From 4fa55e5e55969defd7e37b055310c103e7c69e66 Mon Sep 17 00:00:00 2001 From: Lucas Manuel Rodriguez Date: Wed, 6 May 2026 09:16:12 -0300 Subject: [PATCH] Update osquery schemas and flags to 5.23.0 (#44758) https://github.com/osquery/osquery/releases/tag/5.23.0 PS: I see that the `yara` table was dropped in 5.23.0 in favor of `yara_file` and `yara_process`. ## Summary by CodeRabbit * **New Features** * Added three new osquery query tables: `process_open_handles` (Windows), `secureboot_certificates` (Linux), and `yara_events` for expanded system visibility. * Added new columns across existing tables to enhance data collection capabilities. * **Updates** * Upgraded osquery to version 5.23.0. --- schema/osquery_fleet_schema.json | 667 ++++++++++++++++++++---- schema/tables/yara.yml | 20 - server/fleet/agent_options_generated.go | 2 +- tools/osquery-agent-options/main.go | 2 +- tools/tuf/test/create_repository.sh | 2 +- website/config/custom.js | 2 +- 6 files changed, 558 insertions(+), 137 deletions(-) delete mode 100644 schema/tables/yara.yml diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index d67f85986d..8cd3e0fb92 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -9006,7 +9006,7 @@ "evented": false, "cacheable": false, "notes": "", - "examples": "```\nselect * from docker_images where id = '6a2f32de169d14e6f8a84538eaa28f2629872d7d4f580a303b296c60db36fbd7'\n```", + "examples": "```\nselect * from docker_image_layers where id = '6a2f32de169d14e6f8a84538eaa28f2629872d7d4f580a303b296c60db36fbd7'\n```", "columns": [ { "name": "id", @@ -18824,6 +18824,24 @@ "required": false, "index": true }, + { + "name": "depth", + "description": "Nesting depth of the package (0 = direct dependency)", + "type": "integer", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "max_depth", + "description": "Maximum depth to search for nested packages (default 100, -1 = unlimited)", + "type": "integer", + "notes": "", + "hidden": true, + "required": false, + "index": false + }, { "name": "pid_with_namespace", "description": "Pids that contain a namespace", @@ -22967,6 +22985,112 @@ ], "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_open_files.yml" }, + { + "name": "process_open_handles", + "description": "Enumerate open handles for a specified process. Defaults to the osquery process if no pid constraint is provided.", + "url": "https://fleetdm.com/tables/process_open_handles", + "platforms": [ + "windows" + ], + "evented": false, + "cacheable": true, + "notes": "", + "examples": "```\nselect * from process_open_handles where pid = 1234\n```", + "columns": [ + { + "name": "pid", + "description": "The process identifier that owns the handle.", + "type": "bigint", + "notes": "", + "hidden": false, + "required": true, + "index": true + }, + { + "name": "value", + "description": "The handle value", + "type": "bigint", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "type", + "description": "The type of object referenced by the handle.", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "access", + "description": "The access permissions of the object referenced by the handle.", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "name", + "description": "The value of the object referenced by the handle.", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "attributes", + "description": "Object handle attributes.", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "count", + "description": "Handle Count.", + "type": "bigint", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "raw_pointer_count", + "description": "Raw Pointer/Reference Count. Meaning varies, consult Windows docs.", + "type": "bigint", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "error_stage", + "description": "Error Stage.", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "error_code", + "description": "Error Code.", + "type": "bigint", + "notes": "", + "hidden": false, + "required": false, + "index": false + } + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/process_open_handles.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_open_handles.yml&value=name%3A%20process_open_handles%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, { "name": "process_open_pipes", "description": "Pipes and partner processes for each process.", @@ -25668,6 +25792,175 @@ ], "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/secureboot.yml" }, + { + "name": "secureboot_certificates", + "description": "X.509 certificates from UEFI Secure Boot signature databases (db and dbx EFI variables). Useful for monitoring CA expiry and adoption of updated certificates (e.g. Microsoft UEFI CA 2023).", + "url": "https://fleetdm.com/tables/secureboot_certificates", + "platforms": [ + "linux" + ], + "evented": false, + "cacheable": false, + "notes": "", + "examples": "```\nselect * from secureboot_certificates where revoked = 1\n```", + "columns": [ + { + "name": "common_name", + "description": "Certificate CommonName", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "subject", + "description": "Certificate subject distinguished name", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "issuer", + "description": "Certificate issuer distinguished name", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "not_valid_before", + "description": "Lower bound of valid date", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "not_valid_after", + "description": "Certificate expiration date", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "sha1", + "description": "SHA1 hash of the raw certificate contents", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "serial", + "description": "Certificate serial number", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "revoked", + "description": "1 if the certificate is in the dbx revocation list, 0 if it is in the db allowlist", + "type": "integer", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "path", + "description": "Path to the EFI variable file", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "is_ca", + "description": "1 if the certificate is a CA, 0 otherwise", + "type": "integer", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "self_signed", + "description": "1 if the certificate is self-signed, 0 otherwise", + "type": "integer", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "key_usage", + "description": "Certificate key usage extension string", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "authority_key_id", + "description": "Authority Key Identifier (AKI)", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "subject_key_id", + "description": "Subject Key Identifier (SKI)", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "signing_algorithm", + "description": "Algorithm used to sign the certificate", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "key_algorithm", + "description": "Public key algorithm", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "key_strength", + "description": "Public key size in bits", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + } + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/secureboot_certificates.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsecureboot_certificates.yml&value=name%3A%20secureboot_certificates%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, { "name": "security_profile_info", "description": "Information on the security profile of a given system by listing the system Account and Audit Policies. This table mimics the exported securitypolicy output from the secedit tool.", @@ -29006,7 +29299,7 @@ }, { "name": "level", - "description": "the severity level of the entry", + "description": "the severity level of the entry (undefined, debug, info, default, error, fault)", "type": "text", "notes": "", "hidden": false, @@ -30347,7 +30640,7 @@ }, { "name": "wifi_status", - "description": "macOS current WiFi status.", + "description": "macOS current WiFi status. This table requires Full Disk Access (FDA) permission to retrieve network_name.", "url": "https://fleetdm.com/tables/wifi_status", "platforms": [ "darwin" @@ -31812,6 +32105,15 @@ "notes": "", "examples": "```\nselect filter,consumer,query,command_line_template,wcec.name from wmi_cli_event_consumers wcec left outer join wmi_filter_consumer_binding wcb on consumer = wcec.relative_path left outer join wmi_event_filters wef on wef.relative_path = wcb.filter;\n```", "columns": [ + { + "name": "namespace", + "description": "The WMI namespace where the consumer was found.", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, { "name": "name", "description": "Unique name of a consumer.", @@ -31873,6 +32175,15 @@ "notes": "", "examples": "```\nselect * from wmi_event_filters\n```", "columns": [ + { + "name": "namespace", + "description": "The WMI namespace where the filter was found.", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, { "name": "name", "description": "Unique identifier of an event filter.", @@ -31934,6 +32245,15 @@ "notes": "", "examples": "```\nselect * from wmi_filter_consumer_binding\n```", "columns": [ + { + "name": "namespace", + "description": "The WMI namespace where the binding was found.", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, { "name": "consumer", "description": "Reference to an instance of __EventConsumer that represents the object path to a logical consumer, the recipient of an event.", @@ -31986,6 +32306,15 @@ "notes": "", "examples": "```\nselect filter,consumer,query,scripting_engine,script_file_name,script_text,wsec.name from wmi_script_event_consumers wsec left outer join wmi_filter_consumer_binding wcb on consumer = wsec.relative_path left outer join wmi_event_filters wef on wef.relative_path = wcb.filter;\n```", "columns": [ + { + "name": "namespace", + "description": "The WMI namespace where the consumer was found.", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, { "name": "name", "description": "Unique identifier for the event consumer. ", @@ -32243,116 +32572,6 @@ "url": "https://fleetdm.com/tables/yaml_to_json", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yaml_to_json.yml" }, - { - "name": "yara", - "description": "Triggers one-off YARA query for files at the specified path. Requires one of `sig_group`, `sigfile`, or `sigrule`.", - "url": "https://fleetdm.com/tables/yara", - "platforms": [ - "darwin", - "linux", - "windows" - ], - "evented": false, - "cacheable": false, - "notes": "", - "examples": "Look for files under `/root` that match a Yara signature. This example uses the [EICAR test file](https://www.eicar.org/download-anti-malware-testfile/).\n\n```\nSELECT * FROM yara WHERE path like '/root/%%' AND sigrule IN (\n 'rule eicar {\n strings:\n $s1 = \"X5O!P%@AP[4\\\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*\" fullword ascii\n condition:\n all of them\n}'\n ) AND matches='eicar';\n```", - "columns": [ - { - "name": "path", - "description": "The path scanned", - "type": "text", - "notes": "", - "hidden": false, - "required": true, - "index": true - }, - { - "name": "matches", - "description": "List of YARA matches", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "count", - "description": "Number of YARA matches. \n_Note that `count` is a reserved word and should be wrapped in quotes when referencing this column in a query._", - "type": "integer", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "sig_group", - "description": "Signature group used", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "sigfile", - "description": "Signature file used", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "sigrule", - "description": "Signature strings used", - "type": "text", - "notes": "", - "hidden": true, - "required": false, - "index": false - }, - { - "name": "strings", - "description": "Matching strings", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "tags", - "description": "Matching tags", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "sigurl", - "description": "Signature url", - "type": "text", - "notes": "", - "hidden": true, - "required": false, - "index": false - }, - { - "name": "pid_with_namespace", - "description": "Pids that contain a namespace", - "type": "integer", - "notes": "", - "hidden": true, - "required": false, - "index": false, - "platforms": [ - "linux" - ] - } - ], - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yara.yml" - }, { "name": "yara_events", "description": "Track YARA matches for files specified in configuration data.", @@ -32461,6 +32680,228 @@ ], "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yara_events.yml" }, + { + "name": "yara_file", + "description": "Triggers one-off YARA query for files at the specified path. Additionally requires one of `sig_group`, `sigfile`, or `sigrule`.", + "url": "https://fleetdm.com/tables/yara_file", + "platforms": [ + "darwin", + "linux", + "windows" + ], + "evented": false, + "cacheable": false, + "notes": "", + "examples": "```\nselect * from yara where path = '/etc/passwd' and sigrule = 'rule always_true { condition: true }'\n```", + "columns": [ + { + "name": "path", + "description": "The path scanned", + "type": "text", + "notes": "", + "hidden": false, + "required": true, + "index": true + }, + { + "name": "matches", + "description": "List of YARA matches", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "count", + "description": "Number of YARA matches", + "type": "integer", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "sig_group", + "description": "Signature group used", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "sigfile", + "description": "Signature file used", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "sigrule", + "description": "Signature strings used", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false + }, + { + "name": "strings", + "description": "Matching strings", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "tags", + "description": "Matching tags", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "sigurl", + "description": "Signature url", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false + }, + { + "name": "pid_with_namespace", + "description": "Pids that contain a namespace", + "type": "integer", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "linux" + ] + } + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/yara_file.