Teddy Reed
b57040db60
Add osquery_events table to track pubsub stats
2015-09-03 15:10:53 -07:00
Teddy Reed
2813d3ab87
Add a Linux audit event publisher
2015-09-03 08:45:02 -07:00
Teddy Reed
bb2b5f594b
Static analysis cleanups, static libmagic
2015-09-02 16:55:20 -07:00
Teddy Reed
cd1d39b323
Merge pull request #1407 from theopolis/tls_customization
...
Add 'hidden' flags to customize TLS plugins
2015-08-28 17:21:49 -07:00
Javier Marcos
74be3d1da0
Removing dots at the end of log entries
2015-08-28 16:50:44 -07:00
Teddy Reed
0e16f56c8d
Add 'hidden' flags to customize TLS plugins
2015-08-28 12:57:53 -07:00
Teddy Reed
5bf30a779d
RocksDB usage speedups
2015-08-15 20:43:53 -07:00
Michael O'Farrell
5d0e4be6a1
Merge pull request #1335 from mofarrell/kernel-file-events
...
Added kernel file access events.
2015-07-31 15:22:11 -07:00
Michael O'Farrell
9f2b318778
Added kernel file access events.
2015-07-31 15:06:46 -07:00
Michael O'Farrell
b0289adcf5
Merge pull request #1414 from theopolis/env_limits
...
Add optional environment variable whitelist to process_events
2015-07-30 18:17:31 -07:00
Teddy Reed
dc82ffa636
Add optional environment variable whitelist to process_events
2015-07-30 16:05:11 -07:00
Michael O'Farrell
8c8c591195
Merge pull request #1404 from mofarrell/load-kernel
...
Added loading of kernel.
2015-07-30 15:20:33 -07:00
Michael O'Farrell
eaf7de08df
Added loading of kernel.
2015-07-30 14:36:46 -07:00
Michael O'Farrell
346743e87f
Benchmark using mean across 5 runs.
2015-07-29 16:50:19 -07:00
Teddy Reed
fa36a8918b
Merge pull request #1401 from theopolis/tests_and_benchmarks
...
Various additional tests and benchmarks
2015-07-28 13:20:46 -07:00
Teddy Reed
ff9cb71628
Various additional tests and benchmarks
2015-07-28 12:26:17 -07:00
Michael O'Farrell
93a65eaf04
Merge pull request #1400 from mofarrell/process-events-env-arg
...
Adding environment variables and arguments for process events.
2015-07-27 17:54:06 -07:00
Michael O'Farrell
3f87d5832f
Adding environment variables and arguments for process events.
2015-07-27 15:48:47 -07:00
Teddy Reed
d2effc539c
[ Fix #1374 ] Allow subscription subclassing
2015-07-26 01:48:27 -07:00
Teddy Reed
928f46c00f
Merge pull request #1379 from theopolis/fix_1369
...
[Fix #1369 ] Limit IOKit HID events
2015-07-23 18:26:04 -07:00
Michael O'Farrell
66b075a685
Merge pull request #1377 from mofarrell/benchmark
...
Added benchmarking targets.
2015-07-23 17:37:56 -07:00
Michael O'Farrell
a65f8dd93c
Added benchmarking targets.
2015-07-23 17:07:42 -07:00
Teddy Reed
7c330f0bf8
[ Fix #1369 ] Limit IOKit HID events
2015-07-23 11:52:23 -07:00
Teddy Reed
8eaf389010
Optimize event publisher database namespace lookups.
...
Previously, event publishers used a canonicalized 'type' name for async callbacks.
This type was used to lookup the publisher plugin in the registry as well as for backing store namespacing.
The type is still used but subscribers, which made heavy used of the lookup, store the value locally.
This prevents unneeded publisher plugin allocation when adding events.
