Publish fleetdm.com/queries (#899)
* /sandbox/queries becomes /queries, etc * Publish fleetdm.com/queries Expose query library routes the rest of the way, move remediation data sanitization to the point of entry, and update query library to match (pairing w/ @gillespi314) * Fix accidental commit of sailsrc (again)
This commit is contained in:
Mike McNeil
@@ -7,7 +7,6 @@ spec:
|
||||
description: Count the number of Apple applications installed on the machine.
|
||||
query: SELECT COUNT(*) FROM apps WHERE bundle_identifier LIKE 'com.apple.%';
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: mike-j-thomas,noahtalerman,mikermcneil
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -18,7 +17,6 @@ spec:
|
||||
description: Retrieves the OpenSSL version.
|
||||
query: SELECT name AS name, version AS version, 'deb_packages' AS source FROM deb_packages WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'apt_sources' AS source FROM apt_sources WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'rpm_packages' AS source FROM rpm_packages WHERE name LIKE 'openssl%';
|
||||
purpose: Detection
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -28,7 +26,6 @@ spec:
|
||||
description: Gatekeeper tries to ensure only trusted software is run on a mac machine.
|
||||
query: SELECT * FROM gatekeeper WHERE assessments_enabled = 0;
|
||||
purpose: Detection
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -48,7 +45,6 @@ spec:
|
||||
description: List authorized_keys for each user on the system.
|
||||
query: SELECT * FROM users CROSS JOIN authorized_keys USING (uid);
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -59,7 +55,6 @@ spec:
|
||||
description: List authorized_keys for each user on the system.
|
||||
query: SELECT * FROM users CROSS JOIN authorized_keys USING(uid) WHERE username IN (SELECT distinct(username) FROM last);
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -70,7 +65,6 @@ spec:
|
||||
description: Retrieve application, system, and mobile app crash logs.
|
||||
query: SELECT uid, datetime, responsible, exception_type, identifier, version, crash_path FROM users CROSS JOIN crashes USING (uid);
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -80,7 +74,6 @@ spec:
|
||||
description: List installed Chrome Extensions for all users.
|
||||
query: SELECT uid, datetime, responsible, exception_type, identifier, version, crash_path FROM users CROSS JOIN crashes USING (uid);
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -90,7 +83,6 @@ spec:
|
||||
description: Get all software installed on a FreeBSD computer, including browser plugins and installed packages. Note, this does not included other running processes in the processes table.
|
||||
query: SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name AS name, version AS version, 'Package (Atom)' AS type, 'atom_packages' AS source FROM atom_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Package (pkg)' AS type, 'pkg_packages' AS source FROM pkg_packages;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -100,7 +92,6 @@ spec:
|
||||
description: Get the installed homebrew package database.
|
||||
query: SELECT * FROM homebrew_packages;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -110,7 +101,6 @@ spec:
|
||||
description: Get all software installed on a Linux computer, including browser plugins and installed packages. Note, this does not included other running processes in the processes table.
|
||||
query: SELECT name AS name, version AS version, 'Package (APT)' AS type, 'apt_sources' AS source FROM apt_sources UNION SELECT name AS name, version AS version, 'Package (deb)' AS type, 'deb_packages' AS source FROM deb_packages UNION SELECT package AS name, version AS version, 'Package (Portage)' AS type, 'portage_packages' AS source FROM portage_packages UNION SELECT name AS name, version AS version, 'Package (RPM)' AS type, 'rpm_packages' AS source FROM rpm_packages UNION SELECT name AS name, '' AS version, 'Package (YUM)' AS type, 'yum_sources' AS source FROM yum_sources UNION SELECT name AS name, version AS version, 'Package (NPM)' AS type, 'npm_packages' AS source FROM npm_packages UNION SELECT name AS name, version AS version, 'Package (Atom)' AS type, 'atom_packages' AS source FROM atom_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -120,7 +110,6 @@ spec:
|
||||
description: Get all software installed on a macOS computer, including apps, browser plugins, and installed packages. Note, this does not included other running processes in the processes table.
