Commit Graph

324 Commits

Author SHA1 Message Date
Stefano Bonicatti
d9d0a21b6b
Add some more information about formatting (#6202) 2020-01-29 10:09:06 -08:00
calve
600f21dcfb flags: Implement enable_tables (#6150)
Adds an ``--enable_tables`` CLI flag to specify a limited set of
tables to expose. This is the contrary of ``--disable_tables``.
2020-01-17 18:59:20 -05:00
Brendan Shaklovitz
382d8dab48 Add docs to show that config_dump flag exits (#6136) 2020-01-12 01:44:02 -05:00
Teddy Reed
8c891ab0a8
docs: Fix custom package markdown (#6110)
Co-Authored-By: Nick Anderson <nanderson7@gmail.com>
2019-12-10 00:32:27 -05:00
Stefano Bonicatti
0e0d7b719f Update building doc with Python packages needed by tests 2019-12-07 20:51:09 -05:00
Stefano Bonicatti
a30c67da30 Update steps to install prerequisites on all platforms
- Remove Python 2 as a prerequisite

- Add missing instructions when install Git for Windows

- Correct and move the paragraph about symbolic links permission earlier.
  The "Enable symbolic link" check available during the Git for Windows
  installing procedure doesn't enable the policy, but instead asks git
  to create real symlinks when cloning, which is still something
  we want.
2019-11-28 13:24:28 +01:00
mark m
706874c3d3 Implement azure metadata and tags tables (#5434) 2019-11-26 21:12:27 -05:00
Teddy Reed
19d4e3fc78
docs: Remove references to old osquery kernel extension (#6051) 2019-11-19 00:23:47 -05:00
Teddy Reed
c8cd366c03
docs: Recommend macOS 10.11 deployment target (#6000) 2019-11-15 15:20:34 -05:00
packetzero
de54b643e5 extensions compatibility : default columns to INDEX (#6006)
Recent changes in INDEX enforcement broke extensions.

This fix adds a compatibility flag that defaults to the old behavior of INDEX on all columns.
This only affects extension virtual tables, all built in tables have index constraints enforced.
2019-11-12 13:40:48 -05:00
Teddy Reed
c964db2a49
logging: Change logNumericsAsNumbers to numerics and add docs (#6002)
This is an API change for the format of logged events.
The top-level log field "logNumericsAsNumbers" was introduced to help
migrate from string-encoded numerics to JSON numbers.

This change updates the field to be "numerics", updates the flag to
conform to flag naming conventions, and documents the expectation.
2019-11-09 13:29:14 -05:00
Teddy Reed
11ae5a21b0
docs: Move the schedule_max_drift description into docs (#6003) 2019-11-06 23:34:55 -05:00
Stefano Bonicatti
021d0025a9 Suggest a shorter path to place the osquery folder on Windows (#5987) 2019-11-04 22:54:32 -05:00
Stefano Bonicatti
81af72b477 Restore specific Visual Studio generator selection in building.md (#5992)
Passing the generator is needed because one can have
multiple installations of Visual Studio and Build Tools.

Moreover the documentation is written for Visual Studio 2019 and
the subsequent arguments passed to CMake are not fully valid for
earlier versions.
2019-11-04 22:53:27 -05:00
Samuel Keeley
93d736a49a add 7 zip note 2019-11-04 20:26:17 -05:00
Alessandro Gario
7fee358178 CMake: Update the OpenSSL formula (#5976) 2019-11-01 21:25:14 -04:00
Teddy Reed
0c06658e45 logger: Expose max_lines and correct flag types (#5956)
Multiple flags are moved from FLAG to CLI_FLAG due to the way they are
implemented/used in code. If they were FLAG(s), meaning if they were
also configurable via configuration at runtime, the new values would
still be ignored.

These are:
  - logger_tls_endpoint
  - logger_tls_period
  - logger_tls_max

The flag logger_tls_max has been renamed to logger_tls_max_linesize and
an alias is added for compatibility.

