Commit Graph

81 Commits

Author SHA1 Message Date
RachelElysia
ce543f28fa
Standard Query Library: Docker application specified for standard policy (#10380) 2023-04-13 10:24:49 -04:00
Zach Wasserman
7fa739889d
Add 'Get Crowdstrike Falcon network content filter status' to query library (#9931) 2023-02-17 20:16:28 -08:00
Eric
09b88d0341
Website: Add "Requires MDM" badge to /queries page (#9296)
Changes:
- Added a "MDM required" tag to the queries in the standard query
library that use the `managed_policies` table.
- Updated the build script to add a `requiresMdm` value to queries added
to `builtStaticContent.queries`, and to set it to true if a query has
the "MDM required" tags
- Updated the `/queries` page to add a "Requires MDM" badge to queries
that have `requiresMdm: true`
 . . .

Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
2023-01-12 10:05:03 -06:00
Mo Zhu
1ecd235312
Revert "Add MDM-enforced OS autoupdate query (#8927)" (#8944)
This reverts commit 61f2d5fe58.

This query already existed here: https://fleetdm.com/queries/automatic-installation-of-operating-system-updates-is-enabled-mac-os. I didn't see it because of the "built-in" default filter.
2022-12-07 08:04:50 -08:00
Mo Zhu
61f2d5fe58
Add MDM-enforced OS autoupdate query (#8927)
Necessary for Vanta integration, since currently, we do not store autoupdate information.
2022-12-06 14:08:13 -08:00
Noah Talerman
acb297d505
Update "No 1Password recovery kits..." policy (#8800)
* Update "No 1Password recovery kits..." policy

- Update policy in standard query library shown on fleetdm.com
- Update policy in standard templates shown in Fleet UI

* Update policy template shown in UI

* Commit Sharvil's exits to standard query library

* Commit Sharvil's edits to policy templates
2022-11-29 10:21:55 -05:00
Mo Zhu
7715b50f53
Fix emergency geolocation query (#8723) 2022-11-15 11:46:37 -08:00
Mo Zhu
389ccc03cd
Update standard-query-library.yml (#8688) 2022-11-11 13:59:38 -08:00
Mo Zhu
d57b5b9ec8
Include emergency geolocation query (#8483)
* Include emergency geolocation query

https://fleetdm.com/guides/locate-assets-with-osquery

* Update standard-query-library.yml

Co-authored-by: Guillaume Ross <guillaume@fleetdm.com>
2022-11-11 11:54:01 -08:00
Guillaume Ross
4af331ac40
Adding a query for default handlers (#7924)
* Adding a query

* Update standard-query-library.yml

Thanks @brunerd and @brockwalters!

* Update standard-query-library.yml

Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
2022-11-09 15:01:04 -05:00
Eric
52da2a3108
change relative links in documentation (#8441) 2022-10-26 18:26:49 -05:00
Guillaume Ross
ff1941c755
Adding policy queries (#8298) 2022-10-24 12:45:58 +00:00
Eric
2408dc0298
remove platforms attribute, update query library to use platform (#8116) 2022-10-07 12:10:30 -05:00
Josh Brower
b7daa3d0ad
Add Windows CIS policies (#7959)
- Add 7 policies to fleetdm.com/queries and the Fleet product
2022-10-06 12:43:34 -04:00
RachelElysia
3054450065
Improve developer documentation: Update seed data documentation (#7904) 2022-10-05 12:42:45 -04:00
Nabil Schear
cbe2d252df
Discover Python Packages from Running Python Interpreters query (#7857)
* Discover Python Packages from Running Python Interpreters documentation

* add hunting tag

Co-authored-by: Guillaume Ross <guillaume@binaryfactory.ca>

* Removed extra quote

Co-authored-by: Guillaume Ross <guillaume@binaryfactory.ca>
Co-authored-by: Guillaume Ross <guillaume@fleetdm.com>
2022-09-20 16:10:25 -04:00
Mo Zhu
325adad941
query for discovering TLS certs (#7797)
* query for discovering TLS certs

* Update standard-query-library.yml

* Use Nabil as the contributor

Co-authored-by: Zach Wasserman <zach@fleetdm.com>

* More accurate description of query purpose

Co-authored-by: Zach Wasserman <zach@fleetdm.com>

Co-authored-by: Zach Wasserman <zach@fleetdm.com>
2022-09-20 11:16:59 -07:00
Noah Talerman
035ef3f6e7
Update standard policies and policy templates (#7662)
- Remove "[CIS x.x.x]" tags from product
- Add "CIS" tag to all policies in the standard query library on fleetdm.com
- Remove duplicate "Guest users"policy
- Update language in policies' names and descriptions to be consistent
2022-09-09 11:00:20 -04:00
Guillaume Ross
54569281de
Fixing bug and bumping versions for AV check on macOS (#7522)
The policy had been pasted in `constants.ts` wrong - replacing with the right one, and while I'm here, bumping the versions.
2022-09-01 14:28:30 -04:00
Guillaume Ross
6833114328
Update standard-query-library.yml (#7486) 2022-08-31 13:45:45 -04:00
Guillaume Ross
f413ae764a
7231 - Second batch of macOS policy queries for CIS Benchmark (#7380)
* Adding CIS 1.5 / 1.6 / 2.2.1 to constants.ts