|
||||
query: SELECT name AS name, bundle_short_version AS version, 'Application (macOS)' AS type, 'apps' AS source FROM apps UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name As name, version AS version, 'Browser plugin (Safari)' AS type, 'safari_extensions' AS source FROM safari_extensions UNION SELECT name AS name, version AS version, 'Package (Homebrew)' AS type, 'homebrew_packages' AS source FROM homebrew_packages;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -130,7 +119,6 @@ spec:
|
||||
description: Retrieves the list of installed Safari Extensions for all users in the target system.
|
||||
query: SELECT safari_extensions.* FROM users join safari_extensions USING (uid);
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -140,7 +128,6 @@ spec:
|
||||
description: Get all software installed on a Windows computer, including programs, browser plugins, and installed packages. Note, this does not included other running processes in the processes table.
|
||||
query: SELECT name AS name, version AS version, 'Program (Windows)' AS type, 'programs' AS source FROM programs UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (IE)' AS type, 'ie_extensions' AS source FROM ie_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name AS name, version AS version, 'Package (Chocolatey)' AS type, 'chocolatey_packages' AS source FROM chocolatey_packages UNION SELECT name AS name, version AS version, 'Package (Atom)' AS type, 'atom_packages' AS source FROM atom_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -150,7 +137,6 @@ spec:
|
||||
description:
|
||||
query: SELECT * FROM battery WHERE health != 'Good' AND condition NOT IN ('', 'Normal');
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -160,7 +146,6 @@ spec:
|
||||
description: Displays the percentage of free space available on the primary disk partition.
|
||||
query: SELECT (blocks_available * 100 / blocks) AS pct, * FROM mounts WHERE path = '/';
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -170,7 +155,6 @@ spec:
|
||||
description: Shows system mounted devices and filesystems (not process specific).
|
||||
query: SELECT device, device_alias, path, type, blocks_size FROM mounts;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -180,7 +164,6 @@ spec:
|
||||
description: Shows system mounted devices and filesystems (not process specific).
|
||||
query: SELECT * FROM os_version;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -190,7 +173,6 @@ spec:
|
||||
description: Shows information about the host platform
|
||||
query: SELECT vendor, version, date, revision from platform_info;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -200,7 +182,6 @@ spec:
|
||||
description: Shows applications and binaries set as user/login startup items.
|
||||
query: SELECT * FROM startup_items;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -210,7 +191,6 @@ spec:
|
||||
description: Get a list of system logins and logouts.
|
||||
query: SELECT * FROM last;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -220,7 +200,6 @@ spec:
|
||||
description: Get current users with active shell/console on the system and associated process
|
||||
query: SELECT user,host,time, p.name, p.cmdline, p.cwd, p.root FROM logged_in_users liu, processes p WHERE liu.pid = p.pid and liu.type='user' and liu.user <> '' ORDER BY time;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -231,7 +210,6 @@ spec:
|
||||
description: Shows the system uptime.
|
||||
query: SELECT * FROM uptime;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -241,7 +219,6 @@ spec:
|
||||
description: Shows all USB devices that are actively plugged into the host system.
|
||||
query: SELECT * FROM usb_devices;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -251,7 +228,6 @@ spec:
|
||||
description: Shows information about the wifi network that a host is currently connected to.
|
||||
query: SELECT * FROM wifi_status;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -261,7 +237,6 @@ spec:
|
||||
description:
|
||||
query: SELECT * FROM bitlocker_info WHERE protection_status = 0;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -271,7 +246,6 @@ spec:
|
||||
description: Disk encryption status and information.
|
||||
query: SELECT * FROM disk_encryption;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -282,9 +256,7 @@ spec:
|
||||
description: Identify SSH keys created without a passphrase which can be used in Lateral Movement (MITRE. TA0008)
|
||||
query: SELECT uid, username, description, path, encrypted FROM users CROSS JOIN user_ssh_keys using (uid) WHERE encrypted=0;
|
||||
purpose: Detection
|
||||
remediation:
|
||||
- User awareness about the impact of SSH Keys
|
||||
- Rotate the identified Keys
|
||||
remediation: First, make the user aware about the impact of SSH keys. Then rotate the unencrypted keys detected.
