Teddy Reed
e7ab2fc47b
Limit scope of git/tag version defines.
...
Harden plist parsing against internal fuzzing tests.
Improve file/stream read speeds.
2015-06-12 10:10:20 -07:00
Teddy Reed
8aacaca7eb
Query pack platform binds should match any/all
2015-06-03 13:56:39 -07:00
Teddy Reed
a105924804
Move specs to a top-level path, add query examples
...
1. Example queries will run with an (optional) integration test.
2. Fix bad accesses with OS X package BOMs
3. Move spec files from ./osquery/tables/specs to ./specs
4. Remove server parsers (netlib) from client builds.
2015-06-03 10:39:05 -07:00
Javier Marcos
2b834a401a
Fixing problem with extensions test, utility tables were added to core
2015-05-21 14:10:20 -07:00
Javier Marcos
886ad6e928
Added table for the packs and check for already scheduled queries
2015-05-21 13:42:45 -07:00
Javier Marcos
c6855fab43
Table for osquery packs
2015-05-19 18:44:28 -07:00
Mike Arpaia
fff36af0af
Removing trailing whitespace
2015-05-11 23:31:13 -07:00
Teddy Reed
893f678403
Linting and asan fixups
2015-05-04 11:00:21 -07:00
Teddy Reed
e01a73b4f3
Schedule monitoring, doc updates, logger plugin fixes
2015-05-03 11:54:15 -07:00
mike@arpaia.co
7eb4402a78
VLOG instead of WARNING
2015-04-24 08:55:36 -07:00
mike@arpaia.co
dedee94441
Changing the column wildcard to pattern
2015-04-24 08:54:18 -07:00
Mike Arpaia
3db60378f4
[ Fix #1013 ] wildcard support in file table
...
Now you can run a query like:
```
[localhost] linux (file_wildcard) * ./osquery/osqueryi
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
osquery - being built, with love, at Facebook
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Connected to a transient in-memory database.
osquery> select path from file where wildcard = "/home/%/git/osquery/%";
+--------------------------------------------+
| path |
+--------------------------------------------+
| /home/marpaia/git/osquery/.clang-format |
| /home/marpaia/git/osquery/osquery.thrift |
| /home/marpaia/git/osquery/PATENTS |
| /home/marpaia/git/osquery/README.md |
| /home/marpaia/git/osquery/Vagrantfile |
| /home/marpaia/git/osquery/CONTRIBUTING.md |
| /home/marpaia/git/osquery/mkdocs.yml |
| /home/marpaia/git/osquery/Doxyfile |
| /home/marpaia/git/osquery/.gitmodules |
| /home/marpaia/git/osquery/requirements.txt |
| /home/marpaia/git/osquery/Makefile |
| /home/marpaia/git/osquery/LICENSE |
| /home/marpaia/git/osquery/.gitignore |
| /home/marpaia/git/osquery/CMakeLists.txt |
+--------------------------------------------+
```
2015-04-23 23:39:32 -07:00
Javier Marcos
3c86ecd31c
Changing name to osquery_schedule
2015-04-16 15:26:20 -07:00
Javier Marcos
6f2afd7be8
Adding osquery_scheduled table
2015-04-16 14:48:21 -07:00
Javier Marcos
4763d2a5ff
Removing commented ifdef
2015-04-15 20:46:06 -07:00
Javier Marcos
7a2716b4b6
Adding distro and version to osquery_info
2015-04-15 16:34:12 -07:00
Teddy Reed
692c1b1751
Add package_receipts/package_bom OS X tables
2015-03-27 23:12:09 -07:00
Don Husa
f6b5c5a2e3
Cleaned Up Time Table
2015-03-05 16:57:44 -08:00
Teddy Reed
0673900837
Registry modules
2015-03-04 20:33:10 -08:00
Teddy Reed
99beceaef6
Switch lazy=active concept for registry setup
2015-03-04 18:51:41 -08:00
Mitchell Grenier
d5e8fe61d2
Removed the checks
2015-03-04 11:27:11 -08:00
Teddy Reed
9031bad609
Extensions helpers, API additions
...