2015-07-19 17:10:42 -07:00
Teddy Reed
6104aaebfe
Add optional TLS config plugin refresh
2015-07-17 14:59:08 -07:00
Teddy Reed
270b4da540
[ Fix #1339 ] Add kernel-build to packages when used
2015-07-16 15:23:29 -07:00
Michael O'Farrell
019defc788
Kernel publisher only log info when not connected. [ Fix #1334 ]
2015-07-14 20:10:50 -07:00
Michael O'Farrell
58ec6415d3
Created a basic publisher system for kernel events in the kernel extension.
2015-07-13 16:42:55 -07:00
Michael O'Farrell
4bbb591b37
Added kernel process events table.
2015-07-08 13:47:07 -07:00
Michael O'Farrell
0284b9e60d
Merge branch 'master' into kernel
...
Conflicts:
mkdocs.yml
2015-07-08 10:26:32 -07:00
Teddy Reed
ab56011881
Apply FIM pattern matching to inotify
2015-07-07 18:18:45 -07:00
Teddy Reed
f48619ed28
[ #1285 , #1276 ] Faster, optimized subscriber results
2015-07-07 00:59:28 -07:00
Teddy Reed
d2685cfa41
[ #1142 ] Move path resolution into publisher logic
2015-07-07 00:45:55 -07:00
Teddy Reed
bf65e3d2d6
Event index time and streaming
2015-07-07 00:44:57 -07:00
Teddy Reed
546aaa885d
[ Fix #1063 ] Allow configure-time symlink resolution in FSEvents
2015-07-02 16:50:27 -07:00
Teddy Reed
7aac5fd358
Replace custom wildcarding with POSIX-glob
...
POSIX-globbing will allow event publishers/subscribers to post-check
results against glob-syntax, fnpath matching, and POSIX C-regex.
These checks are anecdotally speedy.
2015-07-02 13:53:16 -07:00
Michael O'Farrell
a00fb638c2
Added kernel event publisher.
2015-07-01 17:40:42 -07:00
Michael O'Farrell
1ab7040d83
Kernel extension fixes for daemon shutdown process.
2015-06-30 18:00:25 -07:00
Michael O'Farrell
680ffd3bc8
Added a gangsta test (gtest) for the kernel communications.
...
This test does not evaluate the functionality of the kernel
communication unless the KERNEL_TEST flag was set during the build.
The test will not succeed unless the tests are being run as root.
2015-06-29 12:12:54 -07:00
Michael O'Farrell
f4e05b992a
Merge branch 'master' into kernel
...
Conflicts:
mkdocs.yml
2015-06-26 17:04:42 -07:00
Michael O'Farrell
89fb4fbaf0
Moved kernel userland code into the osquery directory structure.
...
Test cpp files are dead.
2015-06-25 12:38:39 -07:00
Sharvil Shah
f676ba7642
Implements disk_events and the related publisher and subscriber.
...
We now have a Publisher to report on disk events and its metadata,
using the DiskArbitration framework on OS X. Currently disk appearance
and disappearance events are published for both physical and
virtual disks (DMG files). On an event trigger, disk properties are
parsed and that metadata is reported along with the action.
The Subscriber subscribes to virtual disk events currently.
This closes #1103 .
2015-06-22 11:09:18 -07:00
Teddy Reed
4c80891010
Fix FSEvents multiplexing actions
2015-06-05 17:36:29 -07:00
Teddy Reed
8b3686a58a
TLS plugin workflow tests
2015-05-26 19:55:00 -07:00
Teddy Reed
2a1f496cc5
Towards TLS config/logging
2015-05-19 17:05:55 -07:00
Mike Arpaia
fff36af0af
Removing trailing whitespace
2015-05-11 23:31:13 -07:00
Teddy Reed
ee872d3fbe
Harden events tests
2015-05-06 20:33:39 -07:00
Teddy Reed
d0bbb0bc4f
Towards safer and shuffled unittests
2015-04-29 14:43:27 -07:00
Teddy Reed
be65922569
Fast tests
2015-04-27 09:40:31 -07:00
Teddy Reed
16447e67d6
[ Fix #1040 ] Check for disabled event subs
2015-04-26 12:15:49 -07:00