* Adding CIS 1.5 / 1.6 / 2.2.1 to standard query library

* Adding 2.3.1

* Adding 2.3.1 to query library and 2.4.2 to both

* Adding 2.4.10

* Tagging 2.5.1.1

* Tagging 2.5.2.1

* Tagging 2.5.2.2

* Adding 2.5.6

* Adding 2.6.1.4

* Adding 3.6

* Tagging 5.1.2

* Tagging 5.2.2

* Tagging 5.8

The query we have for the screen lock is comprehensive and covers more than one CIS requirement

* Adding 6.1.3 and 6.1.4
2022-08-26 16:59:16 -04:00
Luke Heath
f08cf6c11c
Remove FreeBSD references from website, UI, and query library (#7279) 2022-08-24 16:03:35 -05:00
Guillaume Ross
c4ccf20bd6
Adding first set of CIS benchmark policies for macOS (#7296)
* Adding CIS 1.1 for macOS

* Adding CIS 1.2

* Fix linting

* Adding CIS 1.3

* Adding CIS 1.4

* Apply suggestions from code review

Committing Noah's suggestions

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>

* Fixed copy pasta errors + changed formatting

Fixed some auto update queries that were accidentally the same, and put [CIS X.X] between brackets in `constants.ts`

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
2022-08-22 19:23:09 +00:00
Luke Heath
2e640eee29
Remove macOS Ventura query from standard query library (#7306) 2022-08-19 18:12:12 -04:00
Noah Talerman
b0e37accc9
Update "Learn how to use Fleet" for Fleet Sandbox (#7142)
- Update "Learn how to use Fleet" docs page to walk a Fleet Sandbox user through adding their device and running a query
- Add a "Get operating system information" query to standard query library for the "Learn how to use Fleet" walkthrough
- Update Fleet's top level README to point users who want to try Fleet to Fleet Sandbox
- Update "How to install osquery..." (macOS, Windows, Linux) blog posts to point users who want to try Fleet to Fleet Sandbox
- Move `fleetctl preview` questions to "Contributing" FAQ section in docs. This is because `fleetctl preview` is now a testing tool for Fleet contributors
- Update "Deploying" docs to point users who want to try Fleet to Fleet Sandbox
2022-08-19 14:13:15 -04:00
Guillaume Ross
dcee7a15ea
Making Bitlocker policy stricter (#7253)
Adding a filter to check that this is happening on the C drive and not some random other drive.
2022-08-18 13:45:17 -04:00
RachelElysia
140a651f3b
Fix spelling and grammar in standard query library (#6937) 2022-08-02 10:12:54 -04:00
Desmi-Dizney
097f71e76c
Editor Pass - Adding password policy query to the default library (#6768)
* Editor Pass - Adding password policy query to the default library

Editor pass for:
-  https://github.com/fleetdm/fleet/pull/6641

* Update constants.ts

* Update frontend/utilities/constants.ts
2022-07-21 13:51:17 -05:00
Guillaume Ross
7559988000
Adding password policy query to the default library (#6641)
* Adding password policy query to the default library

Adding a built-in policy to check the minimum password length on macOS using the recently released password_policy table.

* Addding osquery minimum version + adding query to constants.ts
2022-07-13 15:26:31 -04:00
Noah Talerman
16cb302774
Update standard query library (#6564)
- Tweaked name and description of 2 policies in the standard query library to use consistent formatting
2022-07-08 17:06:26 -04:00
Desmi-Dizney
9444772e6c
Editor pass - add macOS Ventura hardware check (#6520)
Editor pass for:
-  https://github.com/fleetdm/fleet/pull/6494
2022-07-06 17:27:52 -05:00
Erik Gomez
2e2b5e7c1b
add macOS Ventura hardware check (#6494)
Adds a new policy to check for macOS Ventura. Adapted from https://gist.github.com/erikng/b1acc0e07f510f9378f6f78f3d7a7342
2022-07-05 17:39:25 -04:00
Guillaume Ross
04a0c355c5
Add Windows screen lock policy (#6167)
* Adding policy query to check firewall on Mac

This commit closes https://github.com/fleetdm/confidential/issues/1410 once merged.

* Adding policies

This commit closes https://github.com/fleetdm/confidential/issues/1412. Right now there is no way to check the screenlock so instead we check if a profile for screenlock is there.

https://github.com/fleetdm/confidential/issues/1410 also closed by this.

* Update constants.ts

Fixed space

* Resolution text fix for new policies

Fixed copy based on @zhumo's comments!