A new flag is added, logger_tls_max_lines, to expose a previously
hardcoded value of 1024 for the maximum number of log lines to send
every period.
2019-10-28 10:19:50 +01:00
Teddy Reed
75c6d6545e docs: Add reference to buffered_log_max option (#5954) 2019-10-27 21:20:21 -07:00
Alessandro Gario
41fb4efba1
CMake: Migrate macOS and Windows to the OpenSSL formula (#5928) 2019-10-26 14:03:31 +02:00
Teddy Reed
c948c403b8
docs: Nitpicks to improve new-user experience (#5912) 2019-10-21 22:41:04 -04:00
Alessandro Gario
225bbaf992
Integrate cppcheck and clang-tidy within the CMake project (#5730) 2019-10-08 18:17:11 +02:00
seph
ba81289baf Documentation around process-auditing (#5852) 2019-10-04 16:47:28 +02:00
Zachary Wasserman
9a2304aa57 Update Windows build instructions (#5820)
Co-Authored-By: Stefano Bonicatti <smjert@gmail.com>
2019-09-23 17:41:11 -04:00
Teddy Reed
835ae84635
CPack: Linux package nitpicks and docs (#5822)
This fixes the license for RPMs, sets the homepage for DEBs, and sets
the package revision correctly.
2019-09-23 17:39:27 -04:00
Zachary Wasserman
33f7c6fc3f Prune Vagrant boxes and fix AWS support (#5819)
- Remove Vagrant boxes provided by individual users and not well-known organizations.
- Use osquery/aws-dummy box for AWS support.
- Fix AWS startup when used without VPC and subnet.
2019-09-21 21:02:12 -04:00
Stefano Bonicatti
1463d0a76e Add make to be installed among the other packages on Linux (#5784)
Also use --no-install-recommends to avoid installing unneeded packages.
2019-09-12 13:24:09 -04:00
Mike Myers
802e667d85 Readthedocs cleanup (#5767)
* Update HTTP links to HTTPS links, point to current URIs, update test-running steps.
* Clarify a minor missing cd step in the shell commands; minor format fixes.
* Add a note about how to isolate individual unit tests, using GTEST_FILTER.
* Drop first-person voice in docs/wiki/deployment/debugging.md.
* Document that osqueryd -S == osqueryi.
* Add new build steps for Linux using the custom toolchain.

Co-Authored-By: seph <github@directionless.org>
2019-09-08 11:59:18 -04:00
Stefano Bonicatti
0b2cd791d3 Linux custom toolchain integration (#5759)
- Always link to libc++abi.a, dl and rt.
- Add OSQUERY_TOOLCHAIN_SYSROOT option which should contain
  the path to the sysroot where the portable compiler and its libraries are in.
- Fix OpenSSL build with custom toolchain.
- Always include the custom toolchain cmake.
  Unfortunately system name detection is done when project() is called
  which is also when compiler detection is done, and we need the compiler
  to be set before that, so we always include the cmake file.
- Do not use getrandom syscall in Boost, for glibc < 2.25 support.
- Remove usage of secure_getenv and getauxval in librpm.
- Update CI to use the toolchain.
- Reflect changes in the docs.
2019-09-06 19:51:25 -04:00
Stefano Bonicatti
f6ed617394
Uniform and update CMake version to 3.14.6 (#5756)
The new version contains a fix for the FindBison module.
The docs have been updated too.
2019-09-06 22:12:13 +02:00
Mike Myers
3b584c62b1 Address issue #5681 with more complete info on extension file permissions. (#5741) 2019-09-04 08:11:45 -04:00
Mike Myers
ecd9e2340b Add note on the need for Administrator when building on Windows (#5740)
... and additional prerequisites on Ubuntu 18.10.
2019-09-03 13:56:18 -04:00
Mike Myers
c34be8e546 Correct for 3.4.0 change to install path; copy-edit; add steps for MSI packaging with CMake. 2019-08-28 12:56:38 -04:00
Teddy Reed
2e8016a038 docs: Update README to correct email and build guide 2019-08-23 00:57:21 -04:00
Mike Myers
9541378a8f Make improvements to the bulid guide. 2019-08-23 00:55:09 -04:00
Teddy Reed
a56b43eb1d
docs: Update ReadTheDocs with new build docs (#5708) 2019-08-21 21:27:00 -04:00
seph
7a96a9660e sql function regex_match (and some tests for other sql functions) (#5444) 2019-08-14 11:51:21 -04:00
seph
debf92d943
Fix link in docs (#5666)
Update the hyperlink to tables.ht in the docs.
2019-07-24 21:19:33 -07:00
Nick Anderson
214302bdeb
windows: updating more references to osquery installation path (#5580) 2019-06-05 12:45:40 -07:00
George Guliashvili
758706331f Remove unused flag enable_monitor
Summary: Removing flag which was declared but never used. enable_monitor

