Thanks to visit codestin.com
Credit goes to github.com

Skip to content

[Osquery] Add default saved queries #2998

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 19 commits into from
May 16, 2022
Merged

[Osquery] Add default saved queries #2998

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
c4c34a7
[Osquery] Add default saved queries
tomsonpl Apr 5, 2022
f44ddcb
[Osquery] Remove redundant saved query
tomsonpl Apr 5, 2022
3f8efec
add version: 1 to all saved queries
tomsonpl Apr 6, 2022
7fafdd5
format saved queries
tomsonpl Apr 6, 2022
036c8c2
update kibana version
tomsonpl Apr 6, 2022
39fdee7
Change version from integer to string
tomsonpl Apr 19, 2022
3d807c8
remove one saved query for test purposes
tomsonpl Apr 19, 2022
10c4119
Revert "remove one saved query for test purposes"
tomsonpl Apr 19, 2022
2920492
add osquery_manager- prefix to os id
tomsonpl Apr 19, 2022
ef85c8e
change indentation
tomsonpl Apr 19, 2022
a46b2ec
update changelog
tomsonpl Apr 19, 2022
61b40f4
Merge branch 'main' into osquery-add-saved-queries
tomsonpl May 4, 2022
c9bea3b
add ecs mappings to queries
tomsonpl May 4, 2022
d905af3
Merge remote-tracking branch 'origin/osquery-add-saved-queries' into …
tomsonpl May 4, 2022
7e16789
Change osquery saved queries, and fix typo in Compliance
tomsonpl May 10, 2022
fb66343
fix formatting
tomsonpl May 10, 2022
e75f3e1
remove newline at the end
tomsonpl May 10, 2022
354f36f
change lower case to upper case
tomsonpl May 10, 2022
39229b4
remove restricted ecs mappings
tomsonpl May 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
fix formatting
  • Loading branch information
@tomsonpl
tomsonpl committed May 10, 2022
commit fb66343e8b8725721700ff319f031dc5f2b7819b
110 changes: 55 additions & 55 deletions ...ager/kibana/osquery_saved_query/osquery_manager-0796f890-b4a9-11ec-8f39-bf9c07530bbb.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,57 +1,57 @@
{
"attributes": {
"created_at": "2022-04-05T06:24:21.145Z",
"created_by": "elastic",
"description": "Get all current network connections.",
"ecs_mapping": [
{
"key": "process.id",
"value": {
"field": "pid"
}
},
{
"key": "client.port",
"value": {
"field": "port"
}
},
{
"key": "network.iana_number",
"value": {
"field": "protocol"
}
},
{
"key": "network.type",
"value": {
"field": "family"
}
},
{
"key": "client.address",
"value": {
"field": "address"
}
},
{
"key": "process.path",
"value": {
"field": "path"
}
}
],
"id": "listening_ports",
"interval": "3600",
"query": "select * from listening_ports;",
"updated_at": "2022-04-05T06:24:21.145Z",
"updated_by": "elastic",
"version": "1"
},
"coreMigrationVersion": "8.3.0",
"id": "osquery_manager-0796f890-b4a9-11ec-8f39-bf9c07530bbb",
"references": [],
"type": "osquery-saved-query",
"updated_at": "2022-04-05T06:24:21.147Z",
"version": "Wzc0OSwxXQ=="
"attributes": {
"created_at": "2022-04-05T06:24:21.145Z",
"created_by": "elastic",
"description": "Get all current network connections.",
"ecs_mapping": [
{
"key": "process.id",
"value": {
"field": "pid"
}
},
{
"key": "client.port",
"value": {
"field": "port"
}
},
{
"key": "network.iana_number",
"value": {
"field": "protocol"
}
},
{
"key": "network.type",
"value": {
"field": "family"
}
},
{
"key": "client.address",
"value": {
"field": "address"
}
},
{
"key": "process.path",
"value": {
"field": "path"
}
}
],
"id": "listening_ports",
"interval": "3600",
"query": "select * from listening_ports;",
"updated_at": "2022-04-05T06:24:21.145Z",
"updated_by": "elastic",
"version": "1"
},
"coreMigrationVersion": "8.3.0",
"id": "osquery_manager-0796f890-b4a9-11ec-8f39-bf9c07530bbb",
"references": [],
"type": "osquery-saved-query",
"updated_at": "2022-04-05T06:24:21.147Z",
"version": "Wzc0OSwxXQ=="
}
136 changes: 68 additions & 68 deletions ...ager/kibana/osquery_saved_query/osquery_manager-128b90b0-b4a6-11ec-8f39-bf9c07530bbb.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,70 +1,70 @@
