From d47bd8f626ff337badb44139d5b564cb2f640406 Mon Sep 17 00:00:00 2001 From: Luke Heath Date: Mon, 9 Dec 2024 13:42:47 -0600 Subject: [PATCH] Reorganize our it-and-security directory (#24278) --- handbook/engineering/README.md | 2 +- it-and-security/default.yml | 4 +- .../{ => all/agent-options}/agent-options.yml | 0 .../servers-canary.agent-options.yml | 0 .../agent-options}/servers.agent-options.yml | 0 .../queries}/collect-crowdstrike-info.yml | 0 .../queries}/collect-fleetd-information.yml | 0 .../collect-fleetd-update-channels.yml} | 0 .../queries/collect-usb-devices.yml} | 2 +- .../queries/collect-vs-code-extensions.yml} | 2 +- .../lib/collect-crowdstrike-info.queries.yml | 8 -- .../content-filtering.mobileconfig} | 0 .../lock-screen-message.mobileconfig} | 0 .../restrictions.mobileconfig} | 0 .../passcode-settings-ddm.json} | 0 .../policies/linux-device-health.yml} | 0 .../macos-check-if-apple-silicon.queries.yml | 15 --- .../commands}/macos-send-fleetd.xml | 0 .../automatic-updates.mobileconfig} | 0 .../chrome-enrollment.mobileconfig} | 0 .../date-time.mobileconfig} | 0 ...sable-bluetooth-file-sharing.mobileconfig} | 0 .../disable-content-caching.mobileconfig} | 0 .../disable-guest-account.mobileconfig} | 0 .../disable-guest-shares.mobileconfig} | 0 .../disable-internet-sharing.mobileconfig} | 0 .../disable-media-sharing.mobileconfig} | 0 .../disable-safari-safefiles.mobileconfig} | 0 ...disable-update-notifications.mobileconfig} | 0 .../enable-doh.mobileconfig} | 0 .../enable-firewall-logging.mobileconfig} | 0 .../enable-gatekeeper.mobileconfig} | 0 .../enforce-library-validation.mobileconfig} | 0 ...e-show-status-bar-is-enabled.mobileconfig} | 0 .../firewall.mobileconfig} | 0 .../full-disk-access-for-fleetd.mobileconfig} | 0 .../limit-ad-tracking.mobileconfig} | 0 .../configuration-profiles/misc.mobileconfig} | 0 .../prevent-autologon.mobileconfig} | 0 .../secure-terminal-keyboard.mobileconfig} | 0 .../passcode-settings.json} | 0 .../automatic-enrollment.dep.json | 0 .../policies/cis.yml} | 0 .../policies/device-health.yml} | 0 .../lib/macos/policies/upgrade-firefox.yml | 8 ++ .../macos/queries/check-if-apple-silicon.yml | 6 + .../collect-failed-login-attempts.yml} | 2 +- .../collect-software-permissions-system.yml} | 0 .../collect-software-permissions-user.yml} | 0 .../scripts}/collect-fleetd-logs.sh | 0 .../scripts/execute-disable-fleet-desktop.sh} | 0 .../scripts}/install-update-homebrew.sh | 0 .../scripts/mdm-migration.sh} | 0 .../scripts/remove-old-nudge.sh} | 0 .../see-automatic-enrollment-profile.sh} | 0 .../scripts/system-maintenance.sh} | 0 .../software/google-chrome.yml} | 0 .../software/mozilla-firefox.yml} | 0 .../mac-zoom.yml => macos/software/zoom.yml} | 0 .../windows-firewall.xml | 0 .../windows-password.xml | 0 .../windows-screen-lock.xml | 0 .../policies/cis.yml} | 0 .../policies/device-health.yml} | 0 .../queries/collect-windows-defender.yml} | 0 .../scripts/enable-ms-defender.ps1} | 0 .../scripts/install-bitdefender.ps1} | 0 .../scripts/remove-fleetd.ps1} | 0 .../scripts/turn-off-mdm.ps1} | 0 .../teams/company-owned-iphones.yml | 8 +- it-and-security/teams/servers-canary.yml | 2 +- it-and-security/teams/servers.yml | 2 +- it-and-security/teams/workstations-canary.yml | 116 ++++++++---------- it-and-security/teams/workstations.yml | 81 ++++++------ website/config/routes.js | 2 +- 75 files changed, 118 insertions(+), 142 deletions(-) rename it-and-security/lib/{ => all/agent-options}/agent-options.yml (100%) rename it-and-security/lib/{ => all/agent-options}/servers-canary.agent-options.yml (100%) rename it-and-security/lib/{ => all/agent-options}/servers.agent-options.yml (100%) rename it-and-security/lib/{ => all/queries}/collect-crowdstrike-info.yml (100%) rename it-and-security/lib/{ => all/queries}/collect-fleetd-information.yml (100%) rename it-and-security/lib/{collect-fleetd-update-channels.queries.yml => all/queries/collect-fleetd-update-channels.yml} (100%) rename it-and-security/lib/{collect-usb-devices.queries.yml => all/queries/collect-usb-devices.yml} (92%) rename it-and-security/lib/{collect-vs-code-extensions.queries.yml => all/queries/collect-vs-code-extensions.yml} (92%) delete mode 100644 it-and-security/lib/collect-crowdstrike-info.queries.yml rename it-and-security/lib/{configuration-profiles/ios-content-filtering.mobileconfig => ios/configuration-profiles/content-filtering.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/ios-lock-screen-message.mobileconfig => ios/configuration-profiles/lock-screen-message.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/ios-restrictions.mobileconfig => ios/configuration-profiles/restrictions.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/ios-passcode-settings-ddm.json => ios/declaration-profiles/passcode-settings-ddm.json} (100%) rename it-and-security/lib/{linux-device-health.policies.yml => linux/policies/linux-device-health.yml} (100%) delete mode 100644 it-and-security/lib/macos-check-if-apple-silicon.queries.yml rename it-and-security/lib/{ => macos/commands}/macos-send-fleetd.xml (100%) rename it-and-security/lib/{configuration-profiles/macos-automatic-updates.mobileconfig => macos/configuration-profiles/automatic-updates.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-chrome-enrollment.mobileconfig => macos/configuration-profiles/chrome-enrollment.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-date-time.mobileconfig => macos/configuration-profiles/date-time.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig => macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-disable-content-caching.mobileconfig => macos/configuration-profiles/disable-content-caching.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-disable-guest-account.mobileconfig => macos/configuration-profiles/disable-guest-account.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-disable-guest-shares.mobileconfig => macos/configuration-profiles/disable-guest-shares.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-disable-internet-sharing.mobileconfig => macos/configuration-profiles/disable-internet-sharing.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-disable-media-sharing.mobileconfig => macos/configuration-profiles/disable-media-sharing.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-disable-safari-safefiles.mobileconfig => macos/configuration-profiles/disable-safari-safefiles.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-disable-update-notifications.mobileconfig => macos/configuration-profiles/disable-update-notifications.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-enable-doh.mobileconfig => macos/configuration-profiles/enable-doh.