Commit Graph

26 Commits

Author SHA1 Message Date
Mike Arpaia
664c1e1ed3 Merge pull request #1346 from javuto/populating_table_fields
Adding column description to all the missing table fields
2015-07-15 23:37:05 -07:00
Javier Marcos
25f0de07a5 Adding description to all the missing table fields 2015-07-15 23:23:42 -07:00
Tom Burgin
e8d3e45cea Added authorization_mechanisms and authorizations tables 2015-07-15 14:25:19 -04:00
Michael O'Farrell
4bbb591b37 Added kernel process events table. 2015-07-08 13:47:07 -07:00
Michael O'Farrell
ba28b47239 Merge pull request #1298 from theopolis/event_streams
Event index time and streaming
2015-07-07 18:27:35 -07:00
Teddy Reed
f48619ed28 [#1285, #1276] Faster, optimized subscriber results 2015-07-07 00:59:28 -07:00
Teddy Reed
41002b829c Merge pull request #1299 from timzimmermann/date
Add date information to time table
2015-07-07 00:46:32 -07:00
Tim Zimmermann
0c3b123cb1 Add date information to time table
The fix also includes the time in ISO 8601 format
as well as the format returned by C++'s asctime().
See #1297.
2015-07-07 00:00:50 -07:00
Mike Arpaia
4f94c0034c Merge pull request #1290 from timzimmermann/uptime
Uptime
2015-07-03 00:23:44 -07:00
Tim Zimmermann
fa988b4e56 Add uptime table
The table contains information about the time passed since the last boot.
2015-07-02 22:32:48 -07:00
Teddy Reed
0d6ab16281 Yara events was not building 2015-06-29 14:45:31 -07:00
Teddy Reed
040d9d5fd1 Merge pull request #1216 from sharvilshah/osx_mount_events
[Implement #1103] DMG Mount Events
2015-06-22 12:38:32 -07:00
Sharvil Shah
f676ba7642 Implements disk_events and the related publisher and subscriber.
We now have a Publisher to report on disk events and its metadata,
using the DiskArbitration framework on OS X. Currently disk appearance
and disappearance events are published for both physical and
virtual disks (DMG files). On an event trigger, disk properties are
parsed and that metadata is reported along with the action.

The Subscriber subscribes to virtual disk events currently.

This closes #1103.
2015-06-22 11:09:18 -07:00
Mike Arpaia
9d783fee00 adding an example to the keychain_acls spec 2015-06-22 09:38:24 -07:00
Mike Arpaia
53c407781f Merge pull request #1224 from theopolis/duti_table
OS X application duti/scheme listing table
2015-06-22 09:33:06 -07:00
Teddy Reed
37188f788b Fixups in tables, add DOUBLE, shell extensions 2015-06-22 04:17:23 -04:00
Mike Arpaia
1cd0adaaeb fixing the type in the keychain_acls table for real 2015-06-21 23:34:53 -07:00
Teddy Reed
55f270ff97 OS X application duti/scheme listing table 2015-06-21 14:08:21 -04:00
Mike Arpaia
0a83572f08 Table to enumerate keychain ACLs 2015-06-20 14:59:07 -04:00
Teddy Reed
09ea12a2a7 Add application sandbox container metadata 2015-06-19 01:53:09 -04:00
Teddy Reed
b56e9efd47 Merge pull request #1199 from theopolis/fix_open_sockets
Process open sockets on Linux needs '['
2015-06-07 14:04:45 -07:00
Teddy Reed
49eb22ef44 Process open sockets on Linux was added '[' 2015-06-07 13:28:17 -07:00
Teddy Reed
727f5b091f Various table perf improvements and TLS docs 2015-06-05 22:03:15 -07:00
Mike Arpaia
388bfda4e6 Renaming model_specific_register to msr 2015-06-03 23:39:49 -07:00
Michael O'Farrell
5e9383a16b Created a table for information in the model specific register.
This infomation is primarily related to the performance of processor
cores.  The information given constitutes only a small portion of
the information in the model specific register, but this table
has been designed so that more information may easily be added.
The table requires osquery be run as the root, and that the msr
kernel module is loaded.  The table reads the msr data from /dev
2015-06-03 15:55:57 -07:00
Teddy Reed
a105924804 Move specs to a top-level path, add query examples
1. Example queries will run with an (optional) integration test.
2. Fix bad accesses with OS X package BOMs
3. Move spec files from ./osquery/tables/specs to ./specs
4. Remove server parsers (netlib) from client builds.
2015-06-03 10:39:05 -07:00