mirror of
https://github.com/fleetdm/fleet
synced 2026-04-21 21:47:20 +00:00
fa55d72118
# Checklist for submitter #13486 If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md) - [ ] Documented any permissions changes (docs/Using Fleet/manage-access.md) - [X] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [X] Added/updated tests - [X] Manual QA for all new/changed functionality --------- Co-authored-by: RachelElysia <71795832+RachelElysia@users.noreply.github.com> Co-authored-by: Eric <eashaw@sailsjs.com> Co-authored-by: Sampfluger88 <108141731+Sampfluger88@users.noreply.github.com> Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com> Co-authored-by: Roberto Dip <me@roperzh.com> Co-authored-by: Tyler Diderich <15862572+tdiderich@users.noreply.github.com> Co-authored-by: Dave Herder <27025660+dherder@users.noreply.github.com> Co-authored-by: Rachael Shaw <r@rachael.wtf> Co-authored-by: Lucas Manuel Rodriguez <lucas@fleetdm.com> Co-authored-by: Sharon Katz <121527325+sharon-fdm@users.noreply.github.com> Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com> Co-authored-by: Nathanael Holliday <100959072+hollidayn@users.noreply.github.com> Co-authored-by: Katheryn Satterlee <me@ksatter.com> Co-authored-by: Mo Zhu <mo@fleetdm.com> Co-authored-by: Mo Zhu <mozhu888@gmail.com> Co-authored-by: Martin Angers <martin.n.angers@gmail.com> Co-authored-by: Robert Fairburn <8029478+rfairburn@users.noreply.github.com> Co-authored-by: Sabrina Coy <13890648+sabrinabuckets@users.noreply.github.com> Co-authored-by: Isabell Reedy <113355639+ireedy@users.noreply.github.com> Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Co-authored-by: Alex Mitchell <105945793+alexmitchelliii@users.noreply.github.com>
379 lines
8 KiB
YAML
379 lines
8 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the list of application scheme/protocol-based IPC handlers.
|
|
discard_data: false
|
|
interval: 86400
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: app_schemes
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from app_schemes;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the current disk encryption status for the target system.
|
|
discard_data: false
|
|
interval: 86400
|
|
logging: ""
|
|
min_osquery_version: 1.4.5
|
|
name: disk_encryption (posix)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from disk_encryption;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the current disk encryption status for the target system.
|
|
discard_data: false
|
|
interval: 300
|
|
logging: ""
|
|
min_osquery_version: 1.4.5
|
|
name: disk_encryption (darwin,linux)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from disk_encryption;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieve basic information about the physical disks of a system.
|
|
discard_data: false
|
|
interval: 86400
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: disk_info
|
|
observer_can_run: false
|
|
platform: chrome,windows
|
|
query: select * from disk_info;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the current filters and chains per filter in the target system.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.5
|
|
name: iptables
|
|
observer_can_run: false
|
|
platform: linux
|
|
query: select * from iptables;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description:
|
|
Retrieves all the daemons that will run in the start of the target
|
|
OSX system.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.5
|
|
name: launchd
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from launchd;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the list of listening ports.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: listening_ports (specs)
|
|
observer_can_run: false
|
|
platform: darwin,linux,windows
|
|
query: select * from listening_ports;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Retrieves the list of listening ports.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: listening_ports (utility)
|
|
observer_can_run: false
|
|
platform: darwin,linux,windows
|
|
query: select * from listening_ports;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Lists the application bundle that owns a sandbox label.
|
|
discard_data: false
|
|
interval: 86400
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: sandboxes
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from sandboxes;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: System resource usage limits.
|
|
discard_data: false
|
|
interval: 300
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: ulimit_info (smart)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from ulimit_info;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: System uptime.
|
|
discard_data: false
|
|
interval: 600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: uptime (kernel)
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from uptime;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: System uptime.
|
|
discard_data: false
|
|
interval: 600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: uptime (linwin)
|
|
observer_can_run: false
|
|
platform: linux,windows
|
|
query: select * from uptime;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: System uptime.
|
|
discard_data: false
|
|
interval: 600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: uptime (macwin)
|
|
observer_can_run: false
|
|
platform: darwin,windows
|
|
query: select * from uptime;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: System uptime.
|
|
discard_data: false
|
|
interval: 600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: uptime (sleuthkit)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from uptime;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Lists the application bundle that owns a sandbox label.
|
|
discard_data: false
|
|
interval: 86400
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: sandboxes
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from sandboxes;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (all)
|
|
observer_can_run: false
|
|
platform: ""
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (any)
|
|
observer_can_run: false
|
|
platform: ""
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (darwin,linux)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: ""
|
|
name: user groups (empty string platform, empty string version)
|
|
observer_can_run: false
|
|
platform: ""
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (linux,darwin)
|
|
observer_can_run: false
|
|
platform: darwin,linux
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (missing platform)
|
|
observer_can_run: false
|
|
platform: ""
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: ""
|
|
name: user groups (missing version)
|
|
observer_can_run: false
|
|
platform: darwin
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: List of all user groups.
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: user groups (windows,chrome)
|
|
observer_can_run: false
|
|
platform: chrome,windows
|
|
query: select * from user_groups;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description: Extracted information from Windows crash logs (Minidumps).
|
|
discard_data: false
|
|
interval: 3600
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: windows crashes
|
|
observer_can_run: false
|
|
platform: windows
|
|
query: select * from windows_crashes;
|
|
team: ""
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
automations_enabled: false
|
|
description:
|
|
Triggers one-off YARA query for files at the specified path. Requires
|
|
one of sig_group, sigfile, or sigrule.
|
|
discard_data: false
|
|
interval: 0
|
|
logging: ""
|
|
min_osquery_version: 1.4.7
|
|
name: yara (yara)
|
|
observer_can_run: false
|
|
platform: darwin,linux,windows
|
|
query: select * from yara;
|
|
team: ""
|