Use --socket for extensions, limit help
Add an 'active' concept to registries, support a blank item call
Add osquery_registry to list the internal/external plugin details
2015-02-25 01:02:05 -07:00
Teddy Reed
6f155d63c5
Improve flag storage and printing
2015-02-16 16:26:06 -08:00
Teddy Reed
3c36c4196b
Merge pull request #731 from jedi22/wildcard_events
...
Added parsing of extra data along with its addition to the osqueryconfig structure
2015-02-15 19:16:54 -08:00
Mitchell Grenier
54ef2045e5
Made config a meyers singleton. Load should now only ever have to happen once
2015-02-13 12:32:54 -08:00
Teddy Reed
b7734dcd3e
Allow file table to use a directory constraint
2015-02-12 15:44:39 -08:00
Teddy Reed
a59dcf01ee
Add osquery_extensions table
2015-02-11 10:52:25 -08:00
Teddy Reed
2593e8f837
Add extensions status to osquery_info
2015-02-11 10:52:25 -08:00
Teddy Reed
55dfdfcace
Move lsperms into filesystem
2015-02-10 03:00:29 -07:00
Teddy Reed
ff0da3dd19
Add stat details to file table
2015-02-08 20:41:31 -07:00
Teddy Reed
bd620853aa
Verbose log when table row is missing a column
2015-02-01 02:20:09 -07:00
Teddy Reed
9c1faec090
Isolate glog include and depend on libglog for #652
2015-01-21 13:37:06 -08:00
Teddy Reed
64d82388e4
Update the md5 hashing callsites
2015-01-20 14:52:07 -08:00
Teddy Reed
a2d9236478
Use API macro for hash algorithms
2015-01-20 14:24:49 -08:00
Mitchell Grenier
e6e722dd17
Modifed config.cpp to not use the old MD5 implementation
2015-01-15 17:40:42 -08:00
Mitchell Grenier
570c6a32f3
Moved hashing functions into core. #include<osquery/hash.h>
2015-01-15 17:16:05 -08:00
Mitchell Grenier
c13a0e79a5
Most hashing stuff working though rerun bug is still plaguing the queries
2015-01-15 15:06:30 -08:00
Theodore M. Reed
01005c72b3
Moved crontab out of utility
2014-12-23 14:39:59 -08:00
mike@arpaia.co
b9f732c31f
Updating the license comment to be the correct open source header
...
As per t5494224, all of the license headers in osquery needed to be updated
to reflect the correct open source header style.
2014-12-18 10:52:55 -08:00
Teddy Reed
d5c5253bbc
Add osquery_flags vtable
2014-12-16 02:07:50 -08:00
Teddy Reed
b5535256e6
[ Fix #546 ] Rename md5 to config_md5 and add config_path to osquery_info
2014-12-16 01:52:02 -08:00
mike@arpaia.co
8f8bc6b772
osquery_info table
2014-12-10 18:38:41 -08:00
Teddy Reed
7c738c8497
Codemod to improve include search paths
2014-12-03 15:14:02 -08:00
Teddy Reed
d885bf420d
Port manual/filesystem to file using constraints
2014-12-02 12:37:26 -08:00
Teddy Reed
e33443d354
clang-format on feature-predicate updates
2014-11-29 22:36:07 -08:00
Teddy Reed
b4be08a702
Updating table generators to use QueryContext
2014-11-29 22:36:05 -08:00
Teddy Reed
cd8413d483
Organizing affinity types into tables.
2014-11-29 22:36:05 -08:00
Teddy Reed
2b1cd4eee3
Towards predicate constraint checking
2014-11-29 22:36:05 -08:00
Teddy Reed
bc9a5ed3b4
Move expected errors to info log
2014-11-19 09:03:58 -08:00
Wesley Shields
c764226b77
Use INTEGER macro.
...
This makes the code match the example at:
https://github.com/facebook/osquery/wiki/creating-a-new-table
2014-11-17 13:30:46 -05:00
