empayre/fleet
14
0
Fork 0
mirror of https://github.com/empayre/fleet.git synced 2024-11-06 08:55:24 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
998e1dfb6b
fleet/docs/01-Using-Fleet/standard-query-library
History
Eric 8fb22579ea
Reorganize Fleet documentation (#12871) 
Closes: #12611

Changes:
- Added three new documentation sections `/docs/get-started/`,
`/docs/configuration` and `/docs/rest api/`
- Updated folder names: `/docs/Using-Fleet/` » `/docs/Using Fleet` and
`/docs/deploying` » `/docs/deploy/`
- Moved `/docs/using-fleet/process-events.md` to `/articles` and updated
the meta tags to change it into a guide.
- Added support for a new meta tag: `navSection`. This meta tag is used
to organize pages in the sidebar navigation on fleetdm.com/docs
- Moved `docs/using-fleet/application-security.md` and
`docs/using-fleet/security-audits.md` to the security handbook.
- Moved `docs/deploying/load-testing.md` and
`docs/deploying/debugging.md` to the engineering handbook.
- Moved the following files/folders:
- `docs/using-fleet/configuration-files/` »
`docs/configuration/configuration-files/`
- `docs/deploying/configuration.md` »
`docs/configuration/fleet-server-configuration.md`
    -  `docs/using-fleet/rest-api.md` » `docs/rest-api/rest-api.md`
- `docs/using-fleet/monitoring-fleet.md` » `docs/deploy/rest-api.md`
- Updated filenames:
- `docs/using-fleet/permissions.md` »
`docs/using-fleet/manage-access.md`
- `docs/using-fleet/adding-hosts.md` »
`docs/using-fleet/enroll-hosts.md`
    -  `docs/using-fleet/teams.md` » `docs/using-fleet/segment-hosts.md`
- `docs/using-fleet/fleet-ctl-agent-updates.md` »
`docs/using-fleet/update-agents.md`
- `docs/using-fleet/chromeos.md` »
`docs/using-fleet/enroll-chromebooks.md`
- Updated the generated markdown in `server/fleet/gen_activity_doc.go`
and `server/service/osquery_utils/gen_queries_doc.go`
- Updated the navigation sidebar and mobile dropdown links on docs pages
to group pages by their `navSection` meta tag.
- Updated fleetdm.com/docs not to show pages in the `docs/contributing/`
folder in the sidebar navigation
- Added redirects for docs pages that have moved.

.

---------

Co-authored-by: Mike Thomas <mthomas@fleetdm.com>
Co-authored-by: Rachael Shaw <r@rachael.wtf>
2023-07-27 17:40:01 -05:00
..
README.md Reorganize Fleet documentation (#12871) 2023-07-27 17:40:01 -05:00
standard-query-library.yml Standard Query Library: Docker application specified for standard policy (#10380) 2023-04-13 10:24:49 -04:00

README.md

Standard query library

Fleet's standard query library includes a growing collection of useful policies and miscellaneous queries for organizations deploying Fleet and osquery.

Importing the queries in Fleet

After cloning the fleetdm/fleet repo, import the queries and policies found in docs/01-Using-Fleet/standard-query-library/standard-query-library.yml using fleetctl:

fleetctl apply -f docs/01-Using-Fleet/standard-query-library/standard-query-library.yml

Contributors

Do you want to add your own query?

  1. Please copy the following YAML section and paste it at the bottom of the standard-query-library.yml file.
---
apiVersion: v1
kind: query
spec:
  name: What is your query called? Please use a human-readable query name.
  platforms: What operating systems support your query? This can usually be determined by the osquery tables included in your query. Heading to the https://osquery.io/schema webpage to see which operating systems are supported by the tables you include.
  description: Describe your query. What information does your query reveal? (optional)
  query: Insert query here
  purpose: What is the goal of running your query? Ex. Detection
  remediation: Are there any remediation steps to resolve the detection triggered by your query? If not, insert "N/A."
  contributors: zwass,mike-j-thomas
  tags: Keywords that can help users find other relevant queries; a comma should separate each tag. (e.g., "foo, bar")

  1. Replace each field and submit a pull request to the fleetdm/fleet GitHub repository.

  2. If you want to contribute multiple queries, please open one pull request that includes all your queries.

For instructions on submitting pull requests to Fleet, check out the Committing Changes section in the Contributors documentation.

Additional resources

Listed below are great resources that contain additional queries.