Teddy Reed
ee015343f9
Simplify arp, move to arp_table
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
4f524abbea
arp vtable different implementation in osx and linux
2014-11-16 19:49:40 -08:00
Pablo S. Torralba
1843d80660
arp vtable with ip, arp and interface where it was seen
2014-11-16 19:49:40 -08:00
Li-Wen Hsu
e49537c8fa
Add libraries and settings for FreeBSD
2014-11-16 01:41:50 +08:00
Abe Stanway
322fde0121
Socket_inode and port_inode tables to map PIDs->ports via netlink inet_diag
...
Example query:
```
SELECT port.local_port,
port.remote_port,
port.local_ip,
port.remote_ip,
socket.pid,
process.name,
process.cmdline
process.path
FROM socket_inode AS socket
JOIN port_inode AS port
ON socket.inode = port.inode
INNER JOIN processes AS process
ON socket.pid = process.pid;
```
2014-11-10 15:02:31 -05:00
Zachary Wasserman
0b30b9f692
Add basic Mac startup items vtable
2014-11-04 11:40:54 -08:00
Alexander Polakov
274e037527
Blockdev table for linux
2014-11-03 23:39:14 +03:00
Akshay Dixit
6c418507e6
renamed lspci to pci_devices and specified it linux only
2014-11-02 21:09:04 -07:00
Akshay Dixit
afd9d5e160
changed lspci to be a linux only virtual table, and added udev dependency to provisions.sh
2014-11-02 21:07:35 -07:00
Akshay Dixit
7896e7f78e
added lspci virtual table and libudev dependencies
2014-11-02 21:03:43 -07:00
Alexander Polyakov
58716d6cfa
Mounts table for linux
2014-11-01 16:12:56 +03:00
Teddy Reed
eb240ac527
RPM table and more robust Linux building
2014-10-31 21:59:10 -07:00
castrapel
2557bac3d4
RPM Package listing is now working
2014-10-31 16:52:58 -07:00
Pablo S. Torralba
a6e04efdd7
Add quarantine vtable for OSX
...
The tables reports:
- path: The file in quarantine
- creator: The application that created the file
Example:
osquery> select * from quarantine limit 10;
+----------------------------------------------------------------------------+---------------+
| path | creator |
+----------------------------------------------------------------------------+---------------+
| /Applications/Adium.app | Google Chrome |
| /Applications/Adium.app/Contents | Google Chrome |
| /Applications/Adium.app/Contents/_CodeSignature | Google Chrome |
| /Applications/Adium.app/Contents/_CodeSignature/CodeResources | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Adium | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Headers | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/PrivateHeaders | Google Chrome |
| /Applications/Adium.app/Contents/Frameworks/Adium.framework/Resources | Google Chrome |
+----------------------------------------------------------------------------+---------------+
Fixes issue #231
2014-10-31 06:10:51 -07:00
Teddy Reed
39f866387f
[vtables] CPUID asm call feature information
2014-10-29 03:09:34 -07:00
Teddy Reed
1f1b38976a
Merge pull request #261 from facebook/crontab
...
[vtables] Crontab parsing for system/users
2014-10-29 02:52:11 -07:00
Teddy Reed
6db0c67555
Merge pull request #269 from vmauge/suidbin
...
Add suid_bin vtable
2014-10-29 02:30:29 -07:00
Vincent Mauge
471d5faaa0
Add suid_bin vtable
...
