From adc52d3bc0d8f0c9700bce1dc0bebdb488ce6439 Mon Sep 17 00:00:00 2001 From: Mike McNeil Date: Tue, 3 May 2022 17:59:10 -0500 Subject: [PATCH] Website: Disable freeze/refreeze logic + gut sailsrc (#5547) Website: Disable freeze/refreeze logic + gut sailsrc --- website/.sailsrc | 1633 ----------------- .../webhooks/receive-from-github.js | 52 +- 2 files changed, 27 insertions(+), 1658 deletions(-) diff --git a/website/.sailsrc b/website/.sailsrc index 38d712498d..413dbcd8df 100644 --- a/website/.sailsrc +++ b/website/.sailsrc @@ -5,1638 +5,5 @@ "_generatedWith": { "sails": "1.2.5", "sails-generate": "2.0.0" - }, - "builtStaticContent": { - "markdownPages": [ - { - "url": "/docs", - "title": "Readme.md", - "lastModifiedAt": 1646430671000, - "htmlId": "docs--readme--ed2ec460b3", - "sectionRelativeRepoPath": "README.md", - "meta": {} - }, - { - "url": "/docs/deploying/configuration", - "title": "Configuration", - "lastModifiedAt": 1649972032000, - "htmlId": "docs--configuration--72a1dc9889", - "pageOrderInSectionPath": 300, - "sectionRelativeRepoPath": "Deploying/Configuration.md", - "meta": {} - }, - { - "url": "/docs/deploying/faq", - "title": "FAQ", - "lastModifiedAt": 1649172953000, - "htmlId": "docs--faq--3874399106", - "sectionRelativeRepoPath": "Deploying/FAQ.md", - "meta": {} - }, - { - "url": "/docs/deploying/introduction", - "title": "Introduction", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--introduction--d00db76aae", - "pageOrderInSectionPath": 100, - "sectionRelativeRepoPath": "Deploying/Introduction.md", - "meta": {} - }, - { - "url": "/docs/deploying/load-testing", - "title": "Load testing", - "lastModifiedAt": 1648661196000, - "htmlId": "docs--load-testing--aa697601cf", - "pageOrderInSectionPath": 500, - "sectionRelativeRepoPath": "Deploying/Load-testing.md", - "meta": {} - }, - { - "url": "/docs/deploying", - "title": "Deploying", - "lastModifiedAt": 1645753714000, - "htmlId": "docs--readme--dd9b2725d2", - "sectionRelativeRepoPath": "Deploying/README.md", - "meta": {} - }, - { - "url": "/docs/deploying/reference-architectures", - "title": "Reference architectures", - "lastModifiedAt": 1649782140000, - "htmlId": "docs--reference-architectu--a2c31bd3ed", - "pageOrderInSectionPath": 600, - "sectionRelativeRepoPath": "Deploying/Reference-Architectures.md", - "meta": {} - }, - { - "url": "/docs/deploying/server-installation", - "title": "Server installation", - "lastModifiedAt": 1649782140000, - "htmlId": "docs--server-installation--5386b18f92", - "pageOrderInSectionPath": 200, - "sectionRelativeRepoPath": "Deploying/Server-Installation.md", - "meta": {} - }, - { - "url": "/docs/deploying/upgrading-fleet", - "title": "Upgrading Fleet", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--upgrading-fleet--c651ca9547", - "pageOrderInSectionPath": 700, - "sectionRelativeRepoPath": "Deploying/Upgrading-Fleet.md", - "meta": {} - }, - { - "url": "/docs/deploying/fleetctl-agent-updates", - "title": "Fleetctl agent updates", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--fleetctl-agent-updat--a1422ca75a", - "pageOrderInSectionPath": 400, - "sectionRelativeRepoPath": "Deploying/fleetctl-agent-updates.md", - "meta": {} - }, - { - "url": "/docs/contributing/api-versioning", - "title": "API versioning", - "lastModifiedAt": 1649707478000, - "htmlId": "docs--api-versioning--6228c38457", - "pageOrderInSectionPath": 900, - "sectionRelativeRepoPath": "Contributing/API-Versioning.md", - "meta": {} - }, - { - "url": "/docs/contributing/api-for-contributors", - "title": "API for contributors", - "lastModifiedAt": 1649972032000, - "htmlId": "docs--api-for-contributors--1d255f6264", - "pageOrderInSectionPath": 800, - "sectionRelativeRepoPath": "Contributing/API-for-contributors.md", - "meta": {} - }, - { - "url": "/docs/contributing/building-fleet", - "title": "Building Fleet", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--building-fleet--bf3797241b", - "pageOrderInSectionPath": 100, - "sectionRelativeRepoPath": "Contributing/Building-Fleet.md", - "meta": {} - }, - { - "url": "/docs/contributing/faq", - "title": "FAQ", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--faq--02b0898b6c", - "sectionRelativeRepoPath": "Contributing/FAQ.md", - "meta": {} - }, - { - "url": "/docs/contributing/committing-changes", - "title": "Committing changes", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--committing-changes--6f88f3cff0", - "pageOrderInSectionPath": 400, - "sectionRelativeRepoPath": "Contributing/Committing-Changes.md", - "meta": {} - }, - { - "url": "/docs/contributing/migrations", - "title": "Migrations", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--migrations--beb654446c", - "pageOrderInSectionPath": 300, - "sectionRelativeRepoPath": "Contributing/Migrations.md", - "meta": {} - }, - { - "url": "/docs/contributing/releasing-fleet", - "title": "Releasing Fleet", - "lastModifiedAt": 1650307274000, - "htmlId": "docs--releasing-fleet--ce735c85e0", - "pageOrderInSectionPath": 500, - "sectionRelativeRepoPath": "Contributing/Releasing-Fleet.md", - "meta": {} - }, - { - "url": "/docs/contributing", - "title": "Contributing", - "lastModifiedAt": 1645753714000, - "htmlId": "docs--readme--648ed7f844", - "sectionRelativeRepoPath": "Contributing/README.md", - "meta": {} - }, - { - "url": "/docs/contributing/seeding-data", - "title": "Seeding data", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--seeding-data--f66cb5c006", - "pageOrderInSectionPath": 600, - "sectionRelativeRepoPath": "Contributing/Seeding-Data.md", - "meta": {} - }, - { - "url": "/docs/contributing/testing", - "title": "Testing", - "lastModifiedAt": 1647984761000, - "htmlId": "docs--testing--368750fbc0", - "pageOrderInSectionPath": 200, - "sectionRelativeRepoPath": "Contributing/Testing.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/adding-hosts", - "title": "Adding hosts", - "lastModifiedAt": 1649785465000, - "htmlId": "docs--adding-hosts--faca11e96a", - "pageOrderInSectionPath": 500, - "sectionRelativeRepoPath": "Using-Fleet/Adding-hosts.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/automations", - "title": "Automations", - "lastModifiedAt": 1649789295000, - "htmlId": "docs--automations--92ced45abe", - "pageOrderInSectionPath": 1300, - "sectionRelativeRepoPath": "Using-Fleet/Automations.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/faq", - "title": "FAQ", - "lastModifiedAt": 1649972032000, - "htmlId": "docs--faq--5f1ae8b1de", - "sectionRelativeRepoPath": "Using-Fleet/FAQ.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/fleet-ui", - "title": "Fleet UI", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--fleet-ui--2f00609938", - "pageOrderInSectionPath": 200, - "sectionRelativeRepoPath": "Using-Fleet/Fleet-UI.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/learn-how-to-use-fleet", - "title": "Learn how to use Fleet", - "lastModifiedAt": 1648740364000, - "htmlId": "docs--learn-how-to-use-fle--709697d122", - "pageOrderInSectionPath": 100, - "sectionRelativeRepoPath": "Using-Fleet/Learn-how-to-use-Fleet.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/monitoring-fleet", - "title": "Monitoring Fleet", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--monitoring-fleet--92c9888c3d", - "pageOrderInSectionPath": 700, - "sectionRelativeRepoPath": "Using-Fleet/Monitoring-Fleet.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/osquery-logs", - "title": "Osquery logs", - "lastModifiedAt": 1649782140000, - "htmlId": "docs--osquery-logs--ee39cb599f", - "pageOrderInSectionPath": 600, - "sectionRelativeRepoPath": "Using-Fleet/Osquery-logs.md", - "meta": {} - }, - { - "url": "/docs/using-fleet", - "title": "Using Fleet", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--readme--a7dcf9943a", - "sectionRelativeRepoPath": "Using-Fleet/README.