Nick Anderson
072e73b54d
shell: ensuring shell does not access stop event ( #3664 )
2017-09-08 13:03:31 -07:00
Teddy Reed
061dfeecb2
tests: Improve permissions tests as root ( #3665 )
2017-09-08 04:08:57 -04:00
Teddy Reed
e83c1dc4b6
packages: Fix debug info break from binary unification ( #3662 )
2017-09-08 02:23:33 -04:00
Teddy Reed
e86470c96b
[ Fix #3625 ] Use readlink and add test for listening_ports ( #3661 )
2017-09-08 02:08:27 -04:00
Seshu Pasam
6fab8b6083
logging: adding "counter" to differentiate initial results ( #3651 )
...
When setting up alerts for differential logs data you might want to skip the
initial added records. counter can be used to identify if the added records
are all records from initial query of if they are new records. For initial
query results that includes all records counter will be "0". For subsequent
query executions counter will be incremented by 1. When epoch changes, counter
will be reset back to "0".
2017-09-07 15:01:15 -07:00
Seshu Pasam
863cd72e17
AWS code refactoring. ( #3660 )
2017-09-07 09:26:17 -07:00
lxcode
2f60dd0fd3
FreeBSD: Avoid clash with rapidjson ( #3634 )
2017-09-06 17:33:03 -07:00
Nick Anderson
11acc7d64f
deps: bumping rocksdb to 5.7.1 on Windows ( #3640 )
2017-09-06 17:03:29 -07:00
Nick Anderson
093d1337c1
deps: fixing up aws-sdk-cpp choco build script ( #3648 )
2017-09-05 08:00:08 -07:00
Alessandro Gario
6489c8b050
logging: Add Firehose/Kinesis support to Windows ( #3641 )
2017-09-03 16:52:47 -07:00
Teddy Reed
16b40138fe
rocksdb: Flush all column families and set max files ( #3638 )
2017-09-02 12:08:35 -07:00
Nick Anderson
002f2cb873
deploy: Adding binary version and publisher information ( #3629 )
2017-09-02 11:22:56 -07:00
lxcode
61e9f38f57
Add Jenkins status for FreeBSD ( #3636 )
2017-09-02 11:01:28 -07:00
Teddy Reed
205da3c698
rocksdb: Implement a 'backup' and recover feature for RocksDB ( #3635 )
2017-09-01 22:31:03 -07:00
Atyansh Jaiswal
68b1de153d
tables: Adding posix curl virtual table ( #3596 )
2017-08-30 15:24:05 -07:00
Nick Anderson
2a317ce17f
worker: shutdown safely on Windows only if not worker ( #3628 )
2017-08-30 08:45:56 -07:00
Teddy Reed
ae12cf35d8
bottles: boost cmake asio cpp-netlib rocksdb and libaptpkg ( #3630 )
2017-08-30 01:25:26 -07:00
Teddy Reed
e748f38a06
deps: Finish removal of snappy and lz4 dependencies ( #3618 )
2017-08-27 17:45:15 -07:00
Mitchell Grenier
7750fa8ee5
deps: Remove snappy and lz4 ( #3545 )
2017-08-27 12:02:27 -07:00
Nick Anderson
3c782051eb
tables: adding chocolatey packages virtual table ( #3612 )
2017-08-27 11:21:04 -07:00
Teddy Reed
f29de27649
Combine osqueryi and osqueryd into single binary ( #2742 )
2017-08-27 11:09:25 -07:00
Alessandro Gario
a3e4310188
Fix 3568: Kinesis/Firehose record size check failure ( #3599 )
2017-08-27 11:01:52 -07:00
Teddy Reed
15485e3eb0
deps: Update cmake to version 3.9.1 ( #3616 )
2017-08-27 10:37:30 -07:00
Teddy Reed
e4bbf06074
codemod: Refactor query functions out of database ( #3615 )
