Commit Graph

43 Commits

Author SHA1 Message Date
Roberto Dip
69bb2abc18
modify query for when encryption key has newlines (#10094) 2023-02-28 15:54:24 -03:00
Zach Wasserman
7c9454c92d
Changes in Fleet server to support Fleetd for Chrome (#10047)
These are minor changes needed to support the new ChromeOS extension.
This should have no effect on non-Chrome platforms.

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests
- [x] Manual QA for all new/changed functionality
2023-02-23 09:18:04 -03:00
Roberto Dip
046401d190
Ingest file vault recovery keys in macOS (#9712)
Related + details at https://github.com/fleetdm/fleet/issues/8708
2023-02-08 11:49:42 -03:00
Tomas Touceda
65783d49c7
Add feature to change or disable Fleet's hardcoded detail queries (#9117)
#8984

- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Added/updated tests

Co-authored-by: Lucas Rodriguez <lucas@fleetdm.com>
2023-01-09 08:56:10 -03:00
Tomas Touceda
af0842804d
Improve how we are logging failed queries and windows detail queries (#9059)
* Improve how we are logging failed queries and windows detail queries

* Update failing tests

* Remove unneeded table in this particular select

* Update tests now that we dont rely on release_id

* Update ingestion since we want to ingest failures for policies and live queries

* We also want labels with failures

* Fix test since we are logging errors slightly differently

* Improve logging and error handling

* Revert back test change

* Actually, we need to OR the booleans to maintain logic
2022-12-21 17:37:40 -03:00
Tomas Touceda
68bd8661e9
Simplify disk encryption query in linux and filter at ingestion (#9037)
* Simplify disk encryption query in linux and filter at ingestion

* Join with mounts to detect whatever is encrypting /
2022-12-19 10:01:59 -03:00
Frank Sievertsen
0dbbad8e10
Exclude windows servers from mdm aggregation and lists (#8585) 2022-11-08 10:29:40 +01:00
Martin Angers
7fbe394b94
Ingest disk encryption flag for hosts, return in GET /hosts/{id} endpoint (#8526) 2022-11-02 15:44:02 -04:00
Frank Sievertsen
baa1ddc0f2
Add MDM detection for windows and mdm endpoints (#8479) 2022-11-01 18:22:07 +01:00
Michal Nicpon
3801f1c6d1
improve primary ip host detail query (#8407)
Previously, the primary ip was determined using the interface with the most traffic. This had a few issues and required explicitly filtering out certain interfaces that we don't want eg loopback, docker.

Instead, use the default route to determine the primary (private) ip. If there are multiple, use the one with the lowest metric and prefer ipv4 addresses.
2022-10-27 16:34:49 -06:00
gillespi314
881194b3b4
Add orbit version and osquery version usage statistics (#8229) 2022-10-24 11:12:56 -05:00
Lucas Manuel Rodriguez
42c47a6fa7
Add missing return to ingestKubequeryInfo (#8178)
* Add missing return to ingestKubequeryInfo

* No need to log error twice
2022-10-12 09:00:49 -03:00
Roberto Dip
e630fabf89
token rotation for fleet desktop (#7779)
This implements what's described in detail here https://github.com/fleetdm/fleet/blob/main/proposals/fleet-desktop-token-rotation.md
2022-10-10 17:15:35 -03:00
gillespi314
e3590beaf7
Ingest ReleaseId from Windows registry (#8030) 2022-10-04 10:34:08 -05:00
Zach Wasserman
486b67caca
Add initial support for kubequery (#6863)
Configuration and fixes for the Fleet server and frontend to add support
for https://github.com/Uptycs/kubequery.