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/permissions", - "title": "Permissions", - "lastModifiedAt": 1650298233000, - "htmlId": "docs--permissions--d59e43bb03", - "pageOrderInSectionPath": 900, - "sectionRelativeRepoPath": "Using-Fleet/Permissions.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/rest-api", - "title": "REST API", - "lastModifiedAt": 1649972032000, - "htmlId": "docs--rest-api--291ce00278", - "pageOrderInSectionPath": 400, - "sectionRelativeRepoPath": "Using-Fleet/REST-API.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/security-best-practices", - "title": "Security best practices", - "lastModifiedAt": 1646243785000, - "htmlId": "docs--security-best-practi--318a932814", - "pageOrderInSectionPath": 800, - "sectionRelativeRepoPath": "Using-Fleet/Security-best-practices.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/supported-browsers", - "title": "Supported browsers", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--supported-browsers--c0f5c62ddc", - "pageOrderInSectionPath": 1200, - "sectionRelativeRepoPath": "Using-Fleet/Supported-browsers.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/security-audits", - "title": "Security audits", - "lastModifiedAt": 1648658738000, - "htmlId": "docs--security-audits--7b5b8f8791", - "pageOrderInSectionPath": 790, - "sectionRelativeRepoPath": "Using-Fleet/Security-audits.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/supported-host-operating-systems", - "title": "Supported host operating systems", - "lastModifiedAt": 1647883352000, - "htmlId": "docs--supported-host-opera--54cf1ca38c", - "pageOrderInSectionPath": 1200, - "sectionRelativeRepoPath": "Using-Fleet/Supported-host-operating-systems.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/teams", - "title": "Teams", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--teams--03b613d1b9", - "pageOrderInSectionPath": 1000, - "sectionRelativeRepoPath": "Using-Fleet/Teams.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/usage-statistics", - "title": "Usage statistics", - "lastModifiedAt": 1645640275000, - "htmlId": "docs--usage-statistics--e3dd8a6930", - "pageOrderInSectionPath": 1100, - "sectionRelativeRepoPath": "Using-Fleet/Usage-statistics.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/vulnerability-processing", - "title": "Vulnerability processing", - "lastModifiedAt": 1649972032000, - "htmlId": "docs--vulnerability-proces--0b68805c6e", - "pageOrderInSectionPath": 1300, - "sectionRelativeRepoPath": "Using-Fleet/Vulnerability-Processing.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/fleetctl-cli", - "title": "Fleetctl CLI", - "lastModifiedAt": 1649972032000, - "htmlId": "docs--fleetctl-cli--a2f8774b92", - "pageOrderInSectionPath": 300, - "sectionRelativeRepoPath": "Using-Fleet/fleetctl-CLI.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/standard-query-library", - "title": "Standard query library", - "lastModifiedAt": 1648528760000, - "htmlId": "docs--readme--69b67ab6a6", - "sectionRelativeRepoPath": "01-Using-Fleet/standard-query-library/README.md", - "meta": {} - }, - { - "url": "/docs/using-fleet/configuration-files", - "title": "Configuration files", - "lastModifiedAt": 1649172953000, - "htmlId": "docs--readme--1305bcd8e0", - "sectionRelativeRepoPath": "Using-Fleet/configuration-files/README.md", - "meta": {} - }, - { - "url": "/handbook", - "title": "Readme.md", - "lastModifiedAt": 1650360631000, - "htmlId": "handbook--readme--5c12c5e11a", - "sectionRelativeRepoPath": "README.md", - "meta": { - "maintainedBy": "mikermcneil" - } - }, - { - "url": "/handbook/brand", - "title": "Brand", - "lastModifiedAt": 1650374154000, - "htmlId": "handbook--brand--79e3346f90", - "sectionRelativeRepoPath": "brand.md", - "meta": { - "maintainedBy": "mike-j-thomas" - } - }, - { - "url": "/handbook/community", - "title": "Community", - "lastModifiedAt": 1650149406000, - "htmlId": "handbook--community--7cbda24c1e", - "sectionRelativeRepoPath": "community.md", - "meta": { - "maintainedBy": "zwass" - } - }, - { - "url": "/handbook/customers", - "title": "Customers", - "lastModifiedAt": 1650293476000, - "htmlId": "handbook--customers--301010470b", - "sectionRelativeRepoPath": "customers.md", - "meta": { - "maintainedBy": "tgauda" - } - }, - { - "url": "/handbook/company", - "title": "Company", - "lastModifiedAt": 1650268210000, - "htmlId": "handbook--company--ad482979c5", - "sectionRelativeRepoPath": "company.md", - "meta": { - "maintainedBy": "mikermcneil" - } - }, - { - "url": "/handbook/growth", - "title": "Growth", - "lastModifiedAt": 1648597285000, - "htmlId": "handbook--growth--5ab83a6c49", - "sectionRelativeRepoPath": "growth.md", - "meta": { - "maintainedBy": "timmy-k" - } - }, - { - "url": "/handbook/handbook", - "title": "Handbook", - "lastModifiedAt": 1642145590000, - "htmlId": "handbook--handbook--742537ed11", - "sectionRelativeRepoPath": "handbook.md", - "meta": { - "maintainedBy": "mike-j-thomas" - } - }, - { - "url": "/handbook/engineering", - "title": "Engineering", - "lastModifiedAt": 1650386896000, - "htmlId": "handbook--engineering--ac21f63e1e", - "sectionRelativeRepoPath": "engineering.md", - "meta": { - "maintainedBy": "zwass" - } - }, - { - "url": "/handbook/people", - "title": "People", - "lastModifiedAt": 1649717878000, - "htmlId": "handbook--people--ea158e83e2", - "sectionRelativeRepoPath": "people.md", - "meta": { - "maintainedBy": "eashaw" - } - }, - { - "url": "/handbook/product", - "title": "Product", - "lastModifiedAt": 1650385437000, - "htmlId": "handbook--product--f6ef7d56b2", - "sectionRelativeRepoPath": "product.md", - "meta": { - "maintainedBy": "noahtalerman" - } - }, - { - "url": "/handbook/security", - "title": "Security", - "lastModifiedAt": 1650385204000, - "htmlId": "handbook--security--ea44619ec3", - "sectionRelativeRepoPath": "security.md", - "meta": { - "maintainedBy": "guillaumeross" - } - }, - { - "url": "/device-management/fleet-user-stories-f100", - "title": "Fleet user stories f100", - "lastModifiedAt": 1650416477000, - "htmlId": "articles--fleet-user-stories-f--c335f9ca99", - "sectionRelativeRepoPath": "fleet-user-stories-f100.md", - "meta": { - "category": "success stories", - "authorGitHubUsername": "mike-j-thomas", - "authorFullName": "Mike Thomas", - "publishedOn": "2021-09-29", - "articleTitle": "Fleet user stories — F100" - } - }, - { - "url": "/device-management/fleet-user-stories-schrodinger", - "title": "Fleet user stories schrodinger", - "lastModifiedAt": 1650416477000, - "htmlId": "articles--fleet-user-stories-s--256815b602", - "sectionRelativeRepoPath": "fleet-user-stories-schrodinger.md", - "meta": { - "category": "success stories", - "authorGitHubUsername": "mike-j-thomas", - "authorFullName": "Mike Thomas", - "publishedOn": "2021-09-10", - "articleTitle": "Fleet user stories — Schrödinger" - } - }, - { - "url": "/guides/deploying-fleet-on-render", - "title": "Deploying Fleet on render", - "lastModifiedAt": 1650430037000, - "htmlId": "articles--deploying-fleet-on-r--e549aa80ec", - "sectionRelativeRepoPath": "deploying-fleet-on-render.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "edwardsb", - "authorFullName": "Ben Edwards", - "publishedOn": "2021-09-21", - "articleTitle": "Deploying Fleet on Render" - } - }, - { - "url": "/guides/deploying-fleet-on-aws-with-terraform", - "title": "Deploying Fleet on aws with terraform", - "lastModifiedAt": 1650430037000, - "htmlId": "articles--deploying-fleet-on-a--48344cd7c8", - "sectionRelativeRepoPath": "deploying-fleet-on-aws-with-terraform.