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fyara_file.yml&value=name%3A%20yara_file%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "name": "yara_process", + "description": "Triggers one-off YARA query for process memory of the specified pid. Additionally requires one of `sig_group`, `sigfile`, or `sigrule`.", + "url": "https://fleetdm.com/tables/yara_process", + "platforms": [ + "darwin", + "linux", + "windows" + ], + "evented": false, + "cacheable": false, + "notes": "", + "examples": "```\nselect * from yara where pid = 1234 and sigrule = 'rule always_true { condition: true }'\n```", + "columns": [ + { + "name": "pid", + "description": "The pid scanned (process memory)", + "type": "integer", + "notes": "", + "hidden": false, + "required": true, + "index": true + }, + { + "name": "matches", + "description": "List of YARA matches", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "count", + "description": "Number of YARA matches", + "type": "integer", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "sig_group", + "description": "Signature group used", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "sigfile", + "description": "Signature file used", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "sigrule", + "description": "Signature strings used", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false + }, + { + "name": "strings", + "description": "Matching strings", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "tags", + "description": "Matching tags", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "sigurl", + "description": "Signature url", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false + }, + { + "name": "pid_with_namespace", + "description": "Pids that contain a namespace", + "type": "integer", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "linux" + ] + } + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/yara_process.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fyara_process.yml&value=name%3A%20yara_process%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, { "name": "ycloud_instance_metadata", "description": "Yandex.Cloud instance metadata.", diff --git a/schema/tables/yara.yml b/schema/tables/yara.yml deleted file mode 100644 index d6d0ece43a..0000000000 --- a/schema/tables/yara.yml +++ /dev/null @@ -1,20 +0,0 @@ -name: yara -columns: - - name: count - description: |- - Number of YARA matches. - _Note that `count` is a reserved word and should be wrapped in quotes when referencing this column in a query._ - type: INTEGER -examples: |- - Look for files under `/root` that match a Yara signature. This example uses the [EICAR test file](https://www.eicar.org/download-anti-malware-testfile/). - - ``` - SELECT * FROM yara WHERE path like '/root/%%' AND sigrule IN ( - 'rule eicar { - strings: - $s1 = "X5O!P%@AP[4\\PZX54(P^)7CC)7}$EICAR-STANDARD-ANTIVIRUS-TEST-FILE!$H+H*" fullword ascii - condition: - all of them - }' - ) AND matches='eicar'; - ``` diff --git a/server/fleet/agent_options_generated.go b/server/fleet/agent_options_generated.go index 4ecdc15579..042b46569f 100644 --- a/server/fleet/agent_options_generated.go +++ b/server/fleet/agent_options_generated.go @@ -1,4 +1,4 @@ -// Automatically generated by tools/osquery-agent-options for osquery 5.22.1. DO NOT EDIT! +// Automatically generated by tools/osquery-agent-options for osquery 5.23.0. DO NOT EDIT! // To update flags for a new osquery version, update the osqueryVersion variable in // "tools/osquery-agent-options/main.go" and run "cd server/fleet/ && go generate". package fleet diff --git a/tools/osquery-agent-options/main.go b/tools/osquery-agent-options/main.go index a32cca8ff1..3ae58fb3e6 100644 --- a/tools/osquery-agent-options/main.go +++ b/tools/osquery-agent-options/main.go @@ -27,7 +27,7 @@ import ( var ( rxOption = regexp.MustCompile(`\-\-(\w+)\s`) - osqueryVersion = "5.22.1" + osqueryVersion = "5.23.0" structTpl = template.Must(template.New("struct").Funcs(template.FuncMap{ "camelCase": camelCaseOptionName, diff --git a/tools/tuf/test/create_repository.sh b/tools/tuf/test/create_repository.sh index 49a88b41f3..8aa777eb6f 100755 --- a/tools/tuf/test/create_repository.sh +++ b/tools/tuf/test/create_repository.sh @@ -45,7 +45,7 @@ ESCROW_BUDDY_PKG_VERSION=1.0.0 SWIFT_DIALOG_VERSION=2.5.6 if [[ -z "$OSQUERY_VERSION" ]]; then - OSQUERY_VERSION=5.22.1 + OSQUERY_VERSION=5.23.0 fi mkdir -p $TUF_PATH/tmp diff --git a/website/config/custom.js b/website/config/custom.js index ead11bcf9e..dbb22fe978 100644 --- a/website/config/custom.js +++ b/website/config/custom.js @@ -368,7 +368,7 @@ module.exports.custom = { // // The version of osquery to use when generating schema docs // (both in Fleet's query console and on fleetdm.com) - versionOfOsquerySchemaToUseWhenGeneratingDocumentation: '5.22.1', + versionOfOsquerySchemaToUseWhenGeneratingDocumentation: '5.23.0', // ███╗ ███╗██╗███████╗ ██████╗