Co-authored-by: Michal Nicpon <michal@fleetdm.com>
2022-09-15 10:02:17 -06:00
gillespi314
8157359f84
Ingest Windows host display version for hosts table (#7403) 2022-08-30 10:16:48 -05:00
Roberto Dip
eeefe2fab9
enable controlled rollout of features by teams (#7408) 2022-08-30 08:13:09 -03:00
Juan Fernandez
3048a07fd1
Feature 7076: Ingest installed windows updates (#7138)
* Ingest installed Windows updates and store them in the windows_updates table. 
* Added config option for enabling/disabling Windows update ingestion and Windows OS vuln. detection.
2022-08-26 14:55:03 -04:00
Roberto Dip
9a1d2066bb
deprecate host_settings in favor of features (#7358)
Related to #7312, this makes use of the changes introduced in #7353 to rename host_settings to features while keeping backwards compatibility.
2022-08-25 13:41:50 -03:00
Juan Fernandez
4013cbbdfc
Feature 6975: Populate vendor column in software inventory (#7297)
- Populate 'software.vendor' when ingesting software from Windows hosts.
- Increate width of 'software.vendor'.
2022-08-18 18:02:56 -04:00
Martin Angers
9755eb2e27
Support async saving of scheduled query statistics (#7012) 2022-08-10 10:01:05 -04:00
gillespi314
3a88afaf98
Add new database tables and queries for host operating systems (#6920) 2022-08-09 13:34:41 -05:00
Eng Zer Jun
1ab171faf3
test: use T.Setenv to set env vars in tests (#6714)
This commit replaces `os.Setenv` with `t.Setenv` in tests. The
environment variable is automatically restored to its original value
when the test and all its subtests complete.

Reference: https://pkg.go.dev/testing#T.Setenv
Signed-off-by: Eng Zer Jun <engzerjun@gmail.com>
2022-07-18 14:22:28 -03:00
Roberto Dip
1ed8efacfa
increase the length of host_batteries.health (#6560)
Rel to #6559, this increases the size of host_batteries.health for cases like "Check Battery" that exceed 10 chars
2022-07-08 21:06:50 +00:00
Martin Angers
539be8ee09
Add battery info in host details response (#6394) 2022-06-28 14:11:49 -04:00
gillespi314
15de4f3e65
Update Fleet host detail query so os_version for Ubuntu hosts reflects accurate patch number in point release (#6360) 2022-06-23 15:24:18 -05:00
Tomas Touceda
fc215610a4
Allow users to customize detail queries for troubleshooting purposes (#6150)
* Allow users to customize detail queries for troubleshooting purposes

* Address review comments
2022-06-09 10:33:49 -03:00
Roberto Dip
a4725518ac
filter out Google Chrome profiles without an associated email before ingesting (#5440)
To add support for #400, we're using the macadmins/osquery-extension to gather Google Chrome profiles from hosts.

Under the hood, the extension looks and parses a json file in which Chrome stores a bunch of data. Given that emails are not required to create Chrome profiles, some of the profiles stored in this file and returned by the query we're using contain empty emails.

The idea after this change is to prevent empty emails from being ingested in the first place instead of filtering them after the fact. I have also included a migration to clean the rows with empty email columns.

Fixes #4780
2022-05-02 09:55:40 -03:00
Zach Wasserman
f28d5ab5be
Skip Docker interfaces for host primary IP (#5119)
See #4754
2022-04-13 11:04:38 -07:00
Benjamin Edwards
74bb559645
Add public ip to hosts & derive geolocation when rendering host (#4652)
* geoip wip
* return nil if ip is empty string or if ParseIP returns nil
* add ui component to render geolocation if available, address PR feedback
* render public ip if available
* add changes file, document geoip in deployment guide
* update rest-api docs
2022-03-21 12:29:52 -04:00
Lucas Manuel Rodriguez
d2ba34c8fc
Add distributed discovery query support for detail queries, add orbit… (#4597)
* Add distributed discovery query support for detail queries, add orbit_info ingestion

* Amend changes file
2022-03-15 16:51:00 -03:00
Zachary Winnerman
3babf53cf4
Fix OSVersion to work properly when distribution does not follow symver (#3968)
* Fix OSVersion to work properly when distribution does not follow symver

Certain distros such as ClearLinux or ArchLinux do not use symver or any
dotted versioning scheme for their releases. Archlinux uses the static
string "Rolling" and ClearLinux uses a single build number such as 35550
for their versions.