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "edwardsb", - "authorFullName": "Ben Edwards", - "publishedOn": "2021-11-30", - "articleTitle": "Deploying Fleet on AWS with Terraform" - } - }, - { - "url": "/device-management/fleet-user-stories-wayfair", - "title": "Fleet user stories wayfair", - "lastModifiedAt": 1650416477000, - "htmlId": "articles--fleet-user-stories-w--8ffcfe32e8", - "sectionRelativeRepoPath": "fleet-user-stories-wayfair.md", - "meta": { - "category": "success stories", - "authorGitHubUsername": "mike-j-thomas", - "authorFullName": "Mike Thomas", - "publishedOn": "2021-08-20", - "articleTitle": "Fleet user stories — Wayfair" - } - } - ], - "queries": [ - { - "name": "Get OpenSSL versions", - "platforms": "Linux", - "description": "Retrieves the OpenSSL version.", - "query": "SELECT name AS name, version AS version, 'deb_packages' AS source FROM deb_packages WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'apt_sources' AS source FROM apt_sources WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'rpm_packages' AS source FROM rpm_packages WHERE name LIKE 'openssl%';", - "purpose": "Informational", - "contributors": [ - { - "name": "Zach Wasserman", - "handle": "zwass", - "avatarUrl": "https://avatars.githubusercontent.com/u/575602?v=4", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-open-ssl-versions", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get authorized SSH keys", - "platforms": "macOS, Linux", - "description": "Presence of authorized SSH keys may be unusual on laptops. Could be completely normal on servers, but may be worth auditing for unusual keys and/or changes.", - "query": "SELECT username, authorized_keys. * FROM users CROSS JOIN authorized_keys USING (uid);", - "purpose": "Informational", - "remediation": "Check out the linked table (https://github.com/fleetdm/fleet/blob/32b4d53e7f1428ce43b0f9fa52838cbe7b413eed/handbook/queries/detect-hosts-with-high-severity-vulnerable-versions-of-openssl.md#table-of-vulnerable-openssl-versions) to determine if the installed version is a high severity vulnerability and view the corresponding CVE(s)", - "contributors": [ - { - "name": "Mike Thomas", - "handle": "mike-j-thomas", - "avatarUrl": "https://avatars.githubusercontent.com/u/78363703?v=4", - "htmlUrl": "https://github.com/mike-j-thomas" - } - ], - "kind": "query", - "slug": "get-authorized-ssh-keys", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get authorized keys for Local Accounts", - "platforms": "macOS, Linux", - "description": "List authorized_keys for each user on the system.", - "query": "SELECT * FROM users CROSS JOIN authorized_keys USING (uid);", - "purpose": "Informational", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-authorized-keys-for-local-accounts", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get authorized keys for Domain Joined Accounts", - "platforms": "macOS, Linux", - "description": "List authorized_keys for each user on the system.", - "query": "SELECT * FROM users CROSS JOIN authorized_keys USING(uid) WHERE username IN (SELECT distinct(username) FROM last);", - "purpose": "Informational", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-authorized-keys-for-domain-joined-accounts", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get crashes", - "platforms": "macOS", - "description": "Retrieve application, system, and mobile app crash logs.", - "query": "SELECT uid, datetime, responsible, exception_type, identifier, version, crash_path FROM users CROSS JOIN crashes USING (uid);", - "purpose": "Informational", - "contributors": [ - { - "name": "Zach Wasserman", - "handle": "zwass", - "avatarUrl": "https://avatars.githubusercontent.com/u/575602?v=4", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-crashes", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get installed Chrome Extensions", - "platforms": "macOS, Linux, Windows, FreeBSD", - "description": "List installed Chrome Extensions for all users.", - "query": "SELECT * FROM users CROSS JOIN chrome_extensions USING (uid);", - "purpose": "Informational", - "contributors": [ - { - "name": "Zach Wasserman", - "handle": "zwass", - "avatarUrl": "https://avatars.githubusercontent.com/u/575602?v=4", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-chrome-extensions", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get installed FreeBSD software", - "platforms": "FreeBSD", - "description": "Get all software installed on a FreeBSD computer, including browser plugins and installed packages. Note, this does not include other running processes in the processes table.", - "query": "SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name AS name, version AS version, 'Package (Atom)' AS type, 'atom_packages' AS source FROM atom_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Package (pkg)' AS type, 'pkg_packages' AS source FROM pkg_packages;", - "purpose": "Informational", - "contributors": [ - { - "name": "Zach Wasserman", - "handle": "zwass", - "avatarUrl": "https://avatars.githubusercontent.com/u/575602?v=4", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-free-bsd-software", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get installed Linux software", - "platforms": "Linux", - "description": "Get all software installed on a Linux computer, including browser plugins and installed packages. Note, this does not include other running processes in the processes table.", - "query": "SELECT name AS name, version AS version, 'Package (APT)' AS type, 'apt_sources' AS source FROM apt_sources UNION SELECT name AS name, version AS version, 'Package (deb)' AS type, 'deb_packages' AS source FROM deb_packages UNION SELECT package AS name, version AS version, 'Package (Portage)' AS type, 'portage_packages' AS source FROM portage_packages UNION SELECT name AS name, version AS version, 'Package (RPM)' AS type, 'rpm_packages' AS source FROM rpm_packages UNION SELECT name AS name, '' AS version, 'Package (YUM)' AS type, 'yum_sources' AS source FROM yum_sources UNION SELECT name AS name, version AS version, 'Package (NPM)' AS type, 'npm_packages' AS source FROM npm_packages UNION SELECT name AS name, version AS version, 'Package (Atom)' AS type, 'atom_packages' AS source FROM atom_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages;", - "purpose": "Informational", - "contributors": [ - { - "name": "Zach Wasserman", - "handle": "zwass", - "avatarUrl": "https://avatars.githubusercontent.com/u/575602?v=4", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-linux-software", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get installed macOS software", - "platforms": "macOS", - "description": "Get all software installed on a macOS computer, including apps, browser plugins, and installed packages. Note, this does not include other running processes in the processes table.", - "query": "SELECT name AS name, bundle_short_version AS version, 'Application (macOS)' AS type, 'apps' AS source FROM apps UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name As name, version AS version, 'Browser plugin (Safari)' AS type, 'safari_extensions' AS source FROM safari_extensions UNION SELECT name AS name, version AS version, 'Package (Homebrew)' AS type, 'homebrew_packages' AS source FROM homebrew_packages;", - "purpose": "Informational", - "contributors": [ - { - "name": "Zach Wasserman", - "handle": "zwass", - "avatarUrl": "https://avatars.githubusercontent.com/u/575602?v=4", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-mac-os-software", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get installed Safari extensions", - "platforms": "macOS", - "description": "Retrieves the list of installed Safari Extensions for all users in the target system.", - "query": "SELECT safari_extensions.