Changes:
- Changed the version of osquery schema we merge with Fleet's overrides
from `5.7.0` to `5.8.1`
- Rand the `generate-merged-schema` script to regenerate
`osquery_fleet_schema.json` .
## EDIT
Mike: Hi Eric, if my changes look good to you, and if it's passing CI,
would you merge?
.
---------
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
This adds a new check about whether all APFS volumes are encrypted. I
needed to add a new table, and I took that opportunity to add another so
that osquery has all information from `diskutil apfs list -plist`.
Note that it is somewhat unclear whether to use the `encryption` or
`filevault` field in the query. FileVault is about whether the volume is
encrypted with a password and Encryption is about whether it is
encrypted at all, since all modern macs have hardware-backed disk
encryption.
#9260
- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
#9260
- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- ~[ ] Added/updated tests~
- [X] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
#9260
- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
#9260
- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
Changes:
- Added three errors to
`website/api/helpers/get-extended-osquery-schema.js` that are thrown if
a YAML schema table has:
- A `platforms` value that is not an array
- A `description` value that is not a string
- A `columns` value that is not an array
- Updated the `platforms` of YAML schema tables in `schema/tables/` that
had string `platforms` values
- Regenerated `/schema/osquery_fleet_schema.json`
.
Changes:
- Updated the version of the osquery schema we merge with Fleet's
overrides (`5.6.0` » `5.7.0`)
- Ran the `generate-merged-schema` script to regenerate
`schema/osquery_fleet_schema.json`
. .
As raised by a community member in
[Slack](https://osquery.slack.com/archives/C01DXJL16D8/p1672751794862639),
this updates our documentation to account for both `unified_log` and
`macadmins_unified_log`.
Per my testing, it should also help with the #9158 bug in Fleet's UI.
I have updated the columns of `macadmins_unified_log` according to
what's in the [source
code](50f94d0d70/tables/unifiedlog/unified_log.go (L47-L69)),
and modified the example to work.
Since I was there I have also updated the osquery version we use to pull
the JSON to `5.6.0` and fixed a small bug related to the examples we
pull from there.
. . . . . . .
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
* Adding tables from the macadmins extension pack
Part 1!
* Adding the 2nd set of macadmins extension tables
Will review in another commit tomorrow before submitting PR
* Fixing typos and example queries
* Add notes re: OUI and wireshark OUI lookup for arp_cache
* More info on ARP spoofing
Co-authored-by: Guillaume Ross <guillaume@fleetdm.com>
* Fix links in markdown
Co-authored-by: Eric <eashaw@sailsjs.com>
Co-authored-by: Guillaume Ross <guillaume@fleetdm.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
* update helper to use the osquery schema from the osquery/osquery-site repo
* update script description and generated json filename
* Add ritual to digital experience handbook
* add merged schema
* Update README.md
* Update get-extended-osquery-schema.js
* Update fleet_schema.json
* Make description uppercase.
Co-authored-by: Guillaume Ross <guillaume@fleetdm.com>
Co-authored-by: Guillaume Ross <guillaume@fleetdm.com>
* Adding a bunch of examples
Adding a bunch of examples and fixing missing trailing `;`s in existing ones
* Delete .sailsrc
Added .sailsrc accidentally form building locally
* Replaced sailsrc with original content
* Fixed typo in table name
* Undoing .sailsrc again
Ooops!
