enterprise Linux",
"patch": "0",
"platform": "rhel",
"platform_like": "rhel",
"version": "Red Hat Enterprise Linux release 9.4 (Plow)"
}
]
{{- end }}
{{ define "fleet_detail_query_os_unix_like" -}}
[
{
"name":"Red Hat Enterprise Linux",
"version":"Red Hat Enterprise Linux release 9.4 (Plow)",
"major":"9",
"minor":"4",
"patch":"0",
"build":"",
"extra":"",
"platform":"rhel",
"arch":"x86_64",
"kernel_version":"5.14.0-503.26.1.el9_5.x86_64"
}
]
{{- end }}
{{ define "fleet_detail_query_osquery_flags" -}}
[
{
"name":"config_refresh",
"value":"{{ printf "%.0f" .ConfigInterval.Seconds }}"
},
{
"name":"distributed_interval",
"value":"{{ printf "%.0f" .QueryInterval.Seconds }}"
},
{
"name":"logger_tls_period",
"value":"99999"
}
]
{{- end }}
{{ define "fleet_detail_query_osquery_info" -}}
[
{
"pid":"11287",
"uuid":"{{ .UUID }}",
"instance_id":"{{ .UUID }}",
"version":"5.5.1",
"config_hash":"b01efbf375ac6767f259ae98751154fef727ce35",
"config_valid":"1",
"extensions":"inactive",
"build_platform":"linux",
"build_distro":"centos7",
"start_time":"1582857555",
"watcher":"-1",
"platform_mask":"9"
}
]
{{- end }}
{{ define "fleet_detail_query_system_info" -}}
[
{
"hostname":"{{ .CachedString "hostname" }}",
"uuid":"{{ .UUID }}",
"cpu_type":"x86_64h",
"cpu_subtype":"Intel x86-64h Haswell",
"cpu_brand":"Intel(R) Xeon(R) Gold 6248R CPU @ 3.00GHz",
"cpu_physical_cores":"4",
"cpu_logical_cores":"8",
"cpu_microcode":"",
"physical_memory":"17179869184",
"hardware_vendor":"Dell Inc.",
"hardware_model":"PowerEdge R750",
"hardware_version":"1.0",
"hardware_serial":"{{ .SerialNumber }}",
"computer_name":"{{ .CachedString "hostname" }}",
"local_hostname":"{{ .CachedString "hostname" }}"
}
]
{{- end }}
{{ define "fleet_detail_query_uptime" -}}
[
{
"days":"0",
"hours":"4",
"minutes":"38",
"seconds":"11",
"total_seconds":"16691"
}
]
{{- end }}
{{/* all hosts */}}
{{ define "fleet_label_query_6" -}}
[
{
"1": "1"
}
]
{{- end }}
{{/* All macOS hosts */}}
{{ define "fleet_label_query_7" -}}
[]
{{- end }}
{{/* All Ubuntu hosts */}}
{{ define "fleet_label_query_8" -}}
[]
{{- end }}
{{/* All CentOS hosts */}}
{{ define "fleet_label_query_9" -}}
[]
{{- end }}
{{/* All Windows hosts */}}
{{ define "fleet_label_query_10" -}}
[]
{{- end }}
{{/* All Red Hat hosts */}}
{{ define "fleet_label_query_11" -}}
[
{
"1": "1"
}
]
{{- end }}
{{/* All Linux distributions */}}
{{ define "fleet_label_query_12" -}}
[
{
"1": "1"
}
]
{{- end }}