* FROM users join safari_extensions USING (uid);", - "purpose": "Informational", - "contributors": [ - { - "name": "Zach Wasserman", - "handle": "zwass", - "avatarUrl": "https://avatars.githubusercontent.com/u/575602?v=4", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-safari-extensions", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get installed Windows software", - "platforms": "Windows", - "description": "Get all software installed on a Windows computer, including programs, browser plugins, and installed packages. Note, this does not include other running processes in the processes table.", - "query": "SELECT name AS name, version AS version, 'Program (Windows)' AS type, 'programs' AS source FROM programs UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (IE)' AS type, 'ie_extensions' AS source FROM ie_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name AS name, version AS version, 'Package (Chocolatey)' AS type, 'chocolatey_packages' AS source FROM chocolatey_packages UNION SELECT name AS name, version AS version, 'Package (Atom)' AS type, 'atom_packages' AS source FROM atom_packages;", - "purpose": "Informational", - "contributors": [ - { - "name": "Zach Wasserman", - "handle": "zwass", - "avatarUrl": "https://avatars.githubusercontent.com/u/575602?v=4", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-windows-software", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get laptops with failing batteries", - "platforms": "macOS", - "description": "Lists all laptops with under-performing or failing batteries.", - "query": "SELECT * FROM battery WHERE health != 'Good' AND condition NOT IN ('', 'Normal');", - "purpose": "Informational", - "contributors": [ - { - "name": "Zach Wasserman", - "handle": "zwass", - "avatarUrl": "https://avatars.githubusercontent.com/u/575602?v=4", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-laptops-with-failing-batteries", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get current users with active shell/console on the system", - "platforms": "macOS, Linux, Windows, FreeBSD", - "description": "Get current users with active shell/console on the system and associated process", - "query": "SELECT user,host,time, p.name, p.cmdline, p.cwd, p.root FROM logged_in_users liu, processes p WHERE liu.pid = p.pid and liu.type='user' and liu.user <> '' ORDER BY time;", - "purpose": "Informational", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-current-users-with-active-shell-console-on-the-system", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get unencrypted SSH keys for local accounts", - "platforms": "macOS, Linux, Windows, FreeBSD", - "description": "Identify SSH keys created without a passphrase which can be used in Lateral Movement (MITRE. TA0008)", - "query": "SELECT uid, username, description, path, encrypted FROM users CROSS JOIN user_ssh_keys using (uid) WHERE encrypted=0;", - "purpose": "Informational", - "remediation": "First, make the user aware about the impact of SSH keys. Then rotate the unencrypted keys detected.", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-unencrypted-ssh-keys-for-local-accounts", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get unencrypted SSH keys for domain joined accounts", - "platforms": "macOS, Linux, Windows, FreeBSD", - "description": "Identify SSH keys created without a passphrase which can be used in Lateral Movement (MITRE. TA0008)", - "query": "SELECT uid, username, description, path, encrypted FROM users CROSS JOIN user_ssh_keys using (uid) WHERE encrypted=0 and username in (SELECT distinct(username) FROM last);", - "purpose": "Informational", - "remediation": "First, make the user aware about the impact of SSH keys. Then rotate the unencrypted keys detected.", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-unencrypted-ssh-keys-for-domain-joined-accounts", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get dynamic linker hijacking on Linux (MITRE. T1574.006)", - "platforms": "Linux", - "description": "Detect any processes that run with LD_PRELOAD environment variable", - "query": "SELECT env.pid, env.key, env.value, p.name,p.path, p.cmdline, p.cwd FROM process_envs env join processes p USING (pid) WHERE key='LD_PRELOAD';", - "purpose": "Informational", - "remediation": "Identify the process/binary detected and confirm with the system's owner.", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-dynamic-linker-hijacking-on-linux-mitre-t-1574-006", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get dynamic linker hijacking on macOS (MITRE. T1574.006)", - "platforms": "macOS", - "description": "Detect any processes that run with DYLD_INSERT_LIBRARIES environment variable", - "query": "SELECT env.pid, env.key, env.value, p.name,p.path, p.cmdline, p.cwd FROM process_envs env join processes p USING (pid) WHERE key='DYLD_INSERT_LIBRARIES';", - "purpose": "Informational", - "remediation": "Identify the process/binary detected and confirm with the system's owner.", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-dynamic-linker-hijacking-on-mac-os-mitre-t-1574-006", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get etc hosts entries", - "platforms": "macOS, Linux", - "description": "Line-parsed /etc/hosts", - "query": "SELECT * FROM etc_hosts WHERE address not in ('127.0.0.1', '::1');", - "purpose": "Informational", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-etc-hosts-entries", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get network interfaces", - "platforms": "macOS, Linux, Windows, FreeBSD", - "description": "Network interfaces MAC address", - "query": "SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details d USING (interface) WHERE address not in ('127.0.0.1', '::1');", - "purpose": "Informational", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-network-interfaces", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get local user accounts", - "platforms": "macOS, Linux, Windows, FreeBSD", - "description": "Local user accounts (including domain accounts that have logged on locally (Windows)).", - "query": "SELECT uid, gid, username, description,directory, shell FROM users;", - "purpose": "Informational", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-local-user-accounts", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get active user accounts on servers", - "platforms": "Linux", - "description": "Domain Joined environment normally have root or other service account only and users are SSH-ing using their Domain Accounts.", - "query": "SELECT * FROM shadow WHERE password_status='active' and username!