diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index b3fadbce4e..b49d917ac6 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -3279,8 +3279,8 @@ }, { "name": "size", - "description": "Size of the carved archive", - "type": "integer", + "description": "Size in bytes of the carved archive", + "type": "bigint", "notes": "", "hidden": false, "required": false, @@ -3335,6 +3335,94 @@ "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/carves.table", "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fcarves.yml&value=name%3A%20carves%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, + { + "name": "certificate_trust_settings", + "description": "Certificate Authorities trust settings installed in Keychains/ca-bundles.", + "url": "https://fleetdm.com/tables/certificate_trust_settings", + "platforms": [ + "darwin" + ], + "evented": false, + "cacheable": false, + "notes": "", + "examples": "```\nselect * from certificate_trust_settings where trust_domain = 'admin'\n```", + "columns": [ + { + "name": "common_name", + "description": "Certificate common name", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "serial", + "description": "Certificate serial number", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "trust_domain", + "description": "Certificate trust settings domain", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": true + }, + { + "name": "trust_policy_name", + "description": "Certificate trust policy name", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "trust_policy_data", + "description": "Certificate trust policy data", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "trust_allowed_error", + "description": "Certificate trust allowed error", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "trust_key_usage", + "description": "Certificate trust key usage", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "trust_result", + "description": "Certificate trust result", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + } + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/certificate_trust_settings.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fcertificate_trust_settings.yml&value=name%3A%20certificate_trust_settings%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, { "name": "certificates", "description": "[Certificate authorities](https://en.wikipedia.org/wiki/Certificate_authority) installed in Keychains/ca-bundles.", @@ -20145,7 +20233,7 @@ }, { "name": "password_policy", - "description": "Password Policies for macOS.", + "description": "OpenDirectory account policies for macOS including password content, authentication, and password change policies.", "url": "https://fleetdm.com/tables/password_policy", "platforms": [ "darwin" @@ -20190,6 +20278,24 @@ "hidden": false, "required": false, "index": false + }, + { + "name": "policy_category", + "description": "Policy category: passwordPolicyAuthentication, passwordPolicyPasswordChange, or passwordPolicyPasswordContent", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "policy_parameters", + "description": "Policy parameters serialized as JSON", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false } ], "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/password_policy.yml" @@ -26923,7 +27029,7 @@ }, { "name": "startup_items", - "description": "Applications and binaries set as user/login startup items.", + "description": "Applications and binaries set as startup items.", "url": "https://fleetdm.com/tables/startup_items", "platforms": [ "darwin", @@ -26964,7 +27070,7 @@ }, { "name": "type", - "description": "Startup Item or Login Item", + "description": "Type of startup item. On macOS this can be app, agent (LaunchAgent), daemon (LaunchDaemon), login item, or user item.", "type": "text", "notes": "", "hidden": false, @@ -26973,7 +27079,7 @@ }, { "name": "source", - "description": "Directory or plist containing startup item", + "description": "Directory containing startup item (on macOS, the subsystem providing it)", "type": "text", "notes": "", "hidden": false, @@ -26982,7 +27088,7 @@ }, { "name": "status", - "description": "Startup status; either enabled or disabled", + "description": "Startup status. On Linux: enabled or disabled. On macOS: Combination of enabled, allowed, notified, and hidden. Apple does not seem to document these status values, but allowed seems to indicate whether it is enabled in System Settings.", "type": "text", "notes": "", "hidden": false, @@ -29674,13 +29780,31 @@ }, { "name": "last_connected", - "description": "Last time this network was connected to as a unix_time", + "description": "Last time this network was connected to as a unix_time (max of last_connected_automatic and last_connected_manual, if available)", "type": "integer", "notes": "", "hidden": true, "required": false, "index": false }, + { + "name": "last_connected_automatic", + "description": "Last time this network was automatically connected to by the system as a unix_time", + "type": "integer", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "last_connected_manual", + "description": "Last time this network was manually connected to by the user as a unix_time", + "type": "integer", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, { "name": "passpoint", "description": "1 if Passpoint is supported, 0 otherwise", diff --git a/server/fleet/agent_options_generated.go b/server/fleet/agent_options_generated.go index f420a47212..d7101e24b8 100644 --- a/server/fleet/agent_options_generated.go +++ b/server/fleet/agent_options_generated.go @@ -1,4 +1,4 @@ -// Automatically generated by tools/osquery-agent-options for osquery 5.20.0. DO NOT EDIT! +// Automatically generated by tools/osquery-agent-options for osquery 5.21.0. DO NOT EDIT! // To update flags for a new osquery version, update the osqueryVersion variable in // "tools/osquery-agent-options/main.go" and run "cd server/fleet/ && go generate". package fleet @@ -56,6 +56,7 @@ type osqueryOptions struct { DistributedTlsMaxAttempts uint64 `json:"distributed_tls_max_attempts"` DistributedTlsReadEndpoint string `json:"distributed_tls_read_endpoint"` DistributedTlsWriteEndpoint string `json:"distributed_tls_write_endpoint"` + DnsResolverRefreshInterval int32 `json:"dns_resolver_refresh_interval"` DockerSocket string `json:"docker_socket"` EnableFileEvents bool `json:"enable_file_events"` EnableForeign bool `json:"enable_foreign"` @@ -203,6 +204,7 @@ type osqueryCommandLineFlags struct { DistributedTlsMaxAttempts uint64 `json:"distributed_tls_max_attempts"` DistributedTlsReadEndpoint string `json:"distributed_tls_read_endpoint"` DistributedTlsWriteEndpoint string `json:"distributed_tls_write_endpoint"` + DnsResolverRefreshInterval int32 `json:"dns_resolver_refresh_interval"` DockerSocket string `json:"docker_socket"` EnableExtensionsWatchdog bool `json:"enable_extensions_watchdog"` EnableFileEvents bool `json:"enable_file_events"` @@ -280,6 +282,7 @@ type osqueryCommandLineFlags struct { ThriftStringSizeLimit int32 `json:"thrift_string_size_limit"` ThriftTimeout uint32 `json:"thrift_timeout"` ThriftVerbose bool `json:"thrift_verbose"` + TlsAcceptGzip bool `json:"tls_accept_gzip"` TlsClientCert string `json:"tls_client_cert"` TlsClientKey string `json:"tls_client_key"` TlsDisableStatusLog bool `json:"tls_disable_status_log"` diff --git a/tools/osquery-agent-options/main.go b/tools/osquery-agent-options/main.go index 5f15d65c7a..73b6bc8b32 100644 --- a/tools/osquery-agent-options/main.go +++ b/tools/osquery-agent-options/main.go @@ -27,7 +27,7 @@ import ( var ( rxOption = regexp.MustCompile(`\-\-(\w+)\s`) - osqueryVersion = "5.20.0" + osqueryVersion = "5.21.0" structTpl = template.Must(template.New("struct").Funcs(template.FuncMap{ "camelCase": camelCaseOptionName, diff --git a/website/config/custom.js b/website/config/custom.js index 7a1b9b9d38..c959d4265c 100644 --- a/website/config/custom.js +++ b/website/config/custom.js @@ -337,7 +337,7 @@ module.exports.custom = { // // The version of osquery to use when generating schema docs // (both in Fleet's query console and on fleetdm.com) - versionOfOsquerySchemaToUseWhenGeneratingDocumentation: '5.20.0', + versionOfOsquerySchemaToUseWhenGeneratingDocumentation: '5.21.0', // ███╗ ███╗██╗███████╗ ██████╗