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-enable-firewall-logging.mobileconfig => macos/configuration-profiles/enable-firewall-logging.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-enable-gatekeeper.mobileconfig => macos/configuration-profiles/enable-gatekeeper.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-enforce-library-validation.mobileconfig => macos/configuration-profiles/enforce-library-validation.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-ensure-show-status-bar-is-enabled.mobileconfig => macos/configuration-profiles/ensure-show-status-bar-is-enabled.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-firewall.mobileconfig => macos/configuration-profiles/firewall.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-full-disk-access-for-fleetd.mobileconfig => macos/configuration-profiles/full-disk-access-for-fleetd.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-limit-ad-tracking.mobileconfig => macos/configuration-profiles/limit-ad-tracking.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-misc.mobileconfig => macos/configuration-profiles/misc.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-prevent-autologon.mobileconfig => macos/configuration-profiles/prevent-autologon.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-secure-terminal-keyboard.mobileconfig => macos/configuration-profiles/secure-terminal-keyboard.mobileconfig} (100%) rename it-and-security/lib/{configuration-profiles/macos-passcode-settings.json => macos/declaration-profiles/passcode-settings.json} (100%) rename it-and-security/lib/{ => macos/enrollment-profiles}/automatic-enrollment.dep.json (100%) rename it-and-security/lib/{macos-cis.policies.yml => macos/policies/cis.yml} (100%) rename it-and-security/lib/{macos-device-health.policies.yml => macos/policies/device-health.yml} (100%) create mode 100644 it-and-security/lib/macos/policies/upgrade-firefox.yml create mode 100644 it-and-security/lib/macos/queries/check-if-apple-silicon.yml rename it-and-security/lib/{collect-failed-login-attempts.queries.yml => macos/queries/collect-failed-login-attempts.yml} (96%) rename it-and-security/lib/{collect-software-permissions-system.queries.yml => macos/queries/collect-software-permissions-system.yml} (100%) rename it-and-security/lib/{collect-software-permissions-user.queries.yml => macos/queries/collect-software-permissions-user.yml} (100%) rename it-and-security/lib/{ => macos/scripts}/collect-fleetd-logs.sh (100%) rename it-and-security/lib/{macos-execute-disable-fleet-desktop.sh => macos/scripts/execute-disable-fleet-desktop.sh} (100%) rename it-and-security/lib/{ => macos/scripts}/install-update-homebrew.sh (100%) rename it-and-security/lib/{macos-mdm-migration.sh => macos/scripts/mdm-migration.sh} (100%) rename it-and-security/lib/{macos-remove-old-nudge.sh => macos/scripts/remove-old-nudge.sh} (100%) rename it-and-security/lib/{macos-see-automatic-enrollment-profile.sh => macos/scripts/see-automatic-enrollment-profile.sh} (100%) rename it-and-security/lib/{macos-system-maintenance.sh => macos/scripts/system-maintenance.sh} (100%) rename it-and-security/lib/{software/mac-google-chrome.yml => macos/software/google-chrome.yml} (100%) rename it-and-security/lib/{software/mac-mozilla-firefox.yml => macos/software/mozilla-firefox.yml} (100%) rename it-and-security/lib/{software/mac-zoom.yml => macos/software/zoom.yml} (100%) rename it-and-security/lib/{ => windows}/configuration-profiles/windows-firewall.xml (100%) rename it-and-security/lib/{ => windows}/configuration-profiles/windows-password.xml (100%) rename it-and-security/lib/{ => windows}/configuration-profiles/windows-screen-lock.xml (100%) rename it-and-security/lib/{windows-cis.policies.yml => windows/policies/cis.yml} (100%) rename it-and-security/lib/{windows-device-health.policies.yml => windows/policies/device-health.yml} (100%) rename it-and-security/lib/{collect-windows-defender.queries.yml => windows/queries/collect-windows-defender.yml} (100%) rename it-and-security/lib/{windows-enable-ms-defender.ps1 => windows/scripts/enable-ms-defender.ps1} (100%) rename it-and-security/lib/{windows-install-bitdefender.ps1 => windows/scripts/install-bitdefender.ps1} (100%) rename it-and-security/lib/{windows-remove-fleetd.ps1 => windows/scripts/remove-fleetd.ps1} (100%) rename it-and-security/lib/{windows-turn-off-mdm.ps1 => windows/scripts/turn-off-mdm.ps1} (100%) diff --git a/handbook/engineering/README.md b/handbook/engineering/README.md index bde2c51804..38ffda8dd4 100644 --- a/handbook/engineering/README.md +++ b/handbook/engineering/README.md @@ -216,7 +216,7 @@ Domain name registrations are handled through Namecheap. Access is managed via 1 It is [possible for end users to remove launch agents](https://github.com/fleetdm/confidential/issues/6088) (this is true not just for osquery, but for anything). -If the host has MDM turned on, use the `fleetctl mdm run-command` CLI command to push the XML file located at https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/macos-send-fleetd.xml to the device, which will reinstall fleetd. +If the host has MDM turned on, use the `fleetctl mdm run-command` CLI command to push the XML file located at https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/macos/commands/macos-send-fleetd.xml to the device, which will reinstall fleetd. If the host doesn't have MDM turned on or isn't enrolled to dogfood, it is beyond our ability to control remotely. diff --git a/it-and-security/default.yml b/it-and-security/default.yml index b9d134f92a..e627ec4f7b 100644 --- a/it-and-security/default.yml +++ b/it-and-security/default.yml @@ -1,5 +1,5 @@ agent_options: - path: ./lib/agent-options.yml + path: ./lib/all/agent-options/agent-options.yml org_settings: features: enable_host_users: true @@ -78,4 +78,4 @@ org_settings: host_batch_size: 0 policies: queries: - - path: ./lib/collect-fleetd-update-channels.queries.yml + - path: ./lib/all/queries/collect-fleetd-update-channels.yml diff --git a/it-and-security/lib/agent-options.yml b/it-and-security/lib/all/agent-options/agent-options.yml similarity index 100% rename from it-and-security/lib/agent-options.yml rename to it-and-security/lib/all/agent-options/agent-options.yml diff --git a/it-and-security/lib/servers-canary.agent-options.yml b/it-and-security/lib/all/agent-options/servers-canary.agent-options.yml similarity index 100% rename from it-and-security/lib/servers-canary.agent-options.yml rename to it-and-security/lib/all/agent-options/servers-canary.agent-options.yml diff --git a/it-and-security/lib/servers.agent-options.yml b/it-and-security/lib/all/agent-options/servers.agent-options.yml similarity index 100% rename from it-and-security/lib/servers.agent-options.yml