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -295,9 +267,7 @@ spec:
|
||||
description: Identify SSH keys created without a passphrase which can be used in Lateral Movement (MITRE. TA0008)
|
||||
query: SELECT uid, username, description, path, encrypted FROM users CROSS JOIN user_ssh_keys using (uid) WHERE encrypted=0 and username in (SELECT distinct(username) FROM last);
|
||||
purpose: Detection
|
||||
remediation:
|
||||
- User awareness about the impact of SSH Keys
|
||||
- Rotate the identified Keys
|
||||
remediation: First, make the user aware about the impact of SSH keys. Then rotate the unencrypted keys detected.
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -308,7 +278,6 @@ spec:
|
||||
description: Line parsed values from system and user cron/tab.
|
||||
query: SELECT * FROM crontab;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -319,7 +288,6 @@ spec:
|
||||
description: suid binaries in common locations.
|
||||
query: SELECT * FROM suid_bin;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: query
|
||||
@@ -329,9 +297,7 @@ spec:
|
||||
description: Detect any processes that run with LD_PRELOAD environment variable
|
||||
query: SELECT env.pid, env.key, env.value, p.name,p.path, p.cmdline, p.cwd FROM process_envs env join processes p USING (pid) WHERE key='LD_PRELOAD';
|
||||
purpose: Detection
|
||||
remediation:
|
||||
- Identify the process/binary detected
|
||||
- Confirm with system owner
|
||||
remediation: Identify the process/binary detected and confirm with the system's owner.
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -342,9 +308,7 @@ spec:
|
||||
description: Detect any processes that run with DYLD_INSERT_LIBRARIES environment variable
|
||||
query: SELECT env.pid, env.key, env.value, p.name,p.path, p.cmdline, p.cwd FROM process_envs env join processes p USING (pid) WHERE key='DYLD_INSERT_LIBRARIES';
|
||||
purpose: Detection
|
||||
remediation:
|
||||
- Identify the process/binary detected
|
||||
- Confirm with system owner
|
||||
remediation: Identify the process/binary detected and confirm with the system's owner.
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -355,7 +319,6 @@ spec:
|
||||
description: Line-parsed /etc/hosts
|
||||
query: SELECT * FROM etc_hosts WHERE address not in ('127.0.0.1', '::1');
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -366,7 +329,6 @@ spec:
|
||||
description: Network interfaces MAC address
|
||||
query: SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details d USING (interface) WHERE address not in ('127.0.0.1', '::1');
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -377,7 +339,6 @@ spec:
|
||||
description: Local user accounts (including domain accounts that have logged on locally (Windows)).
|
||||
query: SELECT uid, gid, username, description,directory, shell FROM users;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -388,7 +349,6 @@ spec:
|
||||
description: Domain Joined environment normally have root or other service account only and users are SSH-ing using their Domain Accounts.
|
||||
query: SELECT * FROM shadow WHERE password_status='active' and username!='root';
|
||||
purpose: Detection
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -402,7 +362,6 @@ spec:
|
||||
(SELECT username FROM users WHERE uid=p.uid) AS username
|
||||
FROM processes as p WHERE cmdline like 'nmap%';
|
||||
purpose: Detection
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -413,7 +372,6 @@ spec:
|
||||
description: Docker images information, can be used on normal system or a kubenode.
|
||||
query: SELECT * FROM docker_images;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -424,7 +382,6 @@ spec:
|
||||
description: Docker containers information, can be used on normal system or a kubenode.
|
||||
query: SELECT * FROM docker_containers;
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
---
|
||||
apiVersion: v1
|
||||
@@ -435,5 +392,4 @@ spec:
|
||||
description: Docker containers Processes, can be used on normal system or a kubenode.