* Screen lock policy

Adding a policy to check if the inactivity timeout is enabled on Windows and set to 1800 seconds or less (30min)

* Update constants.ts

Fix identation

* Update Windows screen lock policy

Changed wording from "administrator" to "IT administrator" in both files.
2022-06-10 12:05:32 -04:00
Guillaume Ross
38aaaffd65
Add policies (#6158)
* Adding policy query to check firewall on Mac

This commit closes https://github.com/fleetdm/confidential/issues/1410 once merged.

* Adding policies

This commit closes https://github.com/fleetdm/confidential/issues/1412. Right now there is no way to check the screenlock so instead we check if a profile for screenlock is there.

https://github.com/fleetdm/confidential/issues/1410 also closed by this.

* Update constants.ts

Fixed space

* Resolution text fix for new policies

Fixed copy based on @zhumo's comments!
2022-06-09 15:20:30 -04:00
kswagler-rh
cffd324214
Adding Suspicious AutoStart Windows (#5977)
* Adding Suspicious AutoStart Windows

* Removed partial query

* switching the polarity of the query results
2022-06-03 14:04:11 -04:00
Desmi-Dizney
870219829b
Docs editor pass - 01-Using Fleet - Standard query library (#6040)
This has been edited for content and copy.
2022-06-02 14:14:08 -04:00
Guillaume Ross
293ede98d6
Adding tags to all queries (#5474) 2022-05-02 17:57:15 -04:00
Lucas Manuel Rodriguez
ed8faa791c
Add slack notification (#5481)
* Add slack notification

* Fix standard-query-library.yml
2022-05-02 08:42:20 -03:00
Desmi-Dizney
2feb1256f3
Docs editor pass - 01-Using-Fleet - Standard-query-library - README.md (#5420)
This has been edited for content and copy.
2022-04-29 09:18:13 -05:00
Desmi-Dizney
d6deec277f
Docs editor pass - 01-Using-Fleet - Standard-query-library - Standard-query-library.yml (#5427)
This has been reviewed for copy.
2022-04-29 09:17:53 -05:00
Desmi-Dizney
ed14c0b02a
Editor pass - New query and new policy: Identify optional fields to users - docs/01-Using-Fleet/standard-query-library/README.md (#5412)
Editor pass for: https://github.com/fleetdm/fleet/pull/5167 - docs/01-Using-Fleet/standard-query-library/README.md
2022-04-28 11:21:59 -05:00
RachelElysia
9ea6fe5efa
New query and new policy: Identify optional fields to users (#5167) 2022-04-20 08:48:47 -04:00
Noah Talerman
3ea0bc744b
Update standard query library to use platforms and platform (#5190)
* Add both `platform` and `platforms` keys as a workaround to support the website and Fleet product
2022-04-18 18:25:50 -04:00
Lucas Manuel Rodriguez
254c2c0208
Fix policies in standard query library (#5177) 2022-04-15 19:22:48 -03:00
Guillaume Ross
710afb3382
App up to date or not installed + no unencrypted SSH keys (#4989)
* App up to date or not installed

Adding "App installed and up to date OR not present" example

* Removed empty last line

* Update standard-query-library.yml

Added right descriptions and resolution for the Docker example, and added a new query to detect unencrypted SSH keys.

* Update docs/01-Using-Fleet/standard-query-library/standard-query-library.yml

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>

* Update docs/01-Using-Fleet/standard-query-library/standard-query-library.yml

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>

* Update docs/01-Using-Fleet/standard-query-library/standard-query-library.yml

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>

* Update standard-query-library.yml

Updated as per @noahtalerman's review

* Update docs/01-Using-Fleet/standard-query-library/standard-query-library.yml

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>

Co-authored-by: Noah Talerman <47070608+noahtalerman@users.noreply.github.com>
2022-04-12 09:23:55 -04:00
Mike McNeil
222d85178d
docs: Add link to standard query library (#4851) 2022-03-28 23:39:20 -05:00
Guillaume Ross
62042e35cd
Fix guest policy in standard query library and constants.ts (#4573)
* Fix guest policy in standard query library

* Fix guest policy in constants.ts
2022-03-14 14:31:33 -04:00
Guillaume Ross
4f8847ddd2
Adding new policy to check for MDM enrollment (#4343) 2022-03-03 14:22:23 -05:00
eashaw
0af5e161d0
Remove numbers from documentation filenames in Fleet repo (#4313)
* Renaming files and a lot of find and replace

* pageRank meta tags, sorting by page rank

* reranking

* removing numbers

* revert changing links that are locked to a commit

* update metatag name, uncomment github contributers

* Update basic-documentation.page.js

* revert link change

* more explicit errors, change pageOrderInSection numbers, updated sort

* Update build-static-content.js

* update comment

* update handbook link

* handbook entry

* update sort

* update changelog doc links to use fleetdm.com

* move standard query library back to old location, update links/references to location

* revert unintentional link changes

* Update handbook/community.md

Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>

Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
2022-02-23 12:17:55 -06:00
RachelElysia
50b71106db
Fix typos "included" to "include" (#4234) 2022-02-16 12:41:11 -05:00