rename to it-and-security/lib/all/agent-options/servers.agent-options.yml diff --git a/it-and-security/lib/collect-crowdstrike-info.yml b/it-and-security/lib/all/queries/collect-crowdstrike-info.yml similarity index 100% rename from it-and-security/lib/collect-crowdstrike-info.yml rename to it-and-security/lib/all/queries/collect-crowdstrike-info.yml diff --git a/it-and-security/lib/collect-fleetd-information.yml b/it-and-security/lib/all/queries/collect-fleetd-information.yml similarity index 100% rename from it-and-security/lib/collect-fleetd-information.yml rename to it-and-security/lib/all/queries/collect-fleetd-information.yml diff --git a/it-and-security/lib/collect-fleetd-update-channels.queries.yml b/it-and-security/lib/all/queries/collect-fleetd-update-channels.yml similarity index 100% rename from it-and-security/lib/collect-fleetd-update-channels.queries.yml rename to it-and-security/lib/all/queries/collect-fleetd-update-channels.yml diff --git a/it-and-security/lib/collect-usb-devices.queries.yml b/it-and-security/lib/all/queries/collect-usb-devices.yml similarity index 92% rename from it-and-security/lib/collect-usb-devices.queries.yml rename to it-and-security/lib/all/queries/collect-usb-devices.yml index ab2b40732e..4ca858ce49 100644 --- a/it-and-security/lib/collect-usb-devices.queries.yml +++ b/it-and-security/lib/all/queries/collect-usb-devices.yml @@ -6,5 +6,5 @@ logging: snapshot min_osquery_version: "" observer_can_run: true - platform: "" + platform: darwin,linux query: SELECT model, vendor FROM usb_devices; \ No newline at end of file diff --git a/it-and-security/lib/collect-vs-code-extensions.queries.yml b/it-and-security/lib/all/queries/collect-vs-code-extensions.yml similarity index 92% rename from it-and-security/lib/collect-vs-code-extensions.queries.yml rename to it-and-security/lib/all/queries/collect-vs-code-extensions.yml index 29f97a2f7f..97dfa04547 100644 --- a/it-and-security/lib/collect-vs-code-extensions.queries.yml +++ b/it-and-security/lib/all/queries/collect-vs-code-extensions.yml @@ -7,6 +7,6 @@ logging: snapshot min_osquery_version: "" observer_can_run: false - platform: "" + platform: darwin,linux,windows query: SELECT extension.name, extension.publisher, extension.version FROM users JOIN vscode_extensions extension USING (uid); \ No newline at end of file diff --git a/it-and-security/lib/collect-crowdstrike-info.queries.yml b/it-and-security/lib/collect-crowdstrike-info.queries.yml deleted file mode 100644 index e68970df54..0000000000 --- a/it-and-security/lib/collect-crowdstrike-info.queries.yml +++ /dev/null @@ -1,8 +0,0 @@ -- name: Get Crowdstrike Falcon network content filter status - description: "Collects crowdstrike information" - query: | - /* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first "Enabled" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1; - interval: 300 # 5 minutes - observer_can_run: true - automations_enabled: false - platform: darwin,linux,windows diff --git a/it-and-security/lib/configuration-profiles/ios-content-filtering.mobileconfig b/it-and-security/lib/ios/configuration-profiles/content-filtering.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/ios-content-filtering.mobileconfig rename to it-and-security/lib/ios/configuration-profiles/content-filtering.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/ios-lock-screen-message.mobileconfig b/it-and-security/lib/ios/configuration-profiles/lock-screen-message.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/ios-lock-screen-message.mobileconfig rename to it-and-security/lib/ios/configuration-profiles/lock-screen-message.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/ios-restrictions.mobileconfig b/it-and-security/lib/ios/configuration-profiles/restrictions.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/ios-restrictions.mobileconfig rename to it-and-security/lib/ios/configuration-profiles/restrictions.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/ios-passcode-settings-ddm.json b/it-and-security/lib/ios/declaration-profiles/passcode-settings-ddm.json similarity index 100% rename from it-and-security/lib/configuration-profiles/ios-passcode-settings-ddm.json rename to it-and-security/lib/ios/declaration-profiles/passcode-settings-ddm.json diff --git a/it-and-security/lib/linux-device-health.policies.yml b/it-and-security/lib/linux/policies/linux-device-health.yml similarity index 100% rename from it-and-security/lib/linux-device-health.policies.yml rename to it-and-security/lib/linux/policies/linux-device-health.yml diff --git a/it-and-security/lib/macos-check-if-apple-silicon.queries.yml b/it-and-security/lib/macos-check-if-apple-silicon.queries.yml deleted file mode 100644 index 4597cebd7a..0000000000 --- a/it-and-security/lib/macos-check-if-apple-silicon.queries.yml +++ /dev/null @@ -1,15 +0,0 @@ -apiVersion: v1 -kind: query -spec: - name: Check if Mac has Apple silicon - query: SELECT 1 FROM system_info WHERE cpu_type = "arm64e"; -# - name: Determine macOS cpu type as Apple Silicon -# automations_enabled: false -# description: Returns true if macOS cpu type is Apple Silicon. -# discard_data: false -# interval: 3600 -# logging: snapshot -# min_osquery_version: "" -# observer_can_run: true -# platform: "darwin" -# query: SELECT 1 FROM system_info WHERE cpu_type = "arm64e"; \ No newline at end of file diff --git a/it-and-security/lib/macos-send-fleetd.xml b/it-and-security/lib/macos/commands/macos-send-fleetd.xml similarity index 100% rename from it-and-security/lib/macos-send-fleetd.xml rename to it-and-security/lib/macos/commands/macos-send-fleetd.xml diff --git a/it-and-security/lib/configuration-profiles/macos-automatic-updates.mobileconfig b/it-and-security/lib/macos/configuration-profiles/automatic-updates.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-automatic-updates.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/automatic-updates.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-chrome-enrollment.mobileconfig b/it-and-security/lib/macos/configuration-profiles/chrome-enrollment.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-chrome-enrollment.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/chrome-enrollment.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-date-time.mobileconfig b/it-and-security/lib/macos/configuration-profiles/date-time.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-date-time.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/date-time.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig b/it-and-security/lib/macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-disable-content-caching.mobileconfig b/it-and-security/lib/macos/configuration-profiles/disable-content-caching.