='root';", - "purpose": "Informational", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-active-user-accounts-on-servers", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get Nmap scanner", - "platforms": "macOS, Linux, Windows, FreeBSD", - "description": "Get Nmap scanner process, as well as its user, parent, and process details.", - "query": "SELECT p.pid, name, p.path, cmdline, cwd, start_time, parent, (SELECT name FROM processes WHERE pid=p.parent) AS parent_name, (SELECT username FROM users WHERE uid=p.uid) AS username FROM processes as p WHERE cmdline like 'nmap%';", - "purpose": "Informational", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-nmap-scanner", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get Docker contained processes on a system", - "platforms": "macOS, Linux", - "description": "Docker containers Processes, can be used on normal system or a kubenode.", - "query": "SELECT c.id, c.name, c.image, c.image_id, c.command, c.created, c.state, c.status, p.cmdline FROM docker_containers c CROSS JOIN docker_container_processes p using(id);", - "purpose": "Informational", - "contributors": [ - { - "name": "Ahmed Elshaer", - "handle": "anelshaer", - "avatarUrl": "https://avatars.githubusercontent.com/u/4087461?v=4", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-docker-contained-processes-on-a-system", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get Windows print spooler remote code execution vulnerability", - "platforms": "Windows", - "description": "Detects devices that are potentially vulnerable to CVE-2021-1675 because the print spooler service is not disabled.", - "query": "SELECT CASE cnt WHEN 2 THEN \"TRUE\" ELSE \"FALSE\" END \"Vulnerable\" FROM (SELECT name start_type, COUNT(name) AS cnt FROM services WHERE name = 'NTDS' or (name = 'Spooler' and start_type <> 'DISABLED')) WHERE cnt = 2;", - "purpose": "Informational", - "contributors": [ - { - "name": null, - "handle": "maravedi", - "avatarUrl": "https://avatars.githubusercontent.com/u/9169890?v=4", - "htmlUrl": "https://github.com/maravedi" - } - ], - "kind": "query", - "slug": "get-windows-print-spooler-remote-code-execution-vulnerability", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get local users and their privileges", - "platforms": "macOS, Linux, Windows", - "description": "Collects the local user accounts and their respective user group.", - "query": "SELECT uid, username, type, groupname FROM users u JOIN groups g ON g.gid = u.gid;", - "purpose": "Informational", - "contributors": [ - { - "name": "Noah Talerman", - "handle": "noahtalerman", - "avatarUrl": "https://avatars.githubusercontent.com/u/47070608?v=4", - "htmlUrl": "https://github.com/noahtalerman" - } - ], - "kind": "query", - "slug": "get-local-users-and-their-privileges", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get processes that no longer exist on disk", - "platforms": "Linux, macOS, Windows", - "description": "Lists all processes of which the binary which launched them no longer exists on disk. Attackers often delete files from disk after launching process to mask presence.", - "query": "SELECT name, path, pid FROM processes WHERE on_disk = 0;", - "purpose": "Incident response", - "contributors": [ - { - "name": "AndrewB", - "handle": "alphabrevity", - "avatarUrl": "https://avatars.githubusercontent.com/u/3847973?v=4", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-processes-that-no-longer-exist-on-disk", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get user files matching a specific hash", - "platforms": "macOS, Linux", - "description": "Looks for specific hash in the Users/ directories for files that are less than 50MB (osquery file size limitation.)", - "query": "SELECT path, sha256 FROM hash WHERE path IN (SELECT path FROM file WHERE size < 50000000 AND path LIKE '/Users/%/Documents/%%') AND sha256 = '16d28cd1d78b823c4f961a6da78d67a8975d66cde68581798778ed1f98a56d75';", - "purpose": "Informational", - "contributors": [ - { - "name": "AndrewB", - "handle": "alphabrevity", - "avatarUrl": "https://avatars.githubusercontent.com/u/3847973?v=4", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-user-files-matching-a-specific-hash", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get local administrator accounts on macOS", - "platforms": "macOS", - "description": "The query allows you to check macOS systems for local administrator accounts.", - "query": "SELECT uid, username, type, groupname FROM users u JOIN groups g ON g.gid = u.gid;", - "purpose": "Informational", - "contributors": [ - { - "name": "AndrewB", - "handle": "alphabrevity", - "avatarUrl": "https://avatars.githubusercontent.com/u/3847973?v=4", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-local-administrator-accounts-on-mac-os", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get all listening ports, by process", - "platforms": "Linux, macOS, Windows", - "description": "List ports that are listening on all interfaces, along with the process to which they are attached.", - "query": "SELECT lp.address, lp.pid, lp.port, lp.protocol, p.name, p.path, p.cmdline FROM listening_ports lp JOIN processes p ON lp.pid = p.pid WHERE lp.address = \"0.0.0.0\";", - "purpose": "Informational", - "contributors": [ - { - "name": "AndrewB", - "handle": "alphabrevity", - "avatarUrl": "https://avatars.githubusercontent.com/u/3847973?v=4", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-all-listening-ports-by-process", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get whether TeamViewer is installed/running", - "platforms": "Windows", - "description": "Looks for the TeamViewer service running on machines. This is used often when attackers gain access to a machine, running TeamViewer to allow them to access a machine.", - "query": "SELECT display_name,status,s.pid,p.path FROM services AS s JOIN processes AS p USING(pid) WHERE s.name LIKE \"%teamviewer%\";", - "purpose": "Informational", - "contributors": [ - { - "name": "AndrewB", - "handle": "alphabrevity", - "avatarUrl": "https://avatars.githubusercontent.com/u/3847973?v=4", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-whether-team-viewer-is-installed-running", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get malicious Python backdoors", - "platforms": "macOS, Linux, Windows", - "description": "Watches for the backdoored Python packages installed on system. See (http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/index.html)", - "query": "SELECT CASE cnt WHEN 0 THEN \"NONE_INSTALLED\" ELSE \"INSTALLED\" END AS \"Malicious Python Packages\", package_name, package_version FROM (SELECT COUNT(name) AS cnt, name AS package_name, version AS package_version, path AS package_path FROM python_packages WHERE package_name IN ('acqusition', 'apidev-coop', 'bzip', 'crypt', 'django-server', 'pwd', 'setup-tools', 'telnet', 'urlib3', 'urllib'));", - "purpose": "Informational", - "contributors": [ - { - "name": "AndrewB", - "handle": "alphabrevity", - "avatarUrl": "https://avatars.githubusercontent.com/u/3847973?v=4", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-malicious-python-backdoors", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Check for artifacts of the Floxif trojan", - "platforms": "Windows", - "description": "Checks for artifacts from the Floxif trojan on Windows machines.", - "query": "SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Piriform\\\\Agomo%';", - "purpose": "Informational", - "contributors": [ - { - "name": "Babatunde Micheal Okutubo", - "handle": "micheal-o", - "avatarUrl": "https://avatars.githubusercontent.com/u/22627292?v=4", - "htmlUrl": "https://github.com/micheal-o" - } - ], - "kind": "query", - "slug": "check-for-artifacts-of-the-floxif-trojan", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get shimcache table", - "platforms": "Windows", - "description": "Returns forensic data showing evidence of likely file execution, in addition to the last modified timestamp of the file, order of execution, full file path order of execution, and the order in which files were executed.", - "query": "select * from shimcache", - "purpose": "Informational", - "contributors": [ - { - "name": null, - "handle": "puffyCid", - "avatarUrl": "https://avatars.githubusercontent.com/u/16283453?v=4", - "htmlUrl": "https://github.com/puffyCid" - } - ], - "kind": "query", - "slug": "get-shimcache-table", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get running docker containers", - "platforms": "macOS, Linux", - "description": "Returns the running Docker containers", - "query": "SELECT id, name, image, image_id, state, status FROM docker_containers WHERE state = \"running\";", - "purpose": "Informational", - "contributors": [ - { - "name": "Kelvin Oghenerhoro Omereshone", - "handle": "DominusKelvin", - "avatarUrl": "https://avatars.githubusercontent.com/u/24433274?v=4", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-running-docker-containers", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get applications hogging memory", - "platforms": "macOS, Linux, Windows", - "description": "Returns top 10 applications or processes hogging memory the most.", - "query": "SELECT pid, name, ROUND((total_size * '10e-7'), 2) AS memory_used FROM processes ORDER BY total_size DESC LIMIT 10;", - "purpose": "Informational", - "contributors": [ - { - "name": "Kelvin Oghenerhoro Omereshone", - "handle": "DominusKelvin", - "avatarUrl": "https://avatars.githubusercontent.com/u/24433274?v=4", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-applications-hogging-memory", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get servers with root login in the last 24 hours", - "platforms": "macOS, Linux, Windows", - "description": "Returns servers with root login in the last 24 hours and the time the users where logged in.", - "query": "SELECT * FROM last WHERE username = \"root\" AND time > (( SELECT unix_time FROM time ) - 86400 );", - "purpose": "Informational", - "contributors": [ - { - "name": "Kelvin Oghenerhoro Omereshone", - "handle": "DominusKelvin", - "avatarUrl": "https://avatars.githubusercontent.com/u/24433274?v=4", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-servers-with-root-login-in-the-last-24-hours", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Detect active processes with Log4j running", - "platforms": "macOS, Linux", - "description": "Returns a list of active processes and the Jar paths which are using Log4j. Version numbers are usually within the Jar filename. Note: This query is resource intensive and has caused problems on systems with limited swap space. Test on some systems before running this widely.", - "query": "WITH target_jars AS (\n SELECT DISTINCT path\n FROM (\n WITH split(word, str) AS(\n SELECT '', cmdline || ' '\n FROM processes\n UNION ALL\n SELECT substr(str, 0, instr(str, ' ')), substr(str, instr(str, ' ') + 1)\n FROM split\n WHERE str != '')\n SELECT word AS path\n FROM split\n WHERE word LIKE '%.jar'\n UNION ALL\n SELECT path\n FROM process_open_files\n WHERE path LIKE '%.jar'\n )\n)\nSELECT path, matches\nFROM yara\nWHERE path IN (SELECT path FROM target_jars)\n AND count > 0\n AND sigrule IN (\n 'rule log4jJndiLookup {\n strings:\n $jndilookup = \"JndiLookup\"\n condition:\n $jndilookup\n }',\n 'rule log4jJavaClass {\n strings:\n $javaclass = \"org/apache/logging/log4j\"\n condition:\n $javaclass\n }'\n );\n", - "purpose": "Detection", - "contributors": [ - { - "name": "Zach Wasserman", - "handle": "zwass", - "avatarUrl": "https://avatars.githubusercontent.com/u/575602?v=4", - "htmlUrl": "https://github.com/zwass" - }, - { - "name": "Tony Gauda", - "handle": "tgauda", - "avatarUrl": "https://avatars.githubusercontent.com/u/5620541?v=4", - "htmlUrl": "https://github.com/tgauda" - } - ], - "kind": "query", - "slug": "detect-active-processes-with-log-4-j-running", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get applications that were opened within the last 24 hours", - "platforms": "macOS", - "description": "Returns applications that were opened within the last 24 hours starting with the last opened application.", - "query": "SELECT * FROM apps WHERE last_opened_time > (( SELECT unix_time FROM time ) - 86400 ) ORDER BY last_opened_time DESC;", - "purpose": "Informational", - "contributors": [ - { - "name": "Kelvin Oghenerhoro Omereshone", - "handle": "DominusKelvin", - "avatarUrl": "https://avatars.githubusercontent.com/u/24433274?v=4", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-applications-that-were-opened-within-the-last-24-hours", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get applications that are not in the Applications directory", - "platforms": "macOS", - "description": "Returns applications that are not in the `/Applications` directory", - "query": "SELECT * FROM apps WHERE path NOT LIKE '/Applications/%';", - "purpose": "Informational", - "contributors": [ - { - "name": "Kelvin Oghenerhoro Omereshone", - "handle": "DominusKelvin", - "avatarUrl": "https://avatars.githubusercontent.com/u/24433274?v=4", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-applications-that-are-not-in-the-applications-directory", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get subscription-based applications that have not been opened for the last 30 days", - "platforms": "macOS", - "description": "Returns applications that are subscription-based and have not been opened for the last 30 days. You can replace the list of applications with those specific to your use case.", - "query": "SELECT * FROM apps WHERE path LIKE '/Applications/%' AND name IN (\"Photoshop.app\", \"Adobe XD.app\", \"Sketch.app\", \"Illustrator.app\") AND last_opened_time < (( SELECT unix_time FROM time ) - 2592000000000 );", - "purpose": "Informational", - "contributors": [ - { - "name": "Kelvin Oghenerhoro Omereshone", - "handle": "DominusKelvin", - "avatarUrl": "https://avatars.githubusercontent.com/u/24433274?v=4", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-subscription-based-applications-that-have-not-been-opened-for-the-last-30-days", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Gatekeeper enabled (macOS)", - "query": "SELECT 1 FROM gatekeeper WHERE assessments_enabled = 1;", - "description": "Checks to make sure that the Gatekeeper feature is enabled on macOS devices. Gatekeeper tries to ensure only trusted software is run on a mac machine.", - "resolution": "To enable Gatekeeper, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable.", - "platforms": "macOS", - "platform": "darwin", - "contributors": [ - { - "name": "Victor Vrantchan", - "handle": "groob", - "avatarUrl": "https://avatars.githubusercontent.com/u/1526945?v=4", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "gatekeeper-enabled-mac-os", - "tags": [] - }, - { - "name": "Full disk encryption enabled (Windows)", - "query": "SELECT 1 FROM bitlocker_info where protection_status = 1;", - "description": "Checks to make sure that full disk encryption is enabled on Windows devices.", - "resolution": "To get additional information, run the following osquery query on the failing device: SELECT * FROM bitlocker_info. In the query results, if protection_status is 2, then the status cannot be determined. If it is 0, it is considered unprotected. Use the additional results (percent_encrypted, conversion_status, etc.) to help narrow down the specific reason why Windows considers the volume unprotected.", - "platforms": "Windows", - "platform": "windows", - "contributors": [ - { - "name": "Josh Brower", - "handle": "defensivedepth", - "avatarUrl": "https://avatars.githubusercontent.com/u/954732?v=4", - "htmlUrl": "https://github.com/defensivedepth" - } - ], - "kind": "policy", - "slug": "full-disk-encryption-enabled-windows", - "tags": [] - }, - { - "name": "Full disk encryption enabled (macOS)", - "query": "SELECT 1 FROM disk_encryption WHERE user_uuid IS NOT \"\" AND filevault_status = 'on' LIMIT 1;", - "description": "Checks to make sure that full disk encryption (FileVault) is enabled on macOS devices.", - "resolution": "To enable full disk encryption, on the failing device, select System Preferences > Security & Privacy > FileVault > Turn On FileVault.", - "platforms": "macOS", - "platform": "darwin", - "contributors": [ - { - "name": "Victor Vrantchan", - "handle": "groob", - "avatarUrl": "https://avatars.githubusercontent.com/u/1526945?v=4", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "full-disk-encryption-enabled-mac-os", - "tags": [] - }, - { - "name": "Full disk encryption enabled (Linux)", - "query": "SELECT 1 FROM disk_encryption WHERE encrypted=1 AND name LIKE '/dev/dm-1';", - "description": "Checks if the root drive is encrypted. There are many ways to encrypt Linux systems. This is the default on distributions such as Ubuntu.", - "resolution": "Ensure the image deployed to your Linux workstation includes full disk encryption.", - "platforms": "Linux", - "platform": "linux", - "contributors": [ - { - "name": "Guillaume Ross", - "handle": "GuillaumeRoss", - "avatarUrl": "https://avatars.githubusercontent.com/u/73836008?v=4", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "full-disk-encryption-enabled-linux", - "tags": [] - }, - { - "name": "System Integrity Protection enabled (macOS)", - "query": "SELECT 1 FROM sip_config WHERE config_flag = 'sip' AND enabled = 1;", - "description": "Checks to make sure that the System Integrity Protection feature is enabled.", - "resolution": "To enable System Integrity Protection, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable.", - "platforms": "macOS", - "platform": "darwin", - "contributors": [ - { - "name": "Victor Vrantchan", - "handle": "groob", - "avatarUrl": "https://avatars.githubusercontent.com/u/1526945?v=4", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "system-integrity-protection-enabled-mac-os", - "tags": [] - }, - { - "name": "Automatic login disabled (macOS)", - "query": "SELECT 1 FROM managed_policies WHERE domain = 'com.apple.loginwindow' AND name = 'com.apple.login.mcx.DisableAutoLoginClient' AND value = 1 LIMIT 1;", - "description": "Required: You’re already enforcing a policy via Moble Device Management (MDM). Checks to make sure that the device user cannot log in to the device without a password.", - "resolution": "The following example profile includes a setting to disable automatic login: https://github.com/gregneagle/profiles/blob/fecc73d66fa17b6fa78b782904cb47cdc1913aeb/loginwindow.mobileconfig#L64-L65.", - "platforms": "macOS", - "platform": "darwin", - "contributors": [ - { - "name": "Victor Vrantchan", - "handle": "groob", - "avatarUrl": "https://avatars.githubusercontent.com/u/1526945?v=4", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "automatic-login-disabled-mac-os", - "tags": [] - }, - { - "name": "Guest users disabled (macOS)", - "query": "SELECT 1 FROM managed_policies WHERE domain = 'com.apple.loginwindow' AND name = 'DisableGuestAccount' AND value = 1 LIMIT 1;", - "description": "Required: You’re already enforcing a policy via Moble Device Management (MDM). Checks to make sure that guest accounts cannot be used to log in to the device without a password.", - "resolution": "The following example profile includes a setting to disable guest users: https://github.com/gregneagle/profiles/blob/fecc73d66fa17b6fa78b782904cb47cdc1913aeb/loginwindow.mobileconfig#L68-L71.", - "platforms": "macOS", - "platform": "darwin", - "contributors": [ - { - "name": "Victor Vrantchan", - "handle": "groob", - "avatarUrl": "https://avatars.githubusercontent.com/u/1526945?v=4", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "guest-users-disabled-mac-os", - "tags": [] - }, - { - "name": "Secure keyboard entry for Terminal.app enabled (macOS)", - "query": "SELECT 1 FROM managed_policies WHERE domain = 'com.apple.Terminal' AND name = 'SecureKeyboardEntry' AND value = 1 LIMIT 1;", - "description": "Required: You’re already enforcing a policy via Moble Device Management (MDM). Checks to make sure that the Secure Keyboard Entry setting is enabled.", - "platforms": "macOS", - "platform": "darwin", - "contributors": [ - { - "name": "Victor Vrantchan", - "handle": "groob", - "avatarUrl": "https://avatars.githubusercontent.com/u/1526945?v=4", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "secure-keyboard-entry-for-terminal-app-enabled-mac-os", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get built-in antivirus status on macOS", - "platforms": "macOS", - "query": "SELECT path, value AS version FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist') OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist');", - "description": "Reads the version numbers from the Malware Removal Tool (MRT) and built-in antivirus (XProtect) plists", - "purpose": "Informational", - "contributors": [ - { - "name": "Guillaume Ross", - "handle": "GuillaumeRoss", - "avatarUrl": "https://avatars.githubusercontent.com/u/73836008?v=4", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "query", - "slug": "get-built-in-antivirus-status-on-mac-os", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get antivirus status from the Windows Security Center", - "platforms": "Windows", - "query": "SELECT antivirus, signatures_up_to_date from windows_security_center CROSS JOIN windows_security_products WHERE type = 'Antivirus';", - "description": "Selects the antivirus and signatures status from Windows Security Center.", - "purpose": "Informational", - "contributors": [ - { - "name": "Guillaume Ross", - "handle": "GuillaumeRoss", - "avatarUrl": "https://avatars.githubusercontent.com/u/73836008?v=4", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "query", - "slug": "get-antivirus-status-from-the-windows-security-center", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Get antivirus (ClamAV/clamd) and updater (freshclam) process status", - "platforms": "Linux", - "query": "SELECT pid, state, cmdline, name FROM processes WHERE name='clamd' OR name='freshclam';", - "description": "Selects the clamd and freshclam processes to ensure AV and its updater are running", - "purpose": "Informational", - "contributors": [ - { - "name": "Guillaume Ross", - "handle": "GuillaumeRoss", - "avatarUrl": "https://avatars.githubusercontent.com/u/73836008?v=4", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "query", - "slug": "get-antivirus-clam-av-clamd-and-updater-freshclam-process-status", - "resolution": "N/A", - "tags": [] - }, - { - "name": "Antivirus healthy (macOS)", - "query": "SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist' AND value>=2155) OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist' and value>=1.88)) WHERE score == 1;", - "description": "Checks the version of Malware Removal Tool (MRT) and the built-in macOS AV (Xprotect). Replace version numbers with latest version regularly.", - "resolution": "To enable automatic security definition updates, on the failing device, select System Preferences > Software Update > Advanced > Turn on Install system data files and security updates.", - "platforms": "macOS", - "platform": "darwin", - "contributors": [ - { - "name": "Guillaume Ross", - "handle": "GuillaumeRoss", - "avatarUrl": "https://avatars.githubusercontent.com/u/73836008?v=4", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "antivirus-healthy-mac-os", - "tags": [] - }, - { - "name": "Antivirus healthy (Windows)", - "query": "SELECT 1 from