зеркало из https://github.com/mozilla/fleet.git
111 строки
2.6 KiB
YAML
111 строки
2.6 KiB
YAML
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: osquery_version
|
|
description: The version of the Launcher and Osquery process
|
|
query: select launcher.version, osquery.version from kolide_launcher_info launcher, osquery_info osquery;
|
|
support:
|
|
launcher: 0.3.0
|
|
osquery: 2.9.0
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: osquery_schedule
|
|
description: Report performance stats for each file in the query schedule.
|
|
query: select name, interval, executions, output_size, wall_time, (user_time/executions) as avg_user_time, (system_time/executions) as avg_system_time, average_memory, last_executed from osquery_schedule;
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: osquery_info
|
|
description: A heartbeat counter that reports general performance (CPU, memory) and version.
|
|
query: select i.*, p.resident_size, p.user_time, p.system_time, time.minutes as counter from osquery_info i, processes p, time where p.pid = i.pid;
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: osquery_events
|
|
description: Report event publisher health and track event counters.
|
|
query: select name, publisher, type, subscriptions, events, active from osquery_events;
|
|
apiVersion: v1
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: docker_processes
|
|
descriptions: The docker containers processes that are running on a system.
|
|
query: select * from docker_container_processes;
|
|
support:
|
|
osquery: 2.9.0
|
|
platforms:
|
|
- linux
|
|
- darwin
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: hostname
|
|
query: select hostname from system_info;
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: uuid
|
|
query: select uuid from osquery_info;
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: instance_id
|
|
query: select instance_id from system_info;
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: always_true
|
|
query: select 1;
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: pending_updates
|
|
query: SELECT value from plist where path = "/Library/Preferences/ManagedInstalls.plist" and key = "PendingUpdateCount" and value > "0";
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: slack_not_running
|
|
query: >
|
|
SELECT * from system_info
|
|
WHERE NOT EXISTS (
|
|
SELECT *
|
|
FROM processes
|
|
WHERE name LIKE "%Slack%"
|
|
);
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: centos_hosts
|
|
query: select 1 from os_version where platform = "centos";
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: ubuntu_hosts
|
|
query: select 1 from os_version where platform = "ubuntu";
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: windows_hosts
|
|
query: select 1 from os_version where platform = "windows";
|
|
---
|
|
apiVersion: v1
|
|
kind: query
|
|
spec:
|
|
name: darwin_hosts
|
|
query: select 1 from os_version where platform = "darwin";
|