2017-08-26 18:36:06 -07:00
Teddy Reed
af3d323841
deps: Fix rapidjson bottle root_url ( #3614 )
2017-08-26 18:22:32 -07:00
Teddy Reed
c50a9b1e82
Fix boost 1.65 build on macOS ( #3613 )
2017-08-26 17:10:25 -07:00
Teddy Reed
70fe4ab194
deps: Update boost for macOS and Linux to version 1.65 ( #3600 )
2017-08-26 16:55:31 -07:00
Nick Anderson
7d82e65cc5
docs: updating comment documentation on carver endpoints ( #3603 )
2017-08-25 12:04:01 -07:00
Nick Anderson
6445e987c1
deps: bumping boost for Windows to 1.65.0 ( #3602 )
2017-08-25 07:43:38 -07:00
Mike Myers
906104564c
Add examples of Windows registry virtual table ( #3597 )
2017-08-22 17:28:56 -07:00
Nick Anderson
f2736bd809
deploy: removing extraneous/wrong verbosity from windows deployment scripts ( #3595 )
2017-08-22 14:36:15 -07:00
Teddy Reed
501bb22de9
deps: Add rapidjson bottle for macOS ( #3591 )
2017-08-22 12:01:40 -07:00
Teddy Reed
a7330e41fc
deps: Update Linux bottles libcryptsetup libdevmapper libdpkg rapidjson ( #3590 )
2017-08-22 11:52:49 -07:00
Teddy Reed
1fadfb11d4
deploy: Change OLD_PIDFILE for systemd to be LOCAL_PIDFILE ( #3589 )
2017-08-22 10:46:25 -07:00
Teddy Reed
48ab0c783c
logger: Use a mutex to protect buffered counts ( #3588 )
2017-08-22 01:30:13 -07:00
Nick Anderson
8bb1e40d27
tables: porting the process_memory_map table to windows ( #3587 )
2017-08-21 21:47:45 -07:00
Teddy Reed
57f6e37839
audit: Handle AUDIT_SOCKADDR messages ( #3586 )
2017-08-21 20:53:32 -07:00
Teddy Reed
072aa7dad1
sql: Handle potential LIKE and GLOB optimizations by increasing comparisons ( #3580 )
2017-08-21 19:31:44 -07:00
Nick Anderson
cbed65d10e
tables: Adding list indexing to darwin plist table ( #3546 )
2017-08-21 09:29:33 -07:00
Teddy Reed
7b2f905f43
aws: Fix TSAN warning in request exception ( #3556 )
2017-08-21 01:04:58 -07:00
Teddy Reed
89f1de3a3b
leaks: Return 1 if profile detects any leaks in tables ( #3578 )
2017-08-20 21:41:33 -07:00
Teddy Reed
2e5beca2e2
deps: Add doxygen and valgrind and remove realpath requirement ( #3577 )
2017-08-20 20:14:53 -07:00
Teddy Reed
cf170c4278
cleanup: Move query out of database header ( #3576 )
2017-08-20 02:44:38 -07:00
uptycs-nishant
5a92d2c7f0
Implementing exclude paths for FIM ( #3530 )
2017-08-19 19:59:23 -07:00
Nick Anderson
5172580ac8
bug: Processes name correctly displays uid for domain users ( #3574 )
2017-08-18 21:51:39 -07:00
Nick Anderson
efcc879450
deploy: adding sanity checks to deployment powershell scripts ( #3572 )
2017-08-18 13:32:41 -07:00
Mark Ignacio
04b51fd450
add LVM and parental contexts to block_devices and disk_encryption on Linux ( #3551 )
2017-08-15 10:33:54 -07:00
Nick Anderson
22de4c7d34
Adding build script for llvm-clang package ( #3565 )
2017-08-14 20:23:36 -07:00
iBigQ
6600361230
fix c++ doc for rapidjson arguments ( #3559 )
2017-08-14 10:55:45 -07:00
Teddy Reed
2e6a0e7e2f
build: Set DEPS_DIR in the make defines ( #3557 )
2017-08-13 02:52:29 -07:00
