diff --git a/handbook/queries/README.md b/handbook/queries/README.md index 3a71ad3f90..1c79413010 100644 --- a/handbook/queries/README.md +++ b/handbook/queries/README.md @@ -1,6 +1,35 @@ -# Queries +# Standard query library +Fleet's standard query library includes a growing collection of useful queries for organizations deploying Fleet and osquery. -## Potentially interesting queries to consider writing up +### Queries -- +- [Detect machines with gatekeeper disabled](./detect-machines-with-gatekeeper-disabled.md) +- [Detect presence of authorized SSH keys](./detect-presence-of-authorized-ssh-keys.md) +- [Find hosts with the firewall disabled](./find-hosts-with-the-firewall-disabled.md) +- [Get installed Chrome extensions](./get-installed-chrome-extensions.md) +- [Get installed FreeBSD software](./get-installed-freebsd-software.md) +- [Get installed Homebrew packages](./get-installed-homebrew-packages.md) +- [Get installed Linux software](./get-installed-linux-software.md) +- [Get installed macOS software](./get-installed-macos-software.md) +- [Get installed Safari extensions](./get-installed-safari-extensions.md) +- [Get installed Windows software](./get-installed-windows-software.md) +- [Get laptops with failing batteries](./get-laptops-with-failing-batteries.md) +- [Get macOS disk free space percentage](./get-macos-disk-free-space-percentage.md) +- [Get System Logins and Logouts](./get-system-logins-and-logouts.md) +- [Get wifi status](./get-wifi-status.md) +- [Get Windows machines with unencrypted hard disks](./get-windows-machines-with-unencrypted-hard-disks.md) +- [Platform info snapshot](./platform_info_snapshot.md) + +### Contributors + +Want to add your own query? + +Please submit a pull request using the [Fleet standard query library template](./standard-query-library-template.md). + +### Additional resources + +Listed below are great resources that contain additional queries. + +- Osquery (https://github.com/osquery/osquery/tree/master/packs) +- Palantir osquery configuration (https://github.com/palantir/osquery-configuration/tree/master/Fleet) diff --git a/handbook/queries/standard-query-library-template.md b/handbook/queries/standard-query-library-template.md new file mode 100644 index 0000000000..b7f05d9376 --- /dev/null +++ b/handbook/queries/standard-query-library-template.md @@ -0,0 +1,25 @@ + + + + +# < TODO Query name > + + + +### Support + + + +### Query + +```sql + +``` + +### Purpose + + + +### Remediation + +