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-disable-content-caching.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/disable-content-caching.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-disable-guest-account.mobileconfig b/it-and-security/lib/macos/configuration-profiles/disable-guest-account.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-disable-guest-account.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/disable-guest-account.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-disable-guest-shares.mobileconfig b/it-and-security/lib/macos/configuration-profiles/disable-guest-shares.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-disable-guest-shares.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/disable-guest-shares.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-disable-internet-sharing.mobileconfig b/it-and-security/lib/macos/configuration-profiles/disable-internet-sharing.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-disable-internet-sharing.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/disable-internet-sharing.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-disable-media-sharing.mobileconfig b/it-and-security/lib/macos/configuration-profiles/disable-media-sharing.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-disable-media-sharing.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/disable-media-sharing.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-disable-safari-safefiles.mobileconfig b/it-and-security/lib/macos/configuration-profiles/disable-safari-safefiles.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-disable-safari-safefiles.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/disable-safari-safefiles.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-disable-update-notifications.mobileconfig b/it-and-security/lib/macos/configuration-profiles/disable-update-notifications.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-disable-update-notifications.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/disable-update-notifications.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-enable-doh.mobileconfig b/it-and-security/lib/macos/configuration-profiles/enable-doh.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-enable-doh.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/enable-doh.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-enable-firewall-logging.mobileconfig b/it-and-security/lib/macos/configuration-profiles/enable-firewall-logging.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-enable-firewall-logging.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/enable-firewall-logging.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-enable-gatekeeper.mobileconfig b/it-and-security/lib/macos/configuration-profiles/enable-gatekeeper.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-enable-gatekeeper.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/enable-gatekeeper.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-enforce-library-validation.mobileconfig b/it-and-security/lib/macos/configuration-profiles/enforce-library-validation.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-enforce-library-validation.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/enforce-library-validation.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-ensure-show-status-bar-is-enabled.mobileconfig b/it-and-security/lib/macos/configuration-profiles/ensure-show-status-bar-is-enabled.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-ensure-show-status-bar-is-enabled.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/ensure-show-status-bar-is-enabled.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-firewall.mobileconfig b/it-and-security/lib/macos/configuration-profiles/firewall.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-firewall.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/firewall.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-full-disk-access-for-fleetd.mobileconfig b/it-and-security/lib/macos/configuration-profiles/full-disk-access-for-fleetd.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-full-disk-access-for-fleetd.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/full-disk-access-for-fleetd.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-limit-ad-tracking.mobileconfig b/it-and-security/lib/macos/configuration-profiles/limit-ad-tracking.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-limit-ad-tracking.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/limit-ad-tracking.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-misc.mobileconfig b/it-and-security/lib/macos/configuration-profiles/misc.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-misc.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/misc.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-prevent-autologon.mobileconfig b/it-and-security/lib/macos/configuration-profiles/prevent-autologon.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-prevent-autologon.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/prevent-autologon.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-secure-terminal-keyboard.mobileconfig b/it-and-security/lib/macos/configuration-profiles/secure-terminal-keyboard.mobileconfig similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-secure-terminal-keyboard.mobileconfig rename to it-and-security/lib/macos/configuration-profiles/secure-terminal-keyboard.mobileconfig diff --git a/it-and-security/lib/configuration-profiles/macos-passcode-settings.json b/it-and-security/lib/macos/declaration-profiles/passcode-settings.json similarity index 100% rename from it-and-security/lib/configuration-profiles/macos-passcode-settings.json rename to it-and-security/lib/macos/declaration-profiles/passcode-settings.json diff --git a/it-and-security/lib/automatic-enrollment.dep.json b/it-and-security/lib/macos/enrollment-profiles/automatic-enrollment.dep.json similarity index 100% rename from it-and-security/lib/automatic-enrollment.dep.json rename to it-and-security/lib/macos/enrollment-profiles/automatic-enrollment.dep.json diff --git a/it-and-security/lib/macos-cis.policies.yml b/it-and-security/lib/macos/policies/cis.yml similarity index 100% rename from it-and-security/lib/macos-cis.policies.yml rename to it-and-security/lib/macos/policies/cis.yml diff --git a/it-and-security/lib/macos-device-health.policies.yml b/it-and-security/lib/macos/policies/device-health.yml similarity index 100% rename from it-and-security/lib/macos-device-health.policies.yml rename to it-and-security/lib/macos/policies/device-health.yml diff --git a/it-and-security/lib/macos/policies/upgrade-firefox.yml