mirror of
https://github.com/fleetdm/fleet
synced 2026-05-24 01:18:42 +00:00
Update query library README and add contributor template (#592)
- Update the `/handbook/queries` README with description, contributors section, and additional links - Add template for contributors
This commit is contained in:
parent
505d53b02b
commit
114dd94770
2 changed files with 57 additions and 3 deletions
|
|
@ -1,6 +1,35 @@
|
|||
# Queries
|
||||
# Standard query library
|
||||
|
||||
Fleet's standard query library includes a growing collection of useful queries for organizations deploying Fleet and osquery.
|
||||
|
||||
## Potentially interesting queries to consider writing up
|
||||
### Queries
|
||||
|
||||
-
|
||||
- [Detect machines with gatekeeper disabled](./detect-machines-with-gatekeeper-disabled.md)
|
||||
- [Detect presence of authorized SSH keys](./detect-presence-of-authorized-ssh-keys.md)
|
||||
- [Find hosts with the firewall disabled](./find-hosts-with-the-firewall-disabled.md)
|
||||
- [Get installed Chrome extensions](./get-installed-chrome-extensions.md)
|
||||
- [Get installed FreeBSD software](./get-installed-freebsd-software.md)
|
||||
- [Get installed Homebrew packages](./get-installed-homebrew-packages.md)
|
||||
- [Get installed Linux software](./get-installed-linux-software.md)
|
||||
- [Get installed macOS software](./get-installed-macos-software.md)
|
||||
- [Get installed Safari extensions](./get-installed-safari-extensions.md)
|
||||
- [Get installed Windows software](./get-installed-windows-software.md)
|
||||
- [Get laptops with failing batteries](./get-laptops-with-failing-batteries.md)
|
||||
- [Get macOS disk free space percentage](./get-macos-disk-free-space-percentage.md)
|
||||
- [Get System Logins and Logouts](./get-system-logins-and-logouts.md)
|
||||
- [Get wifi status](./get-wifi-status.md)
|
||||
- [Get Windows machines with unencrypted hard disks](./get-windows-machines-with-unencrypted-hard-disks.md)
|
||||
- [Platform info snapshot](./platform_info_snapshot.md)
|
||||
|
||||
### Contributors
|
||||
|
||||
Want to add your own query?
|
||||
|
||||
Please submit a pull request using the [Fleet standard query library template](./standard-query-library-template.md).
|
||||
|
||||
### Additional resources
|
||||
|
||||
Listed below are great resources that contain additional queries.
|
||||
|
||||
- Osquery (https://github.com/osquery/osquery/tree/master/packs)
|
||||
- Palantir osquery configuration (https://github.com/palantir/osquery-configuration/tree/master/Fleet)
|
||||
|
|
|
|||
25
handbook/queries/standard-query-library-template.md
Normal file
25
handbook/queries/standard-query-library-template.md
Normal file
|
|
@ -0,0 +1,25 @@
|
|||
<!-- What is your query called? Rename this markdown file with a human readable query name. -->
|
||||
|
||||
<!-- Replace "< TODO Query title >" with your query's name. -->
|
||||
|
||||
# < TODO Query name >
|
||||
|
||||
<!-- Describe your query. What does information does your query reveal? -->
|
||||
|
||||
### Support
|
||||
|
||||
<!-- What platforms (operating systems) support your query? -->
|
||||
|
||||
### Query
|
||||
|
||||
```sql
|
||||
<!-- Insert query here -->
|
||||
```
|
||||
|
||||
### Purpose
|
||||
|
||||
<!-- What is the goal of running your query? Ex. Information or Detection -->
|
||||
|
||||
### Remediation
|
||||
|
||||
<!-- Are there any remediation steps to resolve the detection triggered by your query? If not, insert "N/A." -->
|
||||
Loading…
Reference in a new issue