Teddy Reed
2d7ce9341a
Remove some non-warning/error log lines from tables
2015-07-24 00:09:06 -07:00
Teddy Reed
fc24682816
Fix profile platform bug in leaks checking
2015-07-20 02:06:52 -07:00
Teddy Reed
e8cb919f03
Merge pull request #1364 from theopolis/harden_applications
...
[Fix #1357 ] Use OS X LS API for app listing
2015-07-20 01:14:07 -07:00
Mike Arpaia
5ccfe886ba
Merge pull request #1363 from theopolis/less_rows
...
[Fix #1303 ] Only emit rows when appropriate for processes/users.
2015-07-19 20:36:26 -07:00
Teddy Reed
dd7990b719
[ Fix #1357 ] Use OS X LS API for app listing
...
Attempt to use OS X's LaunchServices to get a list of applications.
Fall back to basic directory traversal of well-known application paths.
2015-07-19 20:22:48 -07:00
Teddy Reed
5249e74146
[ Fix #1303 ] Only emit rows when appropriate for processes/users.
...
When optimizing a table using query constraints an implementation should not add unneeded rows.
A user experience bug exists when selecting with an explicit non-existing pid/uid.
2015-07-19 20:20:04 -07:00
Teddy Reed
bcdbb40f0c
[ Fix #1356 ] Tokenize process environ by '\0' on Linux
2015-07-19 14:34:49 -07:00
Teddy Reed
6104aaebfe
Add optional TLS config plugin refresh
2015-07-17 14:59:08 -07:00
Teddy Reed
c36fbda274
Merge pull request #1349 from theopolis/centos_version
...
[Fix #1319 ] CentOS version reporting and file read error
2015-07-17 09:07:29 -07:00
Teddy Reed
f06820f578
[ Fix #1319 ] CentOS version reporting and file read error
...
1. Redhat-based distributions were not reporting their version correct.
2. The file read API assumed stat would return an accurate file size.
This has been replaced with an attempt to seek to the end of the file.
2015-07-16 14:16:51 -07:00
Mike Arpaia
9eeb224ce7
clang-format authorizations files
2015-07-16 11:09:16 -07:00
Tom Burgin
e8d3e45cea
Added authorization_mechanisms and authorizations tables
2015-07-15 14:25:19 -04:00
Teddy Reed
c269bbeaf3
Rollup of build changes
2015-07-14 13:45:53 -07:00
Michael O'Farrell
276891ad00
Merge pull request #1330 from mofarrell/kernel
...
Kernel!!!
2015-07-13 17:29:08 -07:00
Michael O'Farrell
58ec6415d3
Created a basic publisher system for kernel events in the kernel extension.
2015-07-13 16:42:55 -07:00
Teddy Reed
3bd6b64b8b
Silence OS X OpenSSL-related deprecations
2015-07-13 10:14:47 -07:00
Teddy Reed
1d336ccdb0
Merge pull request #1321 from sharvilshah/cert_parsing_fixes
...
[Fix #1032 ] Better/faster performance when querying certificates on OS X
2015-07-13 09:02:44 -07:00
Sharvil Shah
1ac6702f32
Better/faster performance when querying certificates on OS X
...
X509 parsing is now handled by OpenSSL as there does seem to be a
memory leak in SecCertificateCopyValues of Security framework which resulted
in a performance hit when querying certificates.
key_usage and key_algorithm columns now display human readable strings
(e.g. Digital Signature, CRL Sign rsaEncryption)
than the raw flags and OIDs (e.g 0x86, 1.2.840.1).
This fixes #1032
2015-07-12 11:18:53 -07:00
Teddy Reed
d3424f5831
Fix getifaddrs checking
2015-07-08 22:37:35 -07:00
Michael O'Farrell
4bbb591b37
Added kernel process events table.
2015-07-08 13:47:07 -07:00
Michael O'Farrell
ba28b47239
Merge pull request #1298 from theopolis/event_streams
...
Event index time and streaming
2015-07-07 18:27:35 -07:00
Teddy Reed
ab56011881
Apply FIM pattern matching to inotify
2015-07-07 18:18:45 -07:00
Teddy Reed
0854c3ddc3
Merge pull request #1292 from theopolis/memory_tweaks
...
Some tweaks to estimated scratch/heap for SQLite and RocksDB
2015-07-07 08:11:30 -07:00
Teddy Reed
f48619ed28
[ #1285 , #1276 ] Faster, optimized subscriber results
2015-07-07 00:59:28 -07:00
Teddy Reed
41002b829c
Merge pull request #1299 from timzimmermann/date
...
