Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Add Kolide osquery tables

Browse Source
This commit is contained in:
Sharon Katz
2023-11-01 20:11:35 -06:00
committed by GitHub
parent f8652a1b68
commit ab7717009e
127 changed files with 14429 additions and 213 deletions
Download Patch File Download Diff File Expand all files Collapse all files
orbit/pkg/dataflatten/testdata/animals.json
Vendored
+34
View File
@@ -0,0 +1,34 @@
{
"metadata": {
"testing": true,
"version": "1.0.1"
},
"system": "users demo",
"users": [
{
"favorites": [
"ants"
],
"uuid": "abc123",
"name": "Alex Aardvark",
"id": 1
},
{
"favorites": [
"mice",
"birds"
],
"uuid": "def456",
"name": "Bailey Bobcat",
"id": 2
},
{
"favorites": [
"seeds"
],
"uuid": "ghi789",
"name": "Cam Chipmunk",
"id": 3
}
]
}
orbit/pkg/dataflatten/testdata/animals.jsonl
Vendored
+43
View File
@@ -0,0 +1,43 @@
{
"metadata": {
"testing": true,
"version": "1.0.1"
}
}
{
"system": "users demo"
}
{
"users": [
{
"favorites": [
"ants"
],
"uuid": "abc123",
"name": "Alex Aardvark",
"id": 1
},
{
"favorites": [
"mice",
"birds"
],
"uuid": "def456",
"name": "Bailey Bobcat",
"id": 2
},
{
"favorites": [
"seeds"
],
"uuid": "ghi789",
"name": "Cam Chipmunk",
"id": 3
}
]
}
[
"array-item-A",
"array-item-B",
"array-item-C"
]
orbit/pkg/dataflatten/testdata/animals.plist
Vendored
BIN
View File
Binary file not shown.
orbit/pkg/dataflatten/testdata/animals.xml
Vendored
+55
View File
@@ -0,0 +1,55 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>metadata</key>
<dict>
<key>testing</key>
<true/>
<key>version</key>
<string>1.0.1</string>
</dict>
<key>system</key>
<string>users demo</string>
<key>users</key>
<array>
<dict>
<key>favorites</key>
<array>
<string>ants</string>
</array>
<key>id</key>
<integer>1</integer>
<key>name</key>
<string>Alex Aardvark</string>
<key>uuid</key>
<string>abc123</string>
</dict>
<dict>
<key>favorites</key>
<array>
<string>mice</string>
<string>birds</string>
</array>
<key>id</key>
<integer>2</integer>
<key>name</key>
<string>Bailey Bobcat</string>
<key>uuid</key>
<string>def456</string>
</dict>
<dict>
<key>favorites</key>
<array>
<string>seeds</string>
</array>
<key>id</key>
<integer>3</integer>
<key>name</key>
<string>Cam Chipmunk</string>
<key>uuid</key>
<string>ghi789</string>
</dict>
</array>
</dict>
</plist>
orbit/pkg/dataflatten/testdata/complex2.json
Vendored
+28
View File
@@ -0,0 +1,28 @@
{
"addons": [
{
"string1": "hello",
"null1": null,
"null2": null,
"bool1": true,
"nest1": {
"anArray": []
},
"nest2": [
{
"null3": null,
"null4": null,
"string2": "foo"
}
],
"nest3": {
"string3": null,
"string4": null,
"string5": null,
"string6": "null",
"string7": "A Very Long Sentence",
"string8": "short"
}
}
]
}
orbit/pkg/dataflatten/testdata/nested.json
Vendored
+15
View File
@@ -0,0 +1,15 @@
{
"addons": [
{
"name": "Nested Strings",
"nest1": {
"string1": null,
"string2": null,
"string3": "string3",
"string4": "string4",
"string5": "string5",
"string6": "string6"
}
}
]
}
orbit/pkg/dataflatten/testdata/nested/Makefile
Vendored
+29
View File
@@ -0,0 +1,29 @@
TARGETS:= nested.xml nested.plist
all: $(TARGETS)
clean:
-rm $(TARGETS)
inner.xml: inner.json
plutil -convert xml1 -o $@ $^
inner.plist.b64: inner.json
plutil -convert binary1 -o - $^ | base64 -o $@
inner.plist: inner.json
plutil -convert binary1 -o $@ $^
nested.xml: nested.template.xml inner.xml inner.plist.b64
cat $< | ruby -pe ' \
require "cgi"; \
x = IO.readlines("inner.xml").join.chomp; \
b = IO.readlines("inner.plist.b64").join.chomp; \
STDIN.each_line { |l| l.sub!("INBINARY", b); l.sub!("INXML",CGI::escapeHTML(x)); puts l };' > $@
nested.plist: nested.xml
plutil -convert binary1 -o $@ $<
orbit/pkg/dataflatten/testdata/nested/README.md
Vendored
+1
View File
@@ -0,0 +1 @@
Some simple shell/ruby/make hackery to get a nested plist
orbit/pkg/dataflatten/testdata/nested/inner.json
Vendored
+7
View File
@@ -0,0 +1,7 @@
{
"arr": [
"one",
"two"
],
"astring": "hello"
}
orbit/pkg/dataflatten/testdata/nested/nested.plist
Vendored
BIN
View File
Binary file not shown.
