diff --git a/handbook/queries/README.md b/handbook/queries/README.md index 2857b3011f..236f0210f1 100644 --- a/handbook/queries/README.md +++ b/handbook/queries/README.md @@ -4,24 +4,25 @@ Fleet's standard query library includes a growing collection of useful queries f ### Queries -- [Detect machines with gatekeeper disabled](./detect-machines-with-gatekeeper-disabled.md)(macOS) -- [Detect presence of authorized SSH keys](./detect-presence-of-authorized-ssh-keys.md)(macOS, Linux) -- [Detect hosts with the firewall disabled](./detect-hosts-with-the-firewall-disabled.md)(macOS) -- [Get installed Chrome extensions](./get-installed-chrome-extensions.md)(macOS, Linux, Windows, FreeBSD) -- [Get installed FreeBSD software](./get-installed-freebsd-software.md)(FreeBSD) -- [Get installed Homebrew packages](./get-installed-homebrew-packages.md)(macOS) -- [Get installed Linux software](./get-installed-linux-software.md)(Linux) -- [Get installed macOS software](./get-installed-macos-software.md)(macOS) -- [Get installed Safari extensions](./get-installed-safari-extensions.md)(macOS) -- [Get installed Windows software](./get-installed-windows-software.md)(Windows) -- [Get laptops with failing batteries](./get-laptops-with-failing-batteries.md)(macOS) -- [Get macOS disk free space percentage](./get-macos-disk-free-space-percentage.md)(macOS) -- [Get System Logins and Logouts](./get-system-logins-and-logouts.md)(macOS) -- [Get wifi status](./get-wifi-status.md)(macOS) -- [Get Windows machines with unencrypted hard disks](./get-windows-machines-with-unencrypted-hard-disks.md)(Windows) -- [Get platform info](./get-platform-info.md)(macOS) -- [Get USB devices](./get-usb-devices.md)(macOS, Linux) -- [Count Apple applications installed](./get-usb-devices.md)(macOS) +- [Detect machines with gatekeeper disabled](./detect-machines-with-gatekeeper-disabled.md) (macOS) +- [Detect presence of authorized SSH keys](./detect-presence-of-authorized-ssh-keys.md) (macOS, Linux) +- [Detect hosts with the firewall disabled](./detect-hosts-with-the-firewall-disabled.md) (macOS) +- [Get installed Chrome extensions](./get-installed-chrome-extensions.md) (macOS, Linux, Windows, FreeBSD) +- [Get installed FreeBSD software](./get-installed-freebsd-software.md) (FreeBSD) +- [Get installed Homebrew packages](./get-installed-homebrew-packages.md) (macOS) +- [Get installed Linux software](./get-installed-linux-software.md) (Linux) +- [Get installed macOS software](./get-installed-macos-software.md) (macOS) +- [Get installed Safari extensions](./get-installed-safari-extensions.md) (macOS) +- [Get installed Windows software](./get-installed-windows-software.md) (Windows) +- [Get laptops with failing batteries](./get-laptops-with-failing-batteries.md) (macOS) +- [Get macOS disk free space percentage](./get-macos-disk-free-space-percentage.md) (macOS) +- [Get System Logins and Logouts](./get-system-logins-and-logouts.md) (macOS) +- [Get wifi status](./get-wifi-status.md) (macOS) +- [Get Windows machines with unencrypted hard disks](./get-windows-machines-with-unencrypted-hard-disks.md) (Windows) +- [Get platform info](./get-platform-info.md) (macOS) +- [Get USB devices](./get-usb-devices.md) (macOS, Linux) +- [Count Apple applications installed](./count-apple-applications-installed.md) (macOS) +- [Get authorized keys](./get-authorized-keys.md) (macOS, Linux) ### Contributors diff --git a/handbook/queries/get-authorized-keys.md b/handbook/queries/get-authorized-keys.md new file mode 100644 index 0000000000..2ae1ecc4c9 --- /dev/null +++ b/handbook/queries/get-authorized-keys.md @@ -0,0 +1,16 @@ +# Get authorizes keys + +List authorized_keys for each user on the system. + +### Support +macOS, Linux + +### Query +```sql +SELECT * FROM users CROSS JOIN authorized_keys USING (uid); +``` +### Purpose +Informational + +### Remediation +N/A diff --git a/handbook/queries/get-installed-freebsd-software.md b/handbook/queries/get-installed-freebsd-software.md index 281f70330a..aff8ae87e8 100644 --- a/handbook/queries/get-installed-freebsd-software.md +++ b/handbook/queries/get-installed-freebsd-software.md @@ -13,7 +13,6 @@ SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, - '' AS 'architecture', 'chrome_extensions' AS source FROM chrome_extensions UNION @@ -21,7 +20,6 @@ SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, - '' AS 'architecture', 'firefox_addons' AS source FROM firefox_addons UNION @@ -29,7 +27,6 @@ SELECT name AS name, version AS version, 'Package (Atom)' AS type, - '' AS 'architecture', 'atom_packages' AS source FROM atom_packages UNION @@ -37,7 +34,6 @@ SELECT name AS name, version AS version, 'Package (Python)' AS type, - '' AS 'architecture', 'python_packages' AS source FROM python_packages UNION @@ -45,7 +41,6 @@ SELECT name AS name, version AS version, 'Package (pkg)' AS type, - arch AS 'architecture', 'pkg_packages' AS source FROM pkg_packages; ``` diff --git a/handbook/queries/get-installed-linux-software.md b/handbook/queries/get-installed-linux-software.md index fc384adf60..5db82d5864 100644 --- a/handbook/queries/get-installed-linux-software.md +++ b/handbook/queries/get-installed-linux-software.md @@ -13,8 +13,6 @@ SELECT name AS name, version AS version, 'Package (APT)' AS type, - architectures AS 'architecture', - '' AS 'install_time', 'apt_sources' AS source FROM apt_sources UNION @@ -22,8 +20,6 @@ SELECT name AS name, version AS version, 'Package (deb)' AS type, - arch AS 'architecture', - '' AS 'install_time', 'deb_packages' AS source FROM deb_packages UNION @@ -31,8 +27,6 @@ SELECT package AS name, version AS version, 'Package (Portage)' AS type, - '' AS 'architecture', - '' AS 'install_time', 'portage_packages' AS source FROM portage_packages UNION @@ -40,8 +34,6 @@ SELECT name AS name, version AS version, 'Package (RPM)' AS type, - arch AS 'architecture', - install_time AS 'install_time', 'rpm_packages' AS source FROM rpm_packages UNION @@ -49,8 +41,6 @@ SELECT name AS name, '' AS version, 'Package (YUM)' AS type, - '' AS 'architecture', - '' AS 'install_time', 'yum_sources' AS source FROM yum_sources UNION @@ -58,8 +48,6 @@ SELECT name AS name, version AS version, 'Package (NPM)' AS type, - '' AS 'architecture', - '' AS 'install_time', 'npm_packages' AS source FROM npm_packages UNION @@ -67,8 +55,6 @@ SELECT name AS name, version AS version, 'Package (Atom)' AS type, - '' AS 'architecture', - '' AS 'install_time', 'atom_packages' AS source FROM atom_packages UNION @@ -76,8 +62,6 @@ SELECT name AS name, version AS version, 'Package (Python)' AS type, - '' AS 'architecture', - '' AS 'install_time', 'python_packages' AS source FROM python_packages; ```