Teddy Reed
8213e7dcbc
[events] Improve inotify
2014-10-06 14:37:44 -07:00
Teddy Reed
37352f862a
[events] Formatting from name changes
2014-10-04 13:29:17 -07:00
Teddy Reed
2063252f73
[vtable] Fix warning for process in-condition assignment
2014-10-04 13:29:17 -07:00
mike@arpaia.co
99f5052d15
cleaning up deploy materials
2014-10-03 22:34:59 -07:00
Teddy Reed
b5352729af
Merge pull request #198 from facebook/inotify_tests
...
[events] Stabilize INotify event tests
2014-10-03 17:59:20 -07:00
Teddy Reed
5e6be33767
Merge pull request #199 from facebook/unify_processes
...
[vtable] Parity with OSX/Linux processes table
2014-10-03 17:30:47 -07:00
Teddy Reed
a36117670b
Revert "disabling inotify_tests"
2014-10-03 17:02:00 -07:00
Teddy Reed
25aee56af9
[events] Stabilize INotify event tests
2014-10-03 17:01:32 -07:00
Teddy Reed
69607c7b32
[vtable] Parity with OSX/Linux processes table
2014-10-03 16:24:11 -07:00
mike@arpaia.co
96986773b3
disabling inotify_tests
2014-10-03 14:21:50 -07:00
mike@arpaia.co
660ef01777
iostream in shell
2014-10-03 13:48:31 -07:00
mike@arpaia.co
c118e7a1f8
iostream
2014-10-03 13:48:31 -07:00
Mike Arpaia
1d062bb038
Merge pull request #185 from facebook/ubuntu12_precise_build_support
...
Adding support to build in Ubuntu 12
2014-10-03 12:57:25 -07:00
Teddy Reed
b37785e665
Merge pull request #195 from facebook/events_pubsub
...
Events pubsub
2014-10-03 11:50:37 -07:00
Teddy Reed
c553a59745
[events] Use pub/sub diction for events
2014-10-03 11:30:51 -07:00
Teddy Reed
1e36b494b4
[events] Rename MonitorContext to SubscriptionContext
2014-10-03 08:26:41 -07:00
Teddy Reed
b2474b49eb
[events] Renamed EventType to EventPublisher
2014-10-03 08:14:36 -07:00
Teddy Reed
e77ae22fe2
[events] Rename EventModule to EventSubscriber
2014-10-03 08:08:06 -07:00
Teddy Reed
368ab483a7
Merge pull request #184 from facebook/fsevents
...
[events] Fleshing out OSX FSEvent framework
2014-10-03 07:54:17 -07:00
Teddy Reed
69bfb92905
[events] Fleshing out OSX FSEvent framework
2014-10-02 21:30:14 -07:00
mike@arpaia.co
d1e2ee1241
glog logger plugin
2014-10-02 19:44:45 -07:00
Javier Marcos
7f5d1eee8c
Fixes broken build in Mac OSX
2014-10-02 16:30:29 -07:00
Javier Marcos
06b35c45f0
Adding support to build in Ubuntu 12
2014-10-02 16:30:29 -07:00
mike@arpaia.co
569545648d
lz4
2014-10-02 14:51:18 -07:00
mike@arpaia.co
2348460ca4
Revert "Support for Ubuntu 12, precise"
...
This reverts commit ed0e051eba
2014-10-01 23:00:23 -07:00
Javier Marcos
ed0e051eba
Support for Ubuntu 12, precise
2014-10-02 01:24:23 +00:00
mike@arpaia.co
764619c849
Adding a function to read tomcat configs from disk
2014-09-30 19:59:52 -07:00
Mike Arpaia
3fb8c8a5d4
Merge pull request #183 from facebook/tomcat-users
...
Adding a function to parse the Tomcat users XML file
2014-09-30 19:51:54 -07:00
mike@arpaia.co
196ec880ab
Adding a function to parse the Tomcat users XML file
...
This is apart of a bigger, better virtual table idea that @carnal0wnage
had.
