|
|
|
@@ -54,7 +54,7 @@ SELECT 1 FROM disk_encryption WHERE user_uuid IS NOT "" AND filevault_status = '
|
|
|
|
|
|
|
|
|
|
## disk_encryption_linux
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon
|
|
|
|
|
|
|
|
|
|
- Query:
|
|
|
|
|
```sql
|
|
|
|
@@ -79,7 +79,7 @@ WITH encrypted(enabled) AS (
|
|
|
|
|
|
|
|
|
|
## disk_space_unix
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin
|
|
|
|
|
|
|
|
|
|
- Query:
|
|
|
|
|
```sql
|
|
|
|
@@ -257,7 +257,7 @@ SELECT ipv4 AS address, mac FROM network_interfaces LIMIT 1
|
|
|
|
|
|
|
|
|
|
## network_interface_unix
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin
|
|
|
|
|
|
|
|
|
|
- Query:
|
|
|
|
|
```sql
|
|
|
|
@@ -333,7 +333,7 @@ LIMIT 1;
|
|
|
|
|
|
|
|
|
|
## orbit_info
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin, windows
|
|
|
|
|
|
|
|
|
|
- Discovery query:
|
|
|
|
|
```sql
|
|
|
|
@@ -367,7 +367,7 @@ SELECT
|
|
|
|
|
|
|
|
|
|
## os_unix_like
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin
|
|
|
|
|
|
|
|
|
|
- Query:
|
|
|
|
|
```sql
|
|
|
|
@@ -459,7 +459,7 @@ WITH display_version_table AS (
|
|
|
|
|
|
|
|
|
|
## osquery_flags
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin, windows
|
|
|
|
|
|
|
|
|
|
- Query:
|
|
|
|
|
```sql
|
|
|
|
@@ -477,7 +477,7 @@ select * from osquery_info limit 1
|
|
|
|
|
|
|
|
|
|
## scheduled_query_stats
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin, windows
|
|
|
|
|
|
|
|
|
|
- Query:
|
|
|
|
|
```sql
|
|
|
|
@@ -505,7 +505,7 @@ FROM chrome_extensions
|
|
|
|
|
|
|
|
|
|
## software_linux
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon
|
|
|
|
|
|
|
|
|
|
- Query:
|
|
|
|
|
```sql
|
|
|
|
@@ -737,7 +737,7 @@ WITH app_paths AS (
|
|
|
|
|
|
|
|
|
|
- Description: Prior to osquery version 5.16.0, the python_packages table did not search user directories.
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin, windows
|
|
|
|
|
|
|
|
|
|
- Discovery query:
|
|
|
|
|
```sql
|
|
|
|
@@ -765,7 +765,7 @@ SELECT
|
|
|
|
|
|
|
|
|
|
- Description: As of osquery version 5.16.0, the python_packages table searches user directories with support from a cross join on users. See https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table.
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin, windows
|
|
|
|
|
|
|
|
|
|
- Discovery query:
|
|
|
|
|
```sql
|
|
|
|
@@ -795,7 +795,7 @@ WITH cached_users AS (WITH cached_groups AS (select * from groups)
|
|
|
|
|
|
|
|
|
|
## software_vscode_extensions
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin, windows
|
|
|
|
|
|
|
|
|
|
- Discovery query:
|
|
|
|
|
```sql
|
|
|
|
@@ -893,7 +893,7 @@ select * from system_info limit 1
|
|
|
|
|
|
|
|
|
|
## uptime
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin, windows
|
|
|
|
|
|
|
|
|
|
- Query:
|
|
|
|
|
```sql
|
|
|
|
@@ -902,7 +902,7 @@ select * from uptime limit 1
|
|
|
|
|
|
|
|
|
|
## users
|
|
|
|
|
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, darwin, windows
|
|
|
|
|
- Platforms: linux, ubuntu, debian, rhel, centos, sles, kali, gentoo, amzn, pop, arch, linuxmint, void, nixos, endeavouros, manjaro, opensuse-leap, opensuse-tumbleweed, tuxedo, neon, darwin, windows
|
|
|
|
|
|
|
|
|
|
- Query:
|
|
|
|
|
```sql
|
|
|
|
|