b/it-and-security/lib/macos/policies/upgrade-firefox.yml new file mode 100644 index 0000000000..5797451f2a --- /dev/null +++ b/it-and-security/lib/macos/policies/upgrade-firefox.yml @@ -0,0 +1,8 @@ +- name: macOS - Upgrade Firefox + query: SELECT 1 FROM apps WHERE name = 'Firefox.app' AND version_compare(bundle_short_version, '132.0.0') >= 0; + critical: false + description: The host may have an outdated or non-existent version of Firefox, potentially risking security vulnerabilities or compatibility issues. + resolution: During maintenance, the Firefox app could be updated to the correct version or installed if it's missing. + platform: darwin + install_software: + package_path: "../software/mozilla-firefox.yml" \ No newline at end of file diff --git a/it-and-security/lib/macos/queries/check-if-apple-silicon.yml b/it-and-security/lib/macos/queries/check-if-apple-silicon.yml new file mode 100644 index 0000000000..558fa08ca8 --- /dev/null +++ b/it-and-security/lib/macos/queries/check-if-apple-silicon.yml @@ -0,0 +1,6 @@ +apiVersion: v1 +kind: query +spec: + name: Check if Mac has Apple silicon + query: SELECT 1 FROM system_info WHERE cpu_type = "arm64e"; + platform: "darwin" \ No newline at end of file diff --git a/it-and-security/lib/collect-failed-login-attempts.queries.yml b/it-and-security/lib/macos/queries/collect-failed-login-attempts.yml similarity index 96% rename from it-and-security/lib/collect-failed-login-attempts.queries.yml rename to it-and-security/lib/macos/queries/collect-failed-login-attempts.yml index a2242b7e74..f3b461b5ec 100644 --- a/it-and-security/lib/collect-failed-login-attempts.queries.yml +++ b/it-and-security/lib/macos/queries/collect-failed-login-attempts.yml @@ -8,7 +8,7 @@ logging: snapshot min_osquery_version: "" observer_can_run: false - platform: "" + platform: "darwin" query: SELECT users.username, account_policy_data.failed_login_count, account_policy_data.failed_login_timestamp FROM users INNER JOIN account_policy_data using (uid) WHERE account_policy_data.failed_login_count > 0; \ No newline at end of file diff --git a/it-and-security/lib/collect-software-permissions-system.queries.yml b/it-and-security/lib/macos/queries/collect-software-permissions-system.yml similarity index 100% rename from it-and-security/lib/collect-software-permissions-system.queries.yml rename to it-and-security/lib/macos/queries/collect-software-permissions-system.yml diff --git a/it-and-security/lib/collect-software-permissions-user.queries.yml b/it-and-security/lib/macos/queries/collect-software-permissions-user.yml similarity index 100% rename from it-and-security/lib/collect-software-permissions-user.queries.yml rename to it-and-security/lib/macos/queries/collect-software-permissions-user.yml diff --git a/it-and-security/lib/collect-fleetd-logs.sh b/it-and-security/lib/macos/scripts/collect-fleetd-logs.sh similarity index 100% rename from it-and-security/lib/collect-fleetd-logs.sh rename to it-and-security/lib/macos/scripts/collect-fleetd-logs.sh diff --git a/it-and-security/lib/macos-execute-disable-fleet-desktop.sh b/it-and-security/lib/macos/scripts/execute-disable-fleet-desktop.sh similarity index 100% rename from it-and-security/lib/macos-execute-disable-fleet-desktop.sh rename to it-and-security/lib/macos/scripts/execute-disable-fleet-desktop.sh diff --git a/it-and-security/lib/install-update-homebrew.sh b/it-and-security/lib/macos/scripts/install-update-homebrew.sh similarity index 100% rename from it-and-security/lib/install-update-homebrew.sh rename to it-and-security/lib/macos/scripts/install-update-homebrew.sh diff --git a/it-and-security/lib/macos-mdm-migration.sh b/it-and-security/lib/macos/scripts/mdm-migration.sh similarity index 100% rename from it-and-security/lib/macos-mdm-migration.sh rename to it-and-security/lib/macos/scripts/mdm-migration.sh diff --git a/it-and-security/lib/macos-remove-old-nudge.sh b/it-and-security/lib/macos/scripts/remove-old-nudge.sh similarity index 100% rename from it-and-security/lib/macos-remove-old-nudge.sh rename to it-and-security/lib/macos/scripts/remove-old-nudge.sh diff --git a/it-and-security/lib/macos-see-automatic-enrollment-profile.sh b/it-and-security/lib/macos/scripts/see-automatic-enrollment-profile.sh similarity index 100% rename from it-and-security/lib/macos-see-automatic-enrollment-profile.sh rename to it-and-security/lib/macos/scripts/see-automatic-enrollment-profile.sh diff --git a/it-and-security/lib/macos-system-maintenance.sh b/it-and-security/lib/macos/scripts/system-maintenance.sh similarity index 100% rename from it-and-security/lib/macos-system-maintenance.sh rename to it-and-security/lib/macos/scripts/system-maintenance.sh diff --git a/it-and-security/lib/software/mac-google-chrome.yml b/it-and-security/lib/macos/software/google-chrome.yml similarity index 100% rename from it-and-security/lib/software/mac-google-chrome.yml rename to it-and-security/lib/macos/software/google-chrome.yml diff --git a/it-and-security/lib/software/mac-mozilla-firefox.yml b/it-and-security/lib/macos/software/mozilla-firefox.yml similarity index 100% rename from it-and-security/lib/software/mac-mozilla-firefox.yml rename to it-and-security/lib/macos/software/mozilla-firefox.yml diff --git a/it-and-security/lib/software/mac-zoom.yml b/it-and-security/lib/macos/software/zoom.yml similarity index 100% rename from it-and-security/lib/software/mac-zoom.yml rename to it-and-security/lib/macos/software/zoom.yml diff --git a/it-and-security/lib/configuration-profiles/windows-firewall.xml b/it-and-security/lib/windows/configuration-profiles/windows-firewall.xml similarity index 100% rename from it-and-security/lib/configuration-profiles/windows-firewall.xml rename to it-and-security/lib/windows/configuration-profiles/windows-firewall.xml diff --git a/it-and-security/lib/configuration-profiles/windows-password.xml b/it-and-security/lib/windows/configuration-profiles/windows-password.xml similarity index 100% rename from it-and-security/lib/configuration-profiles/windows-password.xml rename to it-and-security/lib/windows/configuration-profiles/windows-password.xml diff --git a/it-and-security/lib/configuration-profiles/windows-screen-lock.xml b/it-and-security/lib/windows/configuration-profiles/windows-screen-lock.xml similarity index 100% rename from it-and-security/lib/configuration-profiles/windows-screen-lock.xml rename to it-and-security/lib/windows/configuration-profiles/windows-screen-lock.xml diff --git a/it-and-security/lib/windows-cis.policies.yml b/it-and-security/lib/windows/policies/cis.yml similarity index 100% rename from it-and-security/lib/windows-cis.policies.yml rename to it-and-security/lib/windows/policies/cis.yml