In Fleet console, this shows up as a string like "Archlinux 0.0.0.0"
which makes very little sense to the user. This change makes it so that
if OSQuery cannot generate a dotted version number, we should instead
use the build id as an opaque string.

* Add /changes

* Add tests for os_version

* fixup

* fixup
2022-02-14 12:55:23 -05:00
Tomas Touceda
d167556514
Make sure we handle unenrolling properly (#4158)
* Make sure we handle unenrolling properly

* Update failing test

* Fix test
2022-02-11 08:27:15 -03:00
Tomas Touceda
11887f87f7
Add enable scheduled query stats to fleet config (#4066)
* Add enable scheduled query stats to fleet config as well

* Add documentation

* Revert "Allow disabling scheduled query stats via app config (#4049)"

This reverts commit f98fd4d331.

* Add changes file

* Update ref

* Add missing docs
2022-02-09 08:20:29 -03:00
Tomas Touceda
f98fd4d331
Allow disabling scheduled query stats via app config (#4049)
* Allow disabling scheduled query stats via app config

* Update tests

* Fix test

* Moar test fixes

* Remove redundant set

* Add documentation

* Fix typo in docs
2022-02-07 13:37:54 -03:00
Lucas Manuel Rodriguez
371c533bfc
Improved Datastore usage of osquery hosts requests (#3601)
* WIP

* Amend tests

* Do not load aggregated stats for packs

* Add option to host lite

* Fix remaining TODOs

* Fix osquery_utils tests

* Fix SQL

* Fix SQL (bis)

* Restore AuthenticateHost to load once

* Code improvements and re-add deferred host save

* More fixes to the PR

* Wrap users table update on tx

* Add caching to ListPacksForHost and ListScheduledQueriesInPack

* Remove SaveHostSoftware (replaced by UpdateHostSoftware)

* Add unit tests for new functionality

* Add changes file

* Fix scheduled queries test
2022-01-17 22:52:09 -03:00
Lucas Manuel Rodriguez
30e922db07
Fix mdm direct query ingestion for non-mdm hosts (#3483)
* Fix mdm direct query ingestion for non-mdm hosts

* Amend TODO comment

* Add dummy test
2021-12-24 09:43:31 -03:00
Martin Angers
1e2059585a
Add support for google chrome profiles (#3423) 2021-12-21 15:36:19 -05:00
Tomas Touceda
39e71c6d77
Add mdm and munki (#3406)
* Draft for mdm and munki as direct ingest funcs

* Expose mdm/munki over API

* Add test for service and fix bug

* Update queries test

* Fix lint

* Address review comments
2021-12-21 09:37:58 -03:00
Tomas Touceda
142006cbdd
Issue 2099 enable vulnerability processing new installs (#3104)
* Enable vulnerability processing by default

* Add changes file

* Remove wrong env var

* Fix import

* Fix tests

* Update log line

* Remove unneeded import
2021-12-03 14:44:57 -03:00
Tomas Touceda
ad18728ac3
Issue 1601 disk space (#1735)
* wip

* Add tests

* Add migration

* Fix tests and set platform for windows correctly
2021-08-20 14:57:37 -03:00
Tomas Touceda
c6c63ab12a
Refactor app config (POC, for now) (#1685) 2021-08-20 12:27:41 -03:00
Tomas Touceda
11dff7ca92
Issue 1588 allow disabling host users (#1611)
* Allow users to disable host_users

* Add missing files

* Address review comments

* Fix tests

* Check additional queries for nil, not the whole hostsettings

* Finally fix tests
2021-08-11 14:56:11 -03:00