The vtabel report :
- path: full path of the file
- unix_user: name of the owner (if not available display the uid)
- unix_group: name of the groupe (if not available display the gid)
- permissions: report suid or guid
* S for suid bin
* G for guid bin
Example :
osquery> select * from suid_bin;
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
| path | unix_user | unix_group | permissions |
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
| "/bin/ps" | root | wheel | S |
| "/bin/rcp" | root | wheel | S |
| "/Users/vmauge/suid_test" | vmauge | 999 | SG |
| "/usr/bin/at" | root | wheel | S |
| "/usr/bin/atq" | root | wheel | S |
| "/usr/bin/atrm" | root | wheel | S |
| "/usr/bin/batch" | root | wheel | S |
| "/usr/bin/crontab" | root | wheel | S |
| "/usr/bin/ipcs" | root | wheel | S |
| "/usr/bin/lockfile" | root | mail | G |
| "/usr/bin/login" | root | wheel | S |
| "/usr/bin/newgrp" | root | wheel | S |
| "/usr/bin/procmail" | root | mail | G |
| "/usr/bin/quota" | root | wheel | S |
| "/usr/bin/rlogin" | root | wheel | S |
| "/usr/bin/rsh" | root | wheel | S |
| "/usr/bin/su" | root | wheel | S |
| "/usr/bin/sudo" | root | wheel | S |
| "/usr/bin/top" | root | wheel | S |
| "/usr/bin/wall" | root | tty | G |
| "/usr/bin/write" | root | tty | G |
| "/usr/sbin/postdrop" | root | _postdrop | G |
| "/usr/sbin/postqueue" | root | _postdrop | G |
| "/usr/sbin/rpc.net" | root | wheel | S |
| "/usr/sbin/rpcset" | root | wheel | S |
| "/usr/sbin/traceroute" | root | wheel | S |
| "/usr/sbin/traceroute6" | root | wheel | S |
+----------------------------------------------------------------------------------------------------+-----------+---------------+-------------+
This commit fixes issue #253 .
2014-10-29 01:33:58 -07:00
Teddy Reed
339b63677e
[vtables] Rename homebrew files, some cleanup
2014-10-29 00:34:55 -07:00
Martin Majlis
d645dfc257
Initial implementation for the homebrew table.
2014-10-28 21:03:56 -07:00
Martin Majlis
8b8ec7c644
Added initial implementation for crontab.
2014-10-28 17:52:03 -07:00
Javier Marcos
1066f667ab
Adding virtual table bash_history, for linux and darwin
2014-10-22 15:21:05 -07:00
Javier Marcos
06792db7f0
Adding support for last in linux
2014-10-13 18:19:08 -07:00
Javier Marcos
b518c6b9e0
Adding groups vtable and refactoring users
2014-10-10 15:09:14 -07:00
mike@arpaia.co
f45798d31a
OMG memory leaks
2014-10-09 18:08:31 -07:00
Javier Marcos
64ce35c949
Virtual table to be build in both linux and mac
2014-10-09 15:27:18 -07:00
Javier Marcos
7944ab50da
Adding vtable for users
2014-10-09 12:50:34 -07:00
Teddy Reed
69bfb92905
[events] Fleshing out OSX FSEvent framework
2014-10-02 21:30:14 -07:00
Teddy Reed
ed338e8356
[events] Events lifecycle complete, passwd_changes vtable
2014-09-26 12:58:32 -07:00
mike@arpaia.co
6beb5d1247
Moving table generation to CMake
...
CMake now handles building all of the generated code.
2014-09-23 17:55:54 -07:00
mike@arpaia.co
4218a4c2ab
cmake cleanups
2014-09-22 21:23:16 -07:00
mike@arpaia.co
9e2507409c
linking tests against libosquery
2014-09-22 19:54:59 -07:00
Mike Arpaia
db0f0105dd
Revert "Skip tests when making 'fast'"
2014-09-09 21:37:08 -07:00
Teddy Reed
2e150ef8a9
Skip tests when making 'fast'
2014-09-09 16:25:22 -07:00
Teddy Reed
825b50f932
[vtables] Routes table for Linux
2014-09-09 16:07:36 -07:00
Teddy Reed
bfba3d491d
Merge pull request #117 from facebook/linux-processes-vtable
...
[vtables] Processes table for Linux (procps3)
2014-09-09 14:43:26 -07:00
Mike Arpaia
d6699bd0fe
Adding header files to CMakeLists.txt so that other build tools can perform better introspection into the codebase.
2014-09-09 10:53:59 -07:00
Teddy Reed
c6a7e86b18
[vtables] Processes table for Linux (procps3)
2014-09-08 22:42:17 -07:00
mike@arpaia.co
c72d069689
vagrant and make deps on linux
2014-09-08 19:24:23 -07:00
Teddy Reed
7e470747b4
Moving sublibs to single libosquery
2014-09-08 01:58:29 -07:00
Teddy Reed
e23e7bdab8
Merge pull request #102 from facebook/linux-build
...