diff --git a/it-and-security/lib/windows-device-health.policies.yml b/it-and-security/lib/windows/policies/device-health.yml similarity index 100% rename from it-and-security/lib/windows-device-health.policies.yml rename to it-and-security/lib/windows/policies/device-health.yml diff --git a/it-and-security/lib/collect-windows-defender.queries.yml b/it-and-security/lib/windows/queries/collect-windows-defender.yml similarity index 100% rename from it-and-security/lib/collect-windows-defender.queries.yml rename to it-and-security/lib/windows/queries/collect-windows-defender.yml diff --git a/it-and-security/lib/windows-enable-ms-defender.ps1 b/it-and-security/lib/windows/scripts/enable-ms-defender.ps1 similarity index 100% rename from it-and-security/lib/windows-enable-ms-defender.ps1 rename to it-and-security/lib/windows/scripts/enable-ms-defender.ps1 diff --git a/it-and-security/lib/windows-install-bitdefender.ps1 b/it-and-security/lib/windows/scripts/install-bitdefender.ps1 similarity index 100% rename from it-and-security/lib/windows-install-bitdefender.ps1 rename to it-and-security/lib/windows/scripts/install-bitdefender.ps1 diff --git a/it-and-security/lib/windows-remove-fleetd.ps1 b/it-and-security/lib/windows/scripts/remove-fleetd.ps1 similarity index 100% rename from it-and-security/lib/windows-remove-fleetd.ps1 rename to it-and-security/lib/windows/scripts/remove-fleetd.ps1 diff --git a/it-and-security/lib/windows-turn-off-mdm.ps1 b/it-and-security/lib/windows/scripts/turn-off-mdm.ps1 similarity index 100% rename from it-and-security/lib/windows-turn-off-mdm.ps1 rename to it-and-security/lib/windows/scripts/turn-off-mdm.ps1 diff --git a/it-and-security/teams/company-owned-iphones.yml b/it-and-security/teams/company-owned-iphones.yml index 1b1ed229d1..2ca0bb8634 100644 --- a/it-and-security/teams/company-owned-iphones.yml +++ b/it-and-security/teams/company-owned-iphones.yml @@ -16,10 +16,10 @@ controls: minimum_version: "17.6" macos_settings: custom_settings: - - path: ../lib/configuration-profiles/ios-restrictions.mobileconfig - - path: ../lib/configuration-profiles/ios-passcode-settings-ddm.json - - path: ../lib/configuration-profiles/ios-lock-screen-message.mobileconfig - - path: ../lib/configuration-profiles/ios-content-filtering.mobileconfig + - path: ../lib/ios/configuration-profiles/restrictions.mobileconfig + - path: ../lib/ios/configuration-profiles/lock-screen-message.mobileconfig + - path: ../lib/ios/configuration-profiles/content-filtering.mobileconfig + - path: ../lib/ios/declaration-profiles/passcode-settings-ddm.json scripts: policies: queries: diff --git a/it-and-security/teams/servers-canary.yml b/it-and-security/teams/servers-canary.yml index e324a8ab4d..c70cdf4e7a 100644 --- a/it-and-security/teams/servers-canary.yml +++ b/it-and-security/teams/servers-canary.yml @@ -9,7 +9,7 @@ team_settings: secrets: - secret: $DOGFOOD_SERVERS_CANARY_ENROLL_SECRET agent_options: - path: ../lib/servers-canary.agent-options.yml + path: ../lib/all/agent-options/servers-canary.agent-options.yml controls: enable_disk_encryption: false macos_settings: diff --git a/it-and-security/teams/servers.yml b/it-and-security/teams/servers.yml index 5d9e4586a6..7564cc8234 100644 --- a/it-and-security/teams/servers.yml +++ b/it-and-security/teams/servers.yml @@ -9,7 +9,7 @@ team_settings: secrets: - secret: $DOGFOOD_SERVERS_ENROLL_SECRET agent_options: - path: ../lib/servers.agent-options.yml + path: ../lib/all/agent-options/servers.agent-options.yml controls: enable_disk_encryption: false macos_settings: diff --git a/it-and-security/teams/workstations-canary.yml b/it-and-security/teams/workstations-canary.yml index 43fdb0a143..fd5b61c5af 100644 --- a/it-and-security/teams/workstations-canary.yml +++ b/it-and-security/teams/workstations-canary.yml @@ -65,71 +65,65 @@ controls: enable_disk_encryption: true macos_settings: custom_settings: - - path: ../lib/configuration-profiles/macos-chrome-enrollment.mobileconfig - - path: ../lib/configuration-profiles/macos-date-time.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-content-caching.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-guest-account.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-guest-shares.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-internet-sharing.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-media-sharing.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-safari-safefiles.mobileconfig - - path: ../lib/configuration-profiles/macos-enable-doh.mobileconfig - - path: ../lib/configuration-profiles/macos-enable-firewall-logging.mobileconfig - - path: ../lib/configuration-profiles/macos-enable-gatekeeper.mobileconfig - - path: ../lib/configuration-profiles/macos-enforce-library-validation.mobileconfig - - path: ../lib/configuration-profiles/macos-firewall.mobileconfig - - path: ../lib/configuration-profiles/macos-full-disk-access-for-fleetd.mobileconfig - - path: ../lib/configuration-profiles/macos-limit-ad-tracking.mobileconfig - - path: ../lib/configuration-profiles/macos-misc.mobileconfig - - path: ../lib/configuration-profiles/macos-prevent-autologon.mobileconfig - - path: ../lib/configuration-profiles/macos-secure-terminal-keyboard.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-update-notifications.mobileconfig - - path: ../lib/configuration-profiles/macos-ensure-show-status-bar-is-enabled.mobileconfig - - path: ../lib/configuration-profiles/macos-passcode-settings.json + - path: ../lib/macos/configuration-profiles/chrome-enrollment.mobileconfig + - path: ../lib/macos/configuration-profiles/date-time.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-content-caching.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-guest-account.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-guest-shares.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-internet-sharing.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-media-sharing.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-safari-safefiles.mobileconfig + - path: ../lib/macos/configuration-profiles/enable-doh.mobileconfig + - path: ../lib/macos/configuration-profiles/enable-firewall-logging.mobileconfig + - path: ../lib/macos/configuration-profiles/enable-gatekeeper.mobileconfig + - path: ../lib/macos/configuration-profiles/enforce-library-validation.mobileconfig + - path: ../lib/macos/configuration-profiles/firewall.mobileconfig + - path: ../lib/macos/configuration-profiles/full-disk-access-for-fleetd.mobileconfig + - path: ../lib/macos/configuration-profiles/limit-ad-tracking.mobileconfig + - path: ../lib/macos/configuration-profiles/misc.mobileconfig + - path: ../lib/macos/configuration-profiles/prevent-autologon.mobileconfig + - path: ../lib/macos/configuration-profiles/secure-terminal-keyboard.