|
||||
query: SELECT c.id, c.name, c.image, c.image_id, c.command, c.created, c.state, c.status, p.cmdline FROM docker_containers c CROSS JOIN docker_container_processes p using(id);
|
||||
purpose: Informational
|
||||
remediation: N/A
|
||||
contributors: anelshaer
|
||||
|
||||
@@ -20,15 +20,6 @@ parasails.registerPage('query-detail', {
|
||||
// ║║║║ ║ ║╣ ╠╦╝╠═╣║ ║ ║║ ║║║║╚═╗
|
||||
// ╩╝╚╝ ╩ ╚═╝╩╚═╩ ╩╚═╝ ╩ ╩╚═╝╝╚╝╚═╝
|
||||
methods: {
|
||||
castRemediationArray: function (remediation) {
|
||||
if (_.isArray(remediation) && remediation.length) {
|
||||
return remediation.filter((item) => _.isString(item) && item.length);
|
||||
}
|
||||
if (_.isString(remediation) && remediation.length) {
|
||||
return [remediation];
|
||||
}
|
||||
return ['N/A'];
|
||||
}
|
||||
|
||||
}
|
||||
});
|
||||
|
||||
+1
-1
@@ -72,7 +72,7 @@ parasails.registerPage('query-library', {
|
||||
},
|
||||
|
||||
clickCard: function (querySlug) {
|
||||
window.location = '/sandbox/queries/' + querySlug.toLowerCase(); // TODO remove sandbox from path before deploy to production
|
||||
window.location = '/queries/' + querySlug;// we can trust the query slug is url-safe
|
||||
},
|
||||
|
||||
}
|
||||
|
||||
Vendored
-2
@@ -17,8 +17,6 @@ module.exports = {
|
||||
// Add any dev-only routes for local development of not-yet-released pages.
|
||||
// e.g. http://localhost:2024/sandbox/example-query
|
||||
routes: {
|
||||
'GET /sandbox/queries': { action: 'view-query-library' },// « to see it, check out /sandbox/queries
|
||||
'GET /sandbox/queries/:slug': { action: 'view-query-detail' },// « to see it, check out /sandbox/queries/adg
|
||||
'GET /sandbox/documentation/*': { skipAssets: false, action: 'docs/view-basic-documentation' },// « to see it, check out http://localhost:2024/sandbox/documentation/adsg
|
||||
'GET /sandbox/handbook/*': { skipAssets: false, action: 'handbook/view-basic-handbook' },// « to see it, check out http://localhost:2024/sandbox/handbook/adsg
|
||||
},
|
||||
|
||||
Vendored
+3
@@ -22,6 +22,9 @@ module.exports.routes = {
|
||||
'/hall-of-fame': 'https://github.com/fleetdm/fleet/pulse',
|
||||
'/company/about': '/blog', // FUTURE: brief "about" page explaining the origins of the company
|
||||
|
||||
'GET /queries': { action: 'view-query-library' },
|
||||
'GET /queries/:slug': { action: 'view-query-detail' },
|
||||
|
||||
'/contribute': 'https://github.com/fleetdm/fleet/tree/master/docs/4-Contribution',
|
||||
'/company/stewardship': 'https://github.com/fleetdm/fleet', // FUTURE: page about how we approach open source and our commitments to the community
|
||||
'/legal/terms': 'https://docs.google.com/document/d/1OM6YDVIs7bP8wg6iA3VG13X086r64tWDqBSRudG4a0Y/edit',
|
||||
|
||||
+12
@@ -27,11 +27,23 @@ module.exports = {
|
||||
async()=>{// Parse query library from YAML and bake them into the Sails app's configuration.
|
||||
let RELATIVE_PATH_TO_QUERY_LIBRARY_YML_IN_FLEET_REPO = 'docs/1-Using-Fleet/standard-query-library/standard-query-library.yml';
|
||||
let yaml = await sails.helpers.fs.read(path.join(topLvlRepoPath, RELATIVE_PATH_TO_QUERY_LIBRARY_YML_IN_FLEET_REPO));
|
||||
|
||||
let queriesWithProblematicRemediations = [];
|
||||
let queries = YAML.parseAllDocuments(yaml).map((yamlDocument)=>{
|
||||
let query = yamlDocument.toJSON().spec;
|
||||
query.slug = _.kebabCase(query.name);// « unique slug to use for routing to this query's detail page
|
||||
if ((query.remediation !== undefined && !_.isString(query.remediation)) || (query.purpose !== 'Detection' && _.isString(query.remediation))) {
|
||||
// console.log(typeof query.remediation);
|
||||
queriesWithProblematicRemediations.push(query);
|
||||
} else if (query.remediation === undefined) {
|
||||
query.remediation = 'N/A';// « We set this to a string here so that the data type is always string. We use N/A so folks can see there's no remediation and contribute if desired.