Changes for Linux (Ubuntu 14.04) build
2014-09-05 14:52:35 -07:00
Teddy Reed
4ffd184eaf
Changes for Linux (Ubuntu 14.04) build
2014-09-05 10:58:58 -07:00
Javier Marcos
344ca31f26
Adding last virtual table
2014-09-04 16:42:18 -07:00
mike@arpaia.co
63070a0d49
migrating project to use CMake's CTest to run unit tests
2014-09-02 11:14:21 -07:00
mike@arpaia.co
6498f45924
renaming the cacerts table to ca_certs
2014-09-01 18:46:16 -07:00
mike@arpaia.co
8649951fab
minimum possible linkages
2014-08-30 14:29:45 -07:00
mike@arpaia.co
f174c4dbd0
enabling unit tests for tables
2014-08-30 14:26:24 -07:00
mike@arpaia.co
2e5810ae9a
proper ordering in tables/CMakeLists.txt
2014-08-30 04:28:49 -07:00
mike@arpaia.co
b1f86466e0
alphabetizing the order of sources in the tables cmake file
2014-08-30 03:46:08 -07:00
mike@arpaia.co
5b904cca26
moving the table_sources blob down to just above where it's used
2014-08-30 03:43:02 -07:00
mike@arpaia.co
dd909ed39d
breaking out the implementation of os x specific virtual tables into their own cmake library
2014-08-30 03:24:35 -07:00
mike@arpaia.co
3b05ffb97d
breaking out objective-c tables such that they use arc
2014-08-30 03:19:16 -07:00
mike@arpaia.co
92845146d7
re-adding all of the virtual tables that depended on performant objective-c interop
2014-08-30 03:09:04 -07:00
mike@arpaia.co
0e806eff83
Proper ARC in Objective-C++ code
2014-08-30 00:22:26 -07:00
Teddy Reed
f461605b94
[vtable_interfaces] Add interface_{details, addresses} vtables
2014-08-21 18:49:15 -07:00
mike@arpaia.co
807a3617c2
Removing example table
2014-08-19 21:49:42 -07:00
Teddy Reed
42d7f982e9
[vtable_routes] Added vtable for various network routes
2014-08-19 21:39:16 -07:00
Teddy Reed
95ceb21ec5
[vtable_listening_ports] Listening sockets, IPv4, IPv6
2014-08-19 15:25:16 -07:00
Teddy Reed
444cea0649
[vtable_cacerts] New CA certificates table.
2014-08-19 13:47:09 -07:00
mike@arpaia.co
3760e4cce5
Apple virtual table for LaunchAgents and LaunchDaemons
2014-08-15 13:46:09 -07:00
mike@arpaia.co
9973335e49
OS X virtual tables for currently installed applications
2014-08-15 12:58:19 -07:00
Mike Arpaia
3161e8cfeb
Merge pull request #48 from facebook/firewall
...
Virtual table for Apple's application level firewall
2014-08-14 11:33:53 -07:00
mike@arpaia.co
1a381e0feb
Virtual tables for Apple's application level firewall
2014-08-14 11:33:20 -07:00
mike@arpaia.co
2311022e7f
moving cocoa backports to core/osx
2014-08-13 23:20:58 -07:00
Mike Arpaia
5f9a24202f
Merge pull request #42 from facebook/kexts
...
Loaded kernel extensions vtable
2014-08-13 11:49:48 -07:00
mike@arpaia.co
e2bd07008d
[kextstat] osquery virtual table which uses the Core Foundation APIs to
...
expose kernel extension information.
For information about memory managament in Core Foudnation, see:
https://developer.apple.com/library/ios/documentation/CoreFoundation/Conceptual/CFMemoryMgmt/Concepts/Ownership.html#//apple_ref/doc/uid/20001148-103029
2014-08-13 11:48:53 -07:00
mike@arpaia.co
b65f96d666
osx_version table which exposes the major, minor and patch version of
...
the operating system
2014-08-13 11:02:17 -07:00
Teddy Reed
1888150596
[vtable_nvram] Added NVRAM variables vtable (name, variable type, value).
2014-08-12 00:02:38 -07:00
mike@arpaia.co
9a9ae03506
renaming CMakeLists.txt
2014-08-10 02:07:15 -07:00