Add date information to time table
2015-07-07 00:46:32 -07:00
Tim Zimmermann
0c3b123cb1
Add date information to time table
...
The fix also includes the time in ISO 8601 format
as well as the format returned by C++'s asctime().
See #1297 .
2015-07-07 00:00:50 -07:00
Mike Arpaia
4f94c0034c
Merge pull request #1290 from timzimmermann/uptime
...
Uptime
2015-07-03 00:23:44 -07:00
Tim Zimmermann
fa988b4e56
Add uptime table
...
The table contains information about the time passed since the last boot.
2015-07-02 22:32:48 -07:00
Michael O'Farrell
a712cd5036
Fix processes table to report gid correctly.
2015-07-02 17:03:25 -07:00
Teddy Reed
7aac5fd358
Replace custom wildcarding with POSIX-glob
...
POSIX-globbing will allow event publishers/subscribers to post-check
results against glob-syntax, fnpath matching, and POSIX C-regex.
These checks are anecdotally speedy.
2015-07-02 13:53:16 -07:00
Teddy Reed
a8813ab7d8
Some tweaks to estimated scratch/heap for SQLite and RocksDB
2015-07-02 13:52:39 -07:00
Teddy Reed
0d6ab16281
Yara events was not building
2015-06-29 14:45:31 -07:00
Teddy Reed
6437ddb82d
Merge pull request #1235 from sharvilshah/remove_os_x_10_9_code
...
Remove OS X 10.9 code path
2015-06-24 15:18:32 -07:00
Mike Arpaia
7d5cb221dd
Merge pull request #1239 from marpaia/1237-segfault
...
Check for nullptr in CreatePropertyFromCertificate
2015-06-24 08:25:25 -07:00
Mike Arpaia
d6389dc64d
Check for nullptr in CreatePropertyFromCertificate
2015-06-23 21:45:46 -07:00
Sharvil Shah
05bbe2ce06
Remove OS X 10.9 code path since we no longer support it
2015-06-22 20:49:34 -07:00
Teddy Reed
040d9d5fd1
Merge pull request #1216 from sharvilshah/osx_mount_events
...
[Implement #1103 ] DMG Mount Events
2015-06-22 12:38:32 -07:00
Sharvil Shah
f676ba7642
Implements disk_events and the related publisher and subscriber.
...
We now have a Publisher to report on disk events and its metadata,
using the DiskArbitration framework on OS X. Currently disk appearance
and disappearance events are published for both physical and
virtual disks (DMG files). On an event trigger, disk properties are
parsed and that metadata is reported along with the action.
The Subscriber subscribes to virtual disk events currently.
This closes #1103 .
2015-06-22 11:09:18 -07:00
Teddy Reed
37188f788b
Fixups in tables, add DOUBLE, shell extensions
2015-06-22 04:17:23 -04:00
Teddy Reed
55f270ff97
OS X application duti/scheme listing table
2015-06-21 14:08:21 -04:00
Mike Arpaia
be85046d32
typo in keychain_acls table where path was being returned as app_path
2015-06-21 13:52:01 -04:00
Mike Arpaia
0a83572f08
Table to enumerate keychain ACLs
2015-06-20 14:59:07 -04:00
Teddy Reed
09ea12a2a7
Add application sandbox container metadata
2015-06-19 01:53:09 -04:00
Teddy Reed
e7ab2fc47b
Limit scope of git/tag version defines.
...
Harden plist parsing against internal fuzzing tests.
Improve file/stream read speeds.
2015-06-12 10:10:20 -07:00
Teddy Reed
b56e9efd47
Merge pull request #1199 from theopolis/fix_open_sockets
...
Process open sockets on Linux needs '['
2015-06-07 14:04:45 -07:00
Teddy Reed
49eb22ef44
Process open sockets on Linux was added '['
2015-06-07 13:28:17 -07:00
Teddy Reed
727f5b091f
Various table perf improvements and TLS docs
2015-06-05 22:03:15 -07:00
Mike Arpaia
ea70781f25
Merge pull request #1188 from marpaia/msr_format
...
Formatting the callback function in the model_specific_register table
2015-06-04 12:17:19 -07:00
Teddy Reed
a70828c2a4
Merge pull request #1187 from sharvilshah/xattr_update
...
Extended Attributes: Use LaunchServices API for quarantine data
2015-06-03 22:38:17 -07:00
Sharvil Shah
065fe6412d
Use LaunchServices (part of CoreServices) to grab quarantine properties instead of manually parsing the colon separated attribute data.
...
Fall back to deprecated LaunchService API for OS X 10.9 Mavericks.
Added tests for extended_attributes
Better error handling and cleanup
2015-06-03 22:18:45 -07:00