orbit/pkg/dataflatten/testdata/nested/nested.template.xml
Vendored
+11
View File
@@ -0,0 +1,11 @@
plutil -convert xml1 -o - nested.template.json
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>inbinary</key>
<data>INBINARY</data>
<key>inxml</key>
<string>INXML</string>
</dict>
</plist>
orbit/pkg/dataflatten/testdata/nested/nested.xml
Vendored
+23
View File
@@ -0,0 +1,23 @@
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
<key>inbinary</key>
<data>YnBsaXN0MDDSAQIDBlNhcnJXYXN0cmluZ6IEBVNvbmVTdHdvVWhlbGxvCA0RGRwgJAAAAAAAAAEBAAAAAAAAAAcAAAAAAAAAAAAAAAAAAAAq</data>
<key>inxml</key>
<string>&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
&lt;!DOCTYPE plist PUBLIC &quot;-//Apple//DTD PLIST 1.0//EN&quot; &quot;http://www.apple.com/DTDs/PropertyList-1.0.dtd&quot;&gt;
&lt;plist version=&quot;1.0&quot;&gt;
&lt;dict&gt;
&lt;key&gt;arr&lt;/key&gt;
&lt;array&gt;
&lt;string&gt;one&lt;/string&gt;
&lt;string&gt;two&lt;/string&gt;
&lt;/array&gt;
&lt;key&gt;astring&lt;/key&gt;
&lt;string&gt;hello&lt;/string&gt;
&lt;/dict&gt;
&lt;/plist&gt;</string>
</dict>
</plist>
plutil -convert xml1 -o - nested.template.json
orbit/pkg/dataflatten/testdata/secdata.ini
Vendored
+92
View File
@@ -0,0 +1,92 @@
[Unicode]
Unicode=yes
[System Access]
MinimumPasswordAge = 0
MaximumPasswordAge = 42
MinimumPasswordLength = 0
PasswordComplexity = 1
PasswordHistorySize = 0
LockoutBadCount = 1
ResetLockoutCount = 30
LockoutDuration = 30
RequireLogonToChangePassword = 0
ForceLogoffWhenHourExpire = 0
NewAdministratorName = "Administrator"
NewGuestName = "Guest"
ClearTextPassword = 0
LSAAnonymousNameLookup = 0
EnableAdminAccount = 0
EnableGuestAccount = 0
[Event Audit]
AuditSystemEvents = 0
AuditLogonEvents = 0
AuditObjectAccess = 0
AuditPrivilegeUse = 0
AuditPolicyChange = 0
AuditAccountManage = 0
AuditProcessTracking = 0
AuditDSAccess = 0
AuditAccountLogon = 0
[Registry Values]
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SecurityLevel=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Setup\RecoveryConsole\SetCommand=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\CachedLogonsCount=1,"10"
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ForceUnlockLogon=4,0
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\PasswordExpiryWarning=4,5
MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\ScRemoveOption=1,"0"
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin=4,5
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser=4,3
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\DontDisplayLastUserName=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\Kerberos\Parameters\SupportedEncryptionTypes=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeCaption=1,""
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\LegalNoticeText=7,
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ScForceOption=4,0
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ShutdownWithoutLogon=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\UndockWithoutLogon=4,1
MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures=4,0
MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers\AuthenticodeEnabled=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\AuditBaseObjects=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\CrashOnAuditFail=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\DisableDomainCreds=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy\Enabled=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\ForceGuest=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\FullPrivilegeAuditing=3,0
MACHINE\System\CurrentControlSet\Control\Lsa\LimitBlankPasswordUse=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinClientSec=4,536870912
MACHINE\System\CurrentControlSet\Control\Lsa\MSV1_0\NTLMMinServerSec=4,536870912
MACHINE\System\CurrentControlSet\Control\Lsa\NoLMHash=4,1
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymous=4,0
MACHINE\System\CurrentControlSet\Control\Lsa\RestrictAnonymousSAM=4,1
MACHINE\System\CurrentControlSet\Control\Print\Providers\LanMan Print Services\Servers\AddPrinterDrivers=4,0
MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedExactPaths\Machine=7,System\CurrentControlSet\Control\ProductOptions,System\CurrentControlSet\Control\Server Applications,Software\Microsoft\Windows NT\CurrentVersion
MACHINE\System\CurrentControlSet\Control\SecurePipeServers\Winreg\AllowedPaths\Machine=7,System\CurrentControlSet\Control\Print\Printers,System\CurrentControlSet\Services\Eventlog,Software\Microsoft\OLAP Server,Software\Microsoft\Windows NT\CurrentVersion\Print,Software\Microsoft\Windows NT\CurrentVersion\Windows,System\CurrentControlSet\Control\ContentIndex,System\CurrentControlSet\Control\Terminal Server,System\CurrentControlSet\Control\Terminal Server\UserConfig,System\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration,Software\Microsoft\Windows NT\CurrentVersion\Perflib,System\CurrentControlSet\Services\SysmonLog
MACHINE\System\CurrentControlSet\Control\Session Manager\Kernel\ObCaseInsensitive=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\ClearPageFileAtShutdown=4,0
MACHINE\System\CurrentControlSet\Control\Session Manager\ProtectionMode=4,1
MACHINE\System\CurrentControlSet\Control\Session Manager\SubSystems\optional=7,
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\AutoDisconnect=4,15
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableForcedLogOff=4,1
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\EnableSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\NullSessionPipes=7,
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LanManServer\Parameters\RestrictNullSessAccess=4,1
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnablePlainTextPassword=4,0
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\EnableSecuritySignature=4,1
MACHINE\System\CurrentControlSet\Services\LanmanWorkstation\Parameters\RequireSecuritySignature=4,0
MACHINE\System\CurrentControlSet\Services\LDAP\LDAPClientIntegrity=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\DisablePasswordChange=4,0
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\MaximumPasswordAge=4,30
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireSignOrSeal=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\RequireStrongKey=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SealSecureChannel=4,1
MACHINE\System\CurrentControlSet\Services\Netlogon\Parameters\SignSecureChannel=4,1
[Version]
signature="$CHICAGO$"
Revision=1