mirror of
https://github.com/fleetdm/fleet
synced 2026-05-02 19:07:38 +00:00
7b4d9aa487
For #24473 This PR allows users to add / update / remove labels from queries via Gitops. ## Testing 1. Create a few labels in the UI 1. Create a global query "foo" in the UI without labels 2. Create a global query "bar" in the UI with labels 2. Create a global query "baz" in the UI with labels 4. Use `fleetctl gitops` with a global .yml file, and under `queries:` and "foo", "bar", "baz" and "boop". * Add labels to "foo" with `labels_include_any:` * Don't add `labels_include_any:` to "bar" * Add labels to "baz" with `labels_include_any:`, but different labels than what you added in the UI * Add labels to "boop" with `labels_include_any:` The expected outcome when viewing the queries in the UI (on the "edit query" screen) * Foo, Baz and Boop should have the labels specified in gitops * Bar should have no labels
379 lines
8 KiB
YAML
379 lines
8 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the list of application scheme/protocol-based IPC handlers.
|
|
discard_data: false
|
|
interval: 86400
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: app_schemes
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from app_schemes;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the current disk encryption status for the target system.
|
|
discard_data: false
|
|
interval: 86400
|
|
logging: ""
|
|
min_osquery_version: 1.4.5
|
|
name: disk_encryption (posix)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from disk_encryption;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the current disk encryption status for the target system.
|
|
discard_data: false
|
|
interval: 300
|
|
logging: ""
|
|
min_osquery_version: 1.4.5
|
|
name: disk_encryption (darwin,linux)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from disk_encryption;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieve basic information about the physical disks of a system.
|
|
discard_data: false
|
|
interval: 86400
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: disk_info
|
|
observer_can_run: false
|
|
platform: chrome,windows
|
|
query: select * from disk_info;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the current filters and chains per filter in the target system.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.5
|
|
name: iptables
|
|
observer_can_run: false
|
|
platform: linux
|
|
query: select * from iptables;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description:
|
|
Retrieves all the daemons that will run in the start of the target
|
|
OSX system.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.5
|
|
name: launchd
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from launchd;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the list of listening ports.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: listening_ports (specs)
|
|
observer_can_run: false
|
|
platform: darwin,linux,windows
|
|
query: select * from listening_ports;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the list of listening ports.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: listening_ports (utility)
|
|
observer_can_run: false
|
|
platform: darwin,linux,windows
|
|
query: select * from listening_ports;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Lists the application bundle that owns a sandbox label.
|
|
discard_data: false
|
|
interval: 86400
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: sandboxes
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from sandboxes;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: System resource usage limits.
|
|
discard_data: false
|
|
interval: 300
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: ulimit_info (smart)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from ulimit_info;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: System uptime.
|
|
discard_data: false
|
|
interval: 600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: uptime (kernel)
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from uptime;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: System uptime.
|
|
discard_data: false
|
|
interval: 600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: uptime (linwin)
|
|
observer_can_run: false
|
|
platform: linux,windows
|
|
query: select * from uptime;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: System uptime.
|
|
discard_data: false
|
|
interval: 600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: uptime (macwin)
|
|
observer_can_run: false
|
|
platform: darwin,windows
|
|
query: select * from uptime;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: System uptime.
|
|
discard_data: false
|
|
interval: 600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: uptime (sleuthkit)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from uptime;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Lists the application bundle that owns a sandbox label.
|
|
discard_data: false
|
|
interval: 86400
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: sandboxes
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from sandboxes;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (all)
|
|
observer_can_run: false
|
|
platform: ""
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (any)
|
|
observer_can_run: false
|
|
platform: ""
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (darwin,linux)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: ""
|
|
name: user groups (empty string platform, empty string version)
|
|
observer_can_run: false
|
|
platform: ""
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (linux,darwin)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (missing platform)
|
|
observer_can_run: false
|
|
platform: ""
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: ""
|
|
name: user groups (missing version)
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (windows,chrome)
|
|
observer_can_run: false
|
|
platform: chrome,windows
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Extracted information from Windows crash logs (Minidumps).
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: windows crashes
|
|
observer_can_run: false
|
|
platform: windows
|
|
query: select * from windows_crashes;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description:
|
|
Triggers one-off YARA query for files at the specified path. Requires
|
|
one of sig_group, sigfile, or sigrule.
|
|
discard_data: false
|
|
interval: 0
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: yara (yara)
|
|
observer_can_run: false
|
|
platform: darwin,linux,windows
|
|
query: select * from yara;
|
|
team: ""
|