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-update-notifications.mobileconfig + - path: ../lib/macos/configuration-profiles/ensure-show-status-bar-is-enabled.mobileconfig + - path: ../lib/macos/declaration-profiles/passcode-settings.json macos_setup: bootstrap_package: "" - enable_end_user_authentication: true + enable_end_user_authentication: false macos_setup_assistant: null macos_updates: deadline: "2024-12-04" minimum_version: "15.1.1" windows_settings: custom_settings: - - path: ../lib/configuration-profiles/windows-firewall.xml - - path: ../lib/configuration-profiles/windows-password.xml - - path: ../lib/configuration-profiles/windows-screen-lock.xml + - path: ../lib/windows/configuration-profiles/windows-firewall.xml + - path: ../lib/windows/configuration-profiles/windows-password.xml + - path: ../lib/windows/configuration-profiles/windows-screen-lock.xml windows_updates: deadline_days: 7 grace_period_days: 2 scripts: - - path: ../lib/collect-fleetd-logs.sh - - path: ../lib/macos-execute-disable-fleet-desktop.sh - - path: ../lib/macos-see-automatic-enrollment-profile.sh - - path: ../lib/macos-remove-old-nudge.sh - - path: ../lib/macos-mdm-migration.sh - - path: ../lib/macos-system-maintenance.sh - - path: ../lib/windows-remove-fleetd.ps1 - - path: ../lib/windows-turn-off-mdm.ps1 - - path: ../lib/windows-install-bitdefender.ps1 - - path: ../lib/windows-enable-ms-defender.ps1 + - path: ../lib/macos/scripts/collect-fleetd-logs.sh + - path: ../lib/macos/scripts/execute-disable-fleet-desktop.sh + - path: ../lib/macos/scripts/see-automatic-enrollment-profile.sh + - path: ../lib/macos/scripts/remove-old-nudge.sh + - path: ../lib/macos/scripts/mdm-migration.sh + - path: ../lib/macos/scripts/system-maintenance.sh + - path: ../lib/windows/scripts/remove-fleetd.ps1 + - path: ../lib/windows/scripts/turn-off-mdm.ps1 + - path: ../lib/windows/scripts/install-bitdefender.ps1 + - path: ../lib/windows/scripts/enable-ms-defender.ps1 policies: - - path: ../lib/macos-device-health.policies.yml - - path: ../lib/windows-device-health.policies.yml - - path: ../lib/linux-device-health.policies.yml + - path: ../lib/macos/policies/device-health.yml + - path: ../lib/macos/policies/upgrade-firefox.yml + - path: ../lib/windows/policies/device-health.yml + - path: ../lib/linux/policies/linux-device-health.yml - name: macOS - Check if latest version - query: SELECT 1 FROM os_version WHERE (major = '14' AND minor = '6') OR major = '15'; - critical: false + query: SELECT 1 FROM os_version WHERE (major = '15' AND minor = '1' AND patch = '1'); + critical: true description: Using an outdated macOS version risks exposure to security vulnerabilities and potential system instability. resolution: We will update your macOS to the latest version. platform: darwin - calendar_events_enabled: false - - name: macOS - MDM migration complete - query: SELECT 1 AS result FROM system_info WHERE computer_name NOT IN ('Titanosauria2', 'Drew’s MacBook Pro2','fleetwoodmike2'); - critical: false - description: Determines if the device has completed MDM migration to Fleet. - resolution: We will migrate your macOS MDM to Fleet. - platform: darwin calendar_events_enabled: false - name: macOS - System maintenance complete query: SELECT 1 AS result FROM system_info WHERE computer_name NOT IN ('Drew’s MacBook Pro','Anthony’s MacBook Pro','Patricia’s MacBook Pro','Paul’s MacBook Pro','Tom’s MacBook Air'); @@ -138,14 +132,6 @@ policies: resolution: We will perform system maintenance on your device. platform: darwin calendar_events_enabled: true - - name: macOS - Upgrade Firefox - query: SELECT 1 FROM apps WHERE name = 'Firefox.app' AND version_compare(bundle_short_version, '132.0.0') >= 0; - critical: false - description: The host may have an outdated or non-existent version of Firefox, potentially risking security vulnerabilities or compatibility issues. - resolution: During maintenance, the Firefox app could be updated to the correct version or installed if it's missing. - platform: darwin - install_software: - package_path: "../lib/software/mac-mozilla-firefox.yml" - name: macOS - Upgrade Slack query: SELECT 1 FROM apps WHERE name = 'Slack.app' AND version_compare(bundle_short_version, '4.40.126') >= 0; critical: false @@ -154,18 +140,18 @@ policies: platform: darwin calendar_events_enabled: false queries: - - path: ../lib/collect-failed-login-attempts.queries.yml - - path: ../lib/collect-fleetd-information.yml - - path: ../lib/collect-usb-devices.queries.yml - - path: ../lib/collect-vs-code-extensions.queries.yml - - path: ../lib/collect-software-permissions-system.queries.yml - - path: ../lib/collect-software-permissions-user.queries.yml - - path: ../lib/collect-crowdstrike-info.queries.yml + - path: ../lib/macos/queries/collect-failed-login-attempts.yml + - path: ../lib/all/queries/collect-fleetd-information.yml + - path: ../lib/all/queries/collect-usb-devices.yml + - path: ../lib/all/queries/collect-vs-code-extensions.yml + - path: ../lib/macos/queries/collect-software-permissions-system.yml + - path: ../lib/macos/queries/collect-software-permissions-user.yml + - path: ../lib/all/queries/collect-crowdstrike-info.yml software: + packages: + - path: ../lib/macos/software/mozilla-firefox.yml # Mozilla Firefox for MacOS (universal) app_store_apps: - app_store_id: '803453959' # Slack Desktop - app_store_id: '1333542190' # 1Password 7 Desktop - app_store_id: '1477376905' # GitHub - app_store_id: '1152747299' # Figma - packages: - - path: ../lib/software/mac-mozilla-firefox.yml # Mozilla Firefox for MacOS (universal) diff --git a/it-and-security/teams/workstations.yml b/it-and-security/teams/workstations.yml index 6f6c4bfc8a..b599baeb62 100644 --- a/it-and-security/teams/workstations.yml +++ b/it-and-security/teams/workstations.yml @@ -36,33 +36,33 @@ controls: enable_disk_encryption: true macos_settings: custom_settings: - - path: ../lib/configuration-profiles/macos-date-time.mobileconfig - - path: ../lib/configuration-profiles/macos-chrome-enrollment.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-bluetooth-file-sharing.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-content-caching.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-guest-account.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-guest-shares.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-internet-sharing.