empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 17:05:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
228ff9587b
fleet/docs/01-Using-Fleet/standard-query-library
History
eashaw 0af5e161d0
Remove numbers from documentation filenames in Fleet repo (#4313) 
* Renaming files and a lot of find and replace

* pageRank meta tags, sorting by page rank

* reranking

* removing numbers

* revert changing links that are locked to a commit

* update metatag name, uncomment github contributers

* Update basic-documentation.page.js

* revert link change

* more explicit errors, change pageOrderInSection numbers, updated sort

* Update build-static-content.js

* update comment

* update handbook link

* handbook entry

* update sort

* update changelog doc links to use fleetdm.com

* move standard query library back to old location, update links/references to location

* revert unintentional link changes

* Update handbook/community.md

Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>

Co-authored-by: Mike Thomas <78363703+mike-j-thomas@users.noreply.github.com>
Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
2022-02-23 12:17:55 -06:00
..
README.md Remove numbers from documentation filenames in Fleet repo (#4313) 2022-02-23 12:17:55 -06:00
standard-query-library.yml Fix typos "included" to "include" (#4234) 2022-02-16 12:41:11 -05:00

README.md

Standard query library

Fleet's standard query library includes a growing collection of useful queries for organizations deploying Fleet and osquery.

Importing the queries in Fleet

After cloning the fleetdm/fleet repo, import the queries using fleetctl:

fleetctl apply -f docs/01-Using-Fleet/standard-query-library/standard-query-library.yml

Contributors

Want to add your own query?

  1. Please copy the following yaml section and paste it at the bottom of the standard-query-library.yml file.
---
apiVersion: v1
kind: query
spec:
  name: What is your query called? Please use a human readable query name.
  platforms: What operating systems support your query? This can usually be determined by the osquery tables included in your query. Heading to the https://osquery.io/schema webpage to see which operating systems are supported by the tables you include.
  description: Describe your query. What does information does your query reveal?
  query: Insert query here
  purpose: What is the goal of running your query? Ex. Detection
  remediation: Are there any remediation steps to resolve the detection triggered by your query? If not, insert "N/A."
  contributors: zwass,mike-j-thomas
  tags: Keywords that can help users find other relevant queries, each tag should be seperated by a comma. (e.g., "foo,bar")

  1. Replace each field and submit a pull request to the fleetdm/fleet GitHub repository.

  2. If you want to contribute multiple queries, please open one pull request that includes all your queries.

For instructions on submitting pull requests to Fleet check out the Committing Changes section in the Contributors documentation.

Additional resources

Listed below are great resources that contain additional queries.