windows_security_center wsc CROSS JOIN windows_security_products wsp WHERE antivirus = 'Good' AND type = 'Antivirus' AND signatures_up_to_date=1;", - "description": "Checks the status of antivirus and signature updates from the Windows Security Center.", - "resolution": "Ensure Windows Defender or your third-party antivirus is running, up to date, and visible in the Windows Security Center.", - "platforms": "Windows", - "platform": "windows", - "contributors": [ - { - "name": "Guillaume Ross", - "handle": "GuillaumeRoss", - "avatarUrl": "https://avatars.githubusercontent.com/u/73836008?v=4", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "antivirus-healthy-windows", - "tags": [] - }, - { - "name": "Antivirus healthy (Linux)", - "query": "SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM processes WHERE (name = 'clamd') OR (name = 'freshclam')) WHERE score == 1;", - "description": "Checks that both ClamAV's daemon and its updater service (freshclam) are running.", - "resolution": "Ensure ClamAV and Freshclam are installed and running.", - "platforms": "Linux", - "platform": "linux", - "contributors": [ - { - "name": "Guillaume Ross", - "handle": "GuillaumeRoss", - "avatarUrl": "https://avatars.githubusercontent.com/u/73836008?v=4", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "antivirus-healthy-linux", - "tags": [] - }, - { - "name": "MDM Enrolled (macOS)", - "query": "SELECT 1 from mdm WHERE enrolled='true';", - "description": "Required: osquery deployed with Orbit, or manual installation of macadmins/osquery-extension. Checks that a Mac is enrolled to MDM. Add a AND on identity_certificate_uuid to check for a specific MDM.", - "resolution": "Enroll device to MDM", - "platforms": "macOS", - "platform": "darwin", - "contributors": [ - { - "name": "Guillaume Ross", - "handle": "GuillaumeRoss", - "avatarUrl": "https://avatars.githubusercontent.com/u/73836008?v=4", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "mdm-enrolled-mac-os", - "tags": [] - }, - { - "name": "Application is up to date or not present (macOS)", - "query": "SELECT 1 WHERE EXISTS (SELECT 1 FROM apps a1 WHERE a1.bundle_identifier = 'com.electron.dockerdesktop' AND a1.bundle_short_version>='4.6.1') OR NOT EXISTS (SELECT 1 FROM apps a2 WHERE a2.bundle_identifier = 'com.electron.dockerdesktop');", - "description": "Checks if the application (Docker Desktop example) is installed and up to date, or not installed. Fails if the application is installed and on a lower version. You can copy this query and replace the bundle_identifier and bundle_version values to apply the same type of policy to other applications.", - "resolution": "Update Docker or remove it if not used.", - "platforms": "macOS", - "platform": "darwin", - "contributors": [ - { - "name": "Guillaume Ross", - "handle": "GuillaumeRoss", - "avatarUrl": "https://avatars.githubusercontent.com/u/73836008?v=4", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "application-is-up-to-date-or-not-present-mac-os", - "tags": [] - }, - { - "name": "SSH keys encrypted", - "query": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM users CROSS JOIN user_ssh_keys USING (uid) WHERE encrypted='0');", - "description": "Required: osquery must have Full Disk Access. Policy passes if all keys are encrypted, including if no keys are present.", - "resolution": "Use this command to encrypt existing SSH keys by providing the path to the file: ssh-keygen -o -p -f /path/to/file", - "platforms": "macOS, Linux, Windows", - "platform": "darwin,linux,windows", - "contributors": [ - { - "name": "Guillaume Ross", - "handle": "GuillaumeRoss", - "avatarUrl": "https://avatars.githubusercontent.com/u/73836008?v=4", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "ssh-keys-encrypted", - "tags": [] - } - ], - "queryLibraryYmlRepoPath": "docs/01-Using-Fleet/standard-query-library/standard-query-library.yml", - "compiledPagePartialsAppPath": "views/partials/built-from-markdown" } } diff --git a/website/api/controllers/webhooks/receive-from-github.js b/website/api/controllers/webhooks/receive-from-github.js index 5693b4bfc6..c75a28570b 100644 --- a/website/api/controllers/webhooks/receive-from-github.js +++ b/website/api/controllers/webhooks/receive-from-github.js @@ -277,31 +277,33 @@ module.exports = { }, baseHeaders); } - // Temporarily disable re-freeze logic to troubleshoot website caching issues on 2022-05-03. - // (very unlikely this is a culprit, but ruling out race conditions) - // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -// // And also unfreeze and re-freeze to temporarily allow merging. -// // [?] https://github.com/fleetdm/fleet/issues/5179 -// if (isAutoApproved) { - -// let mergeFreezeReport = await sails.helpers.http.get('https://www.mergefreeze.com/api/branches/fleetdm/fleet/main', { access_token: sails.config.custom.mergeFreezeAccessToken });//eslint-disable-line camelcase -// if (mergeFreezeReport.frozen) { -// await sails.helpers.http.post('https://www.mergefreeze.com/api/branches/fleetdm/fleet/main', { frozen: false, access_token: sails.config.custom.mergeFreezeAccessToken, user_name: 'fleet-release' });//eslint-disable-line camelcase - -// // Then, in the background, 2 minutes later... -// setTimeout(()=>{ -// sails.helpers.http.post('https://www.mergefreeze.com/api/branches/fleetdm/fleet/main', { frozen: true, access_token: sails.config.custom.mergeFreezeAccessToken, user_name: 'fleet-release' })//eslint-disable-line camelcase -// .exec((err)=>{ -// if (err) { -// sails.log.error('Background instruction failed: Unexpected error re-freezing repo (see https://github.com/fleetdm/fleet/issues/5179 for background):', err); -// } -// sails.log.info('Re-freeze completed successfully.'); -// });//_∏_ -// }, 2*60*1000);//_∏_ -// }//fi - -// }//fi - // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + // And also unfreeze and re-freeze to temporarily allow merging. + // [?] https://github.com/fleetdm/fleet/issues/5179 + // // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + // > Temporarily disable re-freeze logic to troubleshoot website caching issues on 2022-05-03. + // > (very unlikely this is a culprit, but ruling out race conditions) + // > ~mikermcneil + // // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + // if (isAutoApproved) { + // + // let mergeFreezeReport = await sails.helpers.http.get('https://www.mergefreeze.com/api/branches/fleetdm/fleet/main', { access_token: sails.config.custom.mergeFreezeAccessToken });//eslint-disable-line camelcase + // if (mergeFreezeReport.frozen) { + // await sails.helpers.http.post('https://www.mergefreeze.com/api/branches/fleetdm/fleet/main', { frozen: false, access_token: sails.config.custom.mergeFreezeAccessToken, user_name: 'fleet-release' });//eslint-disable-line camelcase + // + // // Then, in the background, 2 minutes later... + // setTimeout(()=>{ + // sails.helpers.http.post('https://www.mergefreeze.com/api/branches/fleetdm/fleet/main', { frozen: true, access_token: sails.config.custom.mergeFreezeAccessToken, user_name: 'fleet-release' })//eslint-disable-line camelcase + // .exec((err)=>{ + // if (err) { + // sails.log.error('Background instruction failed: Unexpected error re-freezing repo (see https://github.com/fleetdm/fleet/issues/5179 for background):', err); + // } + // sails.log.info('Re-freeze completed successfully.'); + // });//_∏_ + // }, 2*60*1000);//_∏_ + // }//fi + // + // }//fi + // // - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - } } else if (ghNoun === 'issue_comment' && ['created'].includes(action) && (issueOrPr&&issueOrPr.state === 'open')) {