valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 01:55:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
5,647 Commits 2 Branches 109 Tags 25 MiB
60361d9fb9
Commit Graph

5647 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Mike Myers
60361d9fb9 Copy-edit and Markdown lint the Windows install steps; quote-escape a path 2020-09-25 16:22:43 -04:00
Mike Myers
8561aed0da Copy-edit and Markdown lint the CLI flags, and Linux/macOS install steps 2020-09-25 16:22:43 -04:00
Gregory G. Tseng
aabc63649a
Add more AWS regions (#6666) 2020-09-25 16:09:58 -04:00
Nabil Schear
49a02f7000
Add timeout and a timeout column to curl_certificate (#6641) 2020-09-23 10:55:22 -04:00
Mike Myers
eb98636760 Copy-edit and Markdown lint the osqueryi intro 2020-09-23 10:43:25 -04:00
Mike Myers
184114e300 Copy-edit and Markdown lint the osqueryd intro 2020-09-23 10:43:25 -04:00
Mike Myers
f3e57fe118 Markdown lint the CHANGELOG 2020-09-23 10:43:25 -04:00
Mike Myers
cf5a3aeb20 Copy-edit and Markdown lint the SQL intro 2020-09-23 10:43:25 -04:00
Mike Myers
fbdfa87484 Grammar nits and URL fix in wiki Index 2020-09-23 10:43:25 -04:00
Mike Myers
fa95abe83a Normalize format style of Changelog 2020-09-23 10:43:25 -04:00
Teddy Reed
689a571785
carver: Improve tests by faking postCarve (#6659) 2020-09-22 08:52:58 -04:00
Teddy Reed
18319be84c
carver: Emit an error if the carve function is disabled (#6658) 2020-09-21 19:30:04 -04:00
Teddy Reed
d75e6cda72
carver: Update carves specs to allow full scan (#6657) 2020-09-21 19:29:44 -04:00
Teddy Reed
775830270e
carver: Update table to use JSON (#6656) 2020-09-21 19:29:19 -04:00
Teddy Reed
5b8f20bfce
refactor: Move ephemeral database plugin into core and simplify tests (#6648) 2020-09-21 18:25:08 -04:00
Teddy Reed
0ed8b1b581
Fix image column within drivers table on Windows (#6652) 2020-09-18 22:12:58 -04:00
Teddy Reed
6a34c9527e
tests: Improve flaky python test handling (#6654) 2020-09-18 22:12:21 -04:00
seph
d0465b1af3
Add atom_packages table to windows (#6649) 2020-09-18 16:06:01 -04:00
Teddy Reed
f4555ac0d1
Improve performance and accuracy of Windows registry querying (#6647) 2020-09-14 11:59:47 -04:00
Teddy Reed
71524093f2
systemd: Limit osqueryd CPU usage to 20% (#6644) 2020-09-14 11:59:28 -04:00
Steve Brito
62d9a0c1fa
Fix BIOS Info table searching (#5246) 2020-09-13 10:53:07 -04:00
Teddy Reed
87f6832cdc
tests: Restore test_osqueryi (#6631) 2020-09-13 10:52:24 -04:00
puffyCid
bd545631ed
Support for Office MRU (most recently used) entries (#6587) 2020-09-13 10:51:51 -04:00
Teddy Reed
5c71654dcf
Add 4.5.0 CHANGELOG (#6646) 2020-09-12 19:17:50 -04:00
kumarak
69bcf70b8c
Add sigurl column to pass yara signatures with the queries (#6607) 2020-09-11 15:14:01 -04:00
Gavin
5f48f93517
Update process auditing docs schema link (#6645) 2020-09-11 15:12:48 -04:00
puffyCid
10b0635bc2
Support for Background Activity Moderator (#6585) 2020-09-10 22:20:34 -04:00
Teddy Reed
d7d6c56473
database: Remove read only concept (#6637) 2020-09-10 19:58:38 -04:00
kumarak
51d3833508
Parsing of user data in Windows event log (#6643) 2020-09-10 19:57:53 -04:00
Teddy Reed
c32953e139
events: Remove selectAllFrom from linux process events callback (#6638) 2020-09-08 16:16:22 -04:00
Teddy Reed
4f9ab34581
libs: Set glog and gflags includes as SYSTEM (#6635) 2020-09-08 16:15:44 -04:00
Teddy Reed
aae2b809ad
tests: Fix flaky test_2_daemon_with_option (#6634) 2020-09-07 08:40:08 -04:00
Teddy Reed
3759430a87
tests: Improve the reliability of TLSServerRunner (#6632) 2020-09-07 08:38:55 -04:00
Teddy Reed
26b53c5b48
database: Move initialization retry logic into DB API (#6633) 2020-09-07 08:38:14 -04:00
Artemis Tosini
ea70cde29d libs/smartmontools: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
7eabe51bae libs/lzma: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Alessandro Gario <alessandro.gario@gmail.com>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
4ea5db73a6 libs/lldpd: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
41f58c1e3d libs/librdkafka: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Co-Authored-By: Alessandro Gario <alessandro.gario@gmail.com>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
028810ed05 libs/libgpg-error: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
96000c74a0 libs/libgcrypt: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
79eed8b059 libs/libdpkg: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
89ca3f9b09 libs/libaudit: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
5b84482b6f libs/boost: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
a417b0845f libs/berkeley-db: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
48926e1d07 libs/aws-sdk-cpp: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
51a123fa2f libs/openssl: Add aarch64 support 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
a5492c55da Make cpuid table x86_only 
The instruction doesn't exist on other processors, and while there
might be ways to retrieve the equivalent information, none directly
matches the x86 "cpuid". This takes out the table completely on
non-x86_64 architectures.

Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
e324f5bc0e linux: Define __NR_perf_event_open for aarch64 
Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
d12b7931f5 linux: Conditionally build x86_64-only syscalls 
Some syscalls are deprecated on newer architectures, for example
fork and vfork are all variants of clone now; symlink, unlink, rename
etc... at variants of the *at() versions, dup2 of dup3, etc...

Note about the test events: Because the events are synthetic, we
only really test the parser, as such it doesn't matter if aarch64
doesn't use a snapshot of a real event. To keep things simple we
only replace the arch and syscall fields.

Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00
Artemis Tosini
7af153bd1b cmake: Use TARGET_PROCESSOR to set Linux .tgz name suffix 
Instead of hard-wiring "x86_64"

Co-Authored-By: Benjamin Herrenschmidt <benh@kernel.crashing.org>
 2020-09-05 16:50:28 -04:00