|
||||
}
|
||||
return query;
|
||||
});
|
||||
// Report any errors that were detected along the way in one fell swoop to avoid endless resubmitting of PRs.
|
||||
if (queriesWithProblematicRemediations.length >= 1) {
|
||||
throw new Error('Failed parsing YAML for query library: The "remediation" of a query should either be absent (undefined) or a single string (not a list of strings). And "remediation" should only be present when a query\'s purpose is "Detection". But one or more queries have an invalid "remediation": ' + _.pluck(queriesWithProblematicRemediations, 'slug').sort());
|
||||
}//•
|
||||
// Assert uniqueness of slugs.
|
||||
if (queries.length !== _.uniq(_.pluck(queries, 'slug')).length) {
|
||||
throw new Error('Failed parsing YAML for query library: Queries as currently named would result in colliding (duplicate) slugs. To resolve, rename the queries whose names are too similar. Note the duplicates: ' + _.pluck(queries, 'slug').sort());
|
||||
|
||||
Vendored
+10
-12
@@ -5,18 +5,16 @@
|
||||
<h2 class="mb-3">{{query.name}}</h2>
|
||||
<h6 class="font-weight-light pb-3">{{query.description}}</h6>
|
||||
<div v-if="!!query.tip">
|
||||
<div class="container query-tip d-flex align-items-center border-left border-primary p-4 my-5">
|
||||
<div class="container query-tip d-flex align-items-center border-left border-primary p-4 my-5">
|
||||
<img alt="lightbulb" class="lightbulb" src="/images/lightbulb-blue-24x24@2x.png"/><p class="d-flex m-0">{{query.tip}}</p>
|
||||
</div>
|
||||
</div>
|
||||
<h3 class="py-3">Query</h3>
|
||||
<h3 class="py-3">Query</h3>
|
||||
<code class="pb-3">{{query.query}}</code>
|
||||
<div v-if="query.purpose === 'Detection' && (query.remediation && query.remediation.length)">
|
||||
<h3 class="pt-5 pb-3">Remediation</h3>
|
||||
<div v-if="query.purpose === 'Detection' && query.remediation">
|
||||
<h3 class="pt-5 pb-3">Remediation</h3>
|
||||
<ul class="px-4">
|
||||
<li v-for="item of castRemediationArray(query.remediation)">
|
||||
{{item}}
|
||||
</li>
|
||||
<li>{{query.remediation}}</li>
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
@@ -24,7 +22,7 @@
|
||||
<div class="col-3 mx-5 my-5 d-none d-md-block">
|
||||
<!-- TODO: refactor as page script to type-check and normalize"-->
|
||||
<div class="query-sidebar border-bottom mb-3">
|
||||
<h5 permalink="support">Platforms</h5>
|
||||
<h5>Platforms</h5>
|
||||
<p>
|
||||
<span v-if="query.platforms.includes('macOS')"><i class="fa fa-apple fa-lg mr-3" alt="Mac"></i></span>
|
||||
<span v-if="query.platforms.includes('Windows')"><i class="fa fa-windows fa-lg mr-3" alt="Windows"></i></span>
|
||||
@@ -33,16 +31,16 @@
|
||||
</div>
|
||||
|
||||
<div class="query-sidebar border-bottom mb-3">
|
||||
<h5 permalink="purpose">Purpose</h5>
|
||||
<h5>Purpose</h5>
|
||||
<p>{{query.purpose}}</p>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="query-sidebar border-bottom mb-3" v-if="query.contributors && query.contributors.length">
|
||||
<h5 permalink="contributors">Contributors</h5>
|
||||
<h5>Contributors</h5>
|
||||
<!-- TODO: display github avatars"-->
|
||||
<p>{{query.contributors}}</p>
|
||||
</div>
|
||||
<h5 permalink="contribute">Contribute to this page</h5>
|
||||
<h5>Contribute to this page</h5>
|
||||
<a target="_blank" :href="'https://github.com/fleetdm/fleet/edit/master/'+queryLibraryYmlRepoPath">View source</a>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
Reference in New Issue
Block a user