Reviewed By: marekcirkos

Differential Revision: D13958265

fbshipit-source-id: 3a812330950b101abdbd83ada4afd5b262cabd26
2019-02-07 08:16:00 -08:00
bransmartUK
9edcde9083 Added function examples to documentation, SQL Additions (#5305)
Summary:
This pull request is for the addition of examples under the functions in the SQL Additions sub title in the documentation. Specifically the introduction section of the documentation. The file that was changed was sql.md in the osquery/docs/wiki/introduction path. This is the addition I made:

- Added a minimalist drop down design under every subsection of new functions added. (ex. Math Functions like 'sqrt', 'log', ect.). This will allow for newcomers to the documentation to understand even deeper the new Sql added functions that the osquery team supplied, and how to use them in the actual program.

- Each added example tackles every function the osquery team listed in the documentation. Allowing for closer understanding of the functions.
Pull Request resolved: https://github.com/facebook/osquery/pull/5305

Reviewed By: guliashvili

Differential Revision: D13693267

Pulled By: fmanco

fbshipit-source-id: 9c3cd5b5950ce019f5ea5fc74f780f50a291ca71
2019-01-16 14:57:12 -08:00
ume
e72d28797d Fix config_name typo on documentation (#5243)
Summary:
* I think watchlog is a typo for watchdog.
* watchlog_level=2 is legacy configuration.
    * https://github.com/facebook/osquery/pull/2173
Pull Request resolved: https://github.com/facebook/osquery/pull/5243

Reviewed By: guliashvili

Differential Revision: D13693315

Pulled By: fmanco

fbshipit-source-id: 626545186e3950eb43226f6d3926581482d92458
2019-01-16 09:26:14 -08:00
Robbie Ostrow
6b62ce1d8b remove heroku's windmill project from remote deployment doc (#5283)
Summary:
Heroku's windmill project seems to have been removed from both Github and Heroku's site. This PR just deletes the paragraph referring to Windmill (and also deletes a space that was causing markdown to render **https://** incorrectly.)
Pull Request resolved: https://github.com/facebook/osquery/pull/5283

Differential Revision: D13625435

Pulled By: fmanco

fbshipit-source-id: 32e97f8db39d705924a6841b53f0d018e76ddb71
2019-01-11 05:56:57 -08:00
Jonathan Keljo
068efc9d67 Generate strongly-typed TableRow subclasses for each table
Summary:
Continuing to march toward low-overhead, type-safe table rows, this commit
introduces the code generation for said rows. Nothing uses it yet; see the
next commit for that.

(Adapted from https://github.com/facebook/osquery/pull/5199)

Reviewed By: guliashvili

Differential Revision: D13438017

fbshipit-source-id: 959a6e092aee38d33e1c6539cbe14b85172c0135
2019-01-09 13:50:15 -08:00
divious1
a61add8bdd splunk is moving towards preferring colons in sourcetype delimiters (#5338)
Summary:
Just a minor cosmetic change on docs, that changes the Splunk's sourcetype names to have colons instead of underscore as it is the preferred method for delimiting sourcetypes. Not sure if a test is needed for this actual docs change.
Pull Request resolved: https://github.com/facebook/osquery/pull/5338

Differential Revision: D13607572

Pulled By: fmanco

fbshipit-source-id: 95f255fb91b821b602a89c9dda3501fdba10fd1b
2019-01-09 09:47:57 -08:00
George Guliashvili
971bee4441 Move build system to BUCK
fbshipit-source-id: 8ffef5e6a393ac67ce56dcb74845402e43d964a0
2018-12-07 16:12:35 +00:00
ThorodanBrom
805d53e44a Update process-auditing.md (#5188) 2018-09-07 13:04:49 +01:00
ThorodanBrom
3229743460 Small doc fixes (#5186) 2018-09-06 19:42:11 +01:00
Mathieu Martin
c7803fdefd Fix typo. It's Comma, not Coma :-) (#5151) 2018-08-30 21:42:13 +01:00
Giorgi Guliashvili
fa98cd5cc6
get rid of aliased flag log_result_events (#4970) 2018-08-20 20:42:40 +01:00
Giorgi Guliashvili
b30af3b6f2
remove primary logger concept (#4969) 2018-08-20 20:38:26 +01:00