2014-09-30 19:49:38 -07:00
Teddy Reed
bf8209ca90
Merge pull request #182 from facebook/events_docs
...
[events] Added remaining doxy comments
2014-09-30 15:00:08 -07:00
Teddy Reed
ef044c4a72
[events] Added remaining doxy comments
2014-09-30 12:50:14 -07:00
Teddy Reed
6eb9c5fd44
EventFactory, Dispatcher as singletons
2014-09-29 20:47:24 -07:00
Teddy Reed
588f1198f3
Merge pull request #174 from facebook/passwd_changes_vtable
...
[events] Events lifecycle complete, passwd_changes vtable
2014-09-26 21:13:52 -07:00
Teddy Reed
ed338e8356
[events] Events lifecycle complete, passwd_changes vtable
2014-09-26 12:58:32 -07:00
mike@arpaia.co
0c783ebf0a
Migrating internal usage of osquery::query to osquery::SQL
2014-09-26 00:34:56 -07:00
mike@arpaia.co
7076aa813c
SQL class for executing queries
...
implements #141
2014-09-26 00:28:18 -07:00
mike@arpaia.co
636ced854f
Pretty shell results
...
Example:
```
osquery> select name, program || program_arguments as executable from launchd limit 5;
+----------------------------------+-------------------------------------------------------------------------------+
| name | executable |
+----------------------------------+-------------------------------------------------------------------------------+
| bootps.plist | /usr/libexec/bootpd |
| com.apple.afpfs_afpLoad.plist | /System/Library/Filesystems/AppleShare/afpLoad |
| com.apple.afpfs_checkafp.plist | /System/Library/Filesystems/AppleShare/check_afp.app/Contents/MacOS/check_afp |
| com.apple.AirPlayXPCHelper.plist | /usr/libexec/AirPlayXPCHelper |
| com.apple.airport.wps.plist | /usr/libexec/wps |
+----------------------------------+-------------------------------------------------------------------------------+
osquery> .tables
=> alf
=> alf_exceptions
=> alf_explicit_auths
=> alf_services
=> apps
=> ca_certs
=> etc_hosts
=> interface_addresses
=> interface_details
=> kextstat
=> last
=> launchd
=> listening_ports
=> nvram
=> osx_version
=> processes
=> routes
=> time
```
2014-09-25 21:39:07 -07:00
Abe Stanway
663e6756d7
Add libboost_regex.a
2014-09-25 19:18:47 +00:00
mike@arpaia.co
0387fde8b8
Adding permissions check around setting default log directory #130
2014-09-25 10:26:39 -07:00
Mike Arpaia
e1fa406096
Merge pull request #165 from facebook/travis
...
travis
2014-09-24 18:06:32 -07:00
mike@arpaia.co
135dd0dbe4
TravisCI configuration
2014-09-24 18:05:33 -07:00
Teddy Reed
8aaecefec0
Merge branch 'master' of github.com:facebook/osquery into events_updates
2014-09-24 13:55:42 -07:00
Teddy Reed
9220da7e3d
[events] Registry integration
2014-09-24 12:43:14 -07:00
mike@arpaia.co
5f4108c503
Moving all boost smart pointers to std smart pointers
2014-09-24 10:54:59 -07:00
Teddy Reed
9a2d299424
[events] Events and registry coordination
2014-09-24 10:46:37 -07:00
mike@arpaia.co
d7546de036
Relocatable build
...
Making it such that osquery doesn't need to be built in the repo "build"
subdirectory. gentable.py now accepts a positional argument which
indicates the output (which is calculated by cmake) so they don't have
to agree on a destination ahead of time.
2014-09-24 01:58:12 -07:00
mike@arpaia.co
466df023ef
makefile cleanups
2014-09-23 22:06:32 -07:00
mike@arpaia.co
91efb3963f
moving packages subdir to deploy
2014-09-23 21:37:55 -07:00
mike@arpaia.co
cc9aa5d73b
clang-format
2014-09-23 20:31:12 -07:00
mike@arpaia.co
6b25a216c9
periodic clang-format
2014-09-23 20:15:41 -07:00