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-media-sharing.mobileconfig - - path: ../lib/configuration-profiles/macos-disable-safari-safefiles.mobileconfig - - path: ../lib/configuration-profiles/macos-enable-doh.mobileconfig - - path: ../lib/configuration-profiles/macos-enable-firewall-logging.mobileconfig - - path: ../lib/configuration-profiles/macos-enable-gatekeeper.mobileconfig - - path: ../lib/configuration-profiles/macos-enforce-library-validation.mobileconfig - - path: ../lib/configuration-profiles/macos-firewall.mobileconfig - - path: ../lib/configuration-profiles/macos-full-disk-access-for-fleetd.mobileconfig - - path: ../lib/configuration-profiles/macos-limit-ad-tracking.mobileconfig - - path: ../lib/configuration-profiles/macos-misc.mobileconfig - - path: ../lib/configuration-profiles/macos-prevent-autologon.mobileconfig - - path: ../lib/configuration-profiles/macos-secure-terminal-keyboard.mobileconfig - - path: ../lib/configuration-profiles/macos-passcode-settings.json + - path: ../lib/macos/configuration-profiles/date-time.mobileconfig + - path: ../lib/macos/configuration-profiles/chrome-enrollment.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-bluetooth-file-sharing.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-content-caching.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-guest-account.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-guest-shares.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-internet-sharing.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-media-sharing.mobileconfig + - path: ../lib/macos/configuration-profiles/disable-safari-safefiles.mobileconfig + - path: ../lib/macos/configuration-profiles/enable-doh.mobileconfig + - path: ../lib/macos/configuration-profiles/enable-firewall-logging.mobileconfig + - path: ../lib/macos/configuration-profiles/enable-gatekeeper.mobileconfig + - path: ../lib/macos/configuration-profiles/enforce-library-validation.mobileconfig + - path: ../lib/macos/configuration-profiles/firewall.mobileconfig + - path: ../lib/macos/configuration-profiles/full-disk-access-for-fleetd.mobileconfig + - path: ../lib/macos/configuration-profiles/limit-ad-tracking.mobileconfig + - path: ../lib/macos/configuration-profiles/misc.mobileconfig + - path: ../lib/macos/configuration-profiles/prevent-autologon.mobileconfig + - path: ../lib/macos/configuration-profiles/secure-terminal-keyboard.mobileconfig + - path: ../lib/macos/declaration-profiles/passcode-settings.json macos_setup: bootstrap_package: "" enable_end_user_authentication: true - macos_setup_assistant: ../lib/automatic-enrollment.dep.json + macos_setup_assistant: ../lib/macos/enrollment-profiles/automatic-enrollment.dep.json software: - - package_path: ../lib/software/mac-google-chrome.yml # Google Chrome for macOS - - package_path: ../lib/software/mac-zoom.yml # Zoom for macOS + - package_path: ../lib/macos/software/google-chrome.yml # Google Chrome for macOS + - package_path: ../lib/macos/software/zoom.yml # Zoom for macOS - app_store_id: '803453959' # Slack Desktop - app_store_id: '1333542190' # 1Password 7 Desktop macos_updates: @@ -74,29 +74,28 @@ controls: deadline_days: 7 grace_period_days: 2 scripts: - - path: ../lib/collect-fleetd-logs.sh - - path: ../lib/macos-see-automatic-enrollment-profile.sh - - path: ../lib/macos-remove-old-nudge.sh - - path: ../lib/install-update-homebrew.sh - - path: ../lib/windows-remove-fleetd.ps1 - - path: ../lib/windows-turn-off-mdm.ps1 + - path: ../lib/macos/scripts/collect-fleetd-logs.sh + - path: ../lib/macos/scripts/see-automatic-enrollment-profile.sh + - path: ../lib/macos/scripts/remove-old-nudge.sh + - path: ../lib/windows/scripts/remove-fleetd.ps1 + - path: ../lib/windows/scripts/turn-off-mdm.ps1 policies: - - path: ../lib/macos-device-health.policies.yml - - path: ../lib/windows-device-health.policies.yml - - path: ../lib/linux-device-health.policies.yml - - path: ../lib/macos-cis.policies.yml - - path: ../lib/windows-cis.policies.yml + - path: ../lib/macos/policies/device-health.yml + - path: ../lib/macos/policies/cis.yml + - path: ../lib/windows/policies/device-health.yml + - path: ../lib/windows/policies/cis.yml + - path: ../lib/linux/policies/linux-device-health.yml - name: macOS - Check if latest version - query: SELECT 1 FROM os_version WHERE (major = '14' AND minor = '6') OR major = '15'; - critical: false + query: SELECT 1 FROM os_version WHERE (major = '15' AND minor = '1' AND patch = '1'); + critical: true description: Using an outdated macOS version risks exposure to security vulnerabilities and potential system instability. resolution: We will update your macOS to the latest version. platform: darwin calendar_events_enabled: false queries: - - path: ../lib/collect-failed-login-attempts.queries.yml - - path: ../lib/collect-usb-devices.queries.yml - - path: ../lib/collect-vs-code-extensions.queries.yml + - path: ../lib/macos/queries/collect-failed-login-attempts.yml + - path: ../lib/all/queries/collect-usb-devices.yml + - path: ../lib/all/queries/collect-vs-code-extensions.yml - name: Collect expiration date for MDM SCEP certificates description: "For the following issue: https://github.com/fleetdm/confidential/issues/4518. Returns expiration date for macOS hosts's MDM SCEP certs." query: "SELECT common_name, datetime(not_valid_after,'unixepoch') AS expires FROM certificates WHERE 'common_name' LIKE '%FleetDM Identity%';" @@ -106,8 +105,8 @@ queries: observer_can_run: true software: packages: - - path: ../lib/software/mac-zoom.yml # Zoom for macOS - - path: ../lib/software/mac-google-chrome.yml # Google Chrome for macOS + - path: ../lib/macos/software/zoom.yml # Zoom for macOS + - path: ../lib/macos/software/google-chrome.yml # Google Chrome for macOS app_store_apps: - app_store_id: '803453959' # Slack Desktop - app_store_id: '1333542190' # 1Password 7 Desktop diff --git a/website/config/routes.js b/website/config/routes.js index 62cd89aca6..6d04b3bc6d 100644 --- a/website/config/routes.js +++ b/website/config/routes.js @@ -550,7 +550,7 @@ module.exports.routes = { 'GET /try-fleet/sandbox': '/try-fleet', 'GET /try-fleet/waitlist': '/try-fleet', 'GET /endpoint-operations': '/endpoint-ops',// « just in case we type it the wrong way - 'GET /example-dep-profile': 'https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/automatic-enrollment.dep.json', + 'GET /example-dep-profile': 'https://github.com/fleetdm/fleet/blob/main/it-and-security/lib/macos/enrollment-profiles/automatic-enrollment.dep.json', 'GET /vulnerability-management': (req,res)=> { let originalQueryString = req.url.match(/\?(.+)$/) ? '?'+req.url.match(/\?(.+)$/)[1] : ''; return res.redirect(301, sails.config.custom.baseUrl+'/software-management'+originalQueryString);}, 'GET /endpoint-ops': (req,res)=> { let originalQueryString = req.url.match(/\?(.+)$/) ? '?'+req.url.match(/\?(.+)$/)[1] : ''; return res.redirect(301, sails.config.custom.baseUrl+'/observability'+originalQueryString);},