{
"attributes": {
"created_at": "2022-04-05T06:03:11.035Z",
"created_by": "elastic",
"description": "Recursively get info about all files within the specified path. Edit the path to narrow down the search.",
"ecs_mapping": [
{
"key": "file.directory",
"value": {
"field": "directory"
}
},
{
"key": "file.name",
"value": {
"field": "filename"
}
},
{
"key": "file.inode",
"value": {
"field": "inode"
}
},
{
"key": "file.uid",
"value": {
"field": "uid"
}
},
{
"key": "file.gid",
"value": {
"field": "gid"
}
},
{
"key": "file.mode",
"value": {
"field": "mode"
}
},
{
"key": "file.size",
"value": {
"field": "size"
}
},
{
"key": "file.type",
"value": {
"field": "type"
}
}
],
"id": "file_info",
"interval": "3600",
"platform": "windows",
"query": "SELECT * FROM file WHERE path LIKE \"/%%\"",
"updated_at": "2022-04-05T06:03:11.035Z",
"updated_by": "elastic",
"version": "1"
},
"coreMigrationVersion": "8.3.0",
"id": "osquery_manager-128b90b0-b4a6-11ec-8f39-bf9c07530bbb",
"references": [],
"type": "osquery-saved-query",
"updated_at": "2022-04-05T06:03:11.036Z",
"version": "WzczNiwxXQ=="
"attributes": {
"created_at": "2022-04-05T06:03:11.035Z",
"created_by": "elastic",
"description": "Recursively get info about all files within the specified path. Edit the path to narrow down the search.",
"ecs_mapping": [
{
"key": "file.directory",
"value": {
"field": "directory"
}
},
{
"key": "file.name",
"value": {
"field": "filename"
}
},
{
"key": "file.inode",
"value": {
"field": "inode"
}
},
{
"key": "file.uid",
"value": {
"field": "uid"
}
},
{
"key": "file.gid",
"value": {
"field": "gid"
}
},
{
"key": "file.mode",
"value": {
"field": "mode"
}
},
{
"key": "file.size",
"value": {
"field": "size"
}
},
{
"key": "file.type",
"value": {
"field": "type"
}
}
],
"id": "file_info",
"interval": "3600",
"platform": "windows",
"query": "SELECT * FROM file WHERE path LIKE \"/%%\"",
"updated_at": "2022-04-05T06:03:11.035Z",
"updated_by": "elastic",
"version": "1"
},
"coreMigrationVersion": "8.3.0",
"id": "osquery_manager-128b90b0-b4a6-11ec-8f39-bf9c07530bbb",
"references": [],
"type": "osquery-saved-query",
"updated_at": "2022-04-05T06:03:11.036Z",
"version": "WzczNiwxXQ=="
}
64 changes: 32 additions & 32 deletions ...ager/kibana/osquery_saved_query/osquery_manager-239dce60-b4a9-11ec-8f39-bf9c07530bbb.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,34 +1,34 @@
{
"attributes": {
"created_at": "2022-04-05T06:25:08.166Z",
"created_by": "elastic",
"description": "Get applications and executables configured to launch when a system reboots on Windows.",
"ecs_mapping": [
{
"key": "file.path",
"value": {
"field": "path"
}
},
{
"key": "file.name",
"value": {
"field": "name"
}
}
],
"id": "persisted_apps_executables_windows",
"interval": "3600",
"platform": "windows",
"query": "select * from autoexec, startup_items;",
"updated_at": "2022-04-05T06:25:08.166Z",
"updated_by": "elastic",
"version": "1"
},
"coreMigrationVersion": "8.3.0",
"id": "osquery_manager-239dce60-b4a9-11ec-8f39-bf9c07530bbb",
"references": [],
"type": "osquery-saved-query",
"updated_at": "2022-04-05T06:25:08.167Z",
"version": "Wzc1MCwxXQ=="
"attributes": {
"created_at": "2022-04-05T06:25:08.166Z",
"created_by": "elastic",
"description": "Get applications and executables configured to launch when a system reboots on Windows.",
"ecs_mapping": [
{
"key": "file.path",
"value": {
"field": "path"
}
},
{
"key": "file.name",
"value": {
"field": "name"
}
}
],
"id": "persisted_apps_executables_windows",
"interval": "3600",
"platform": "windows",
"query": "select * from autoexec, startup_items;",
"updated_at": "2022-04-05T06:25:08.166Z",
"updated_by": "elastic",
"version": "1"
},
"coreMigrationVersion": "8.3.0",
"id": "osquery_manager-239dce60-b4a9-11ec-8f39-bf9c07530bbb",
"references": [],
"type": "osquery-saved-query",
"updated_at": "2022-04-05T06:25:08.167Z",
"version": "Wzc1MCwxXQ=="
}
Loading