Skip to content

Commit f0dc2f4

Browse files
patrykkopycinskipatrykkopycinski
authored
[Osquery] Add kibana/osquery-pack-asset (#299)
* [Osquery] Add osquery_pack_asset to kibana assets * add changelog
1 parent 20cb225 commit f0dc2f4

File tree

3 files changed

+147
-0
lines changed

3 files changed

+147
-0
lines changed

‎test/packages/good/kibana/osquery_pack_asset/good-osquery-pack-asset-1.json‎

Lines changed: 135 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,135 @@
1+
{
2+
"attributes": {
3+
"name": "vuln-management",
4+
"version": 1,
5+
"queries": [
6+
{
7+
"id": "kernel_info",
8+
"interval": 86400,
9+
"query": "select * from kernel_info;",
10+
"version": "1.4.5"
11+
},
12+
{
13+
"id": "os_version",
14+
"interval": 86400,
15+
"query": "select * from os_version;",
16+
"version": "1.4.5"
17+
},
18+
{
19+
"id": "kextstat",
20+
"interval": 86400,
21+
"platform": "darwin",
22+
"query": "select * from kernel_extensions;",
23+
"version": "1.4.5"
24+
},
25+
{
26+
"id": "kernel_modules",
27+
"interval": 86400,
28+
"platform": "linux",
29+
"query": "select * from kernel_modules;",
30+
"version": "1.4.5"
31+
},
32+
{
33+
"id": "installed_applications",
34+
"interval": 86400,
35+
"platform": "darwin",
36+
"query": "select * from apps;",
37+
"version": "1.4.5"
38+
},
39+
{
40+
"id": "browser_plugins",
41+
"interval": 86400,
42+
"platform": "darwin",
43+
"query": "select browser_plugins.* from users join browser_plugins using (uid);",
44+
"version": "1.6.1"
45+
},
46+
{
47+
"id": "safari_extensions",
48+
"interval": 86400,
49+
"platform": "darwin",
50+
"query": "select safari_extensions.* from users join safari_extensions using (uid);",
51+
"version": "1.6.1"
52+
},
53+
{
54+
"id": "opera_extensions",
55+
"interval": 86400,
56+
"platform": "darwin,linux",
57+
"query": "select opera_extensions.* from users join opera_extensions using (uid);",
58+
"version": "1.6.1"
59+
},
60+
{
61+
"id": "chrome_extensions",
62+
"interval": 86400,
63+
"query": "select chrome_extensions.* from users join chrome_extensions using (uid);",
64+
"version": "1.6.1"
65+
},
66+
{
67+
"id": "firefox_addons",
68+
"interval": 86400,
69+
"platform": "darwin,linux",
70+
"query": "select firefox_addons.* from users join firefox_addons using (uid);",
71+
"version": "1.6.1"
72+
},
73+
{
74+
"id": "homebrew_packages",
75+
"interval": 86400,
76+
"platform": "darwin",
77+
"query": "select * from homebrew_packages;",
78+
"version": "1.4.5"
79+
},
80+
{
81+
"id": "package_receipts",
82+
"interval": 86400,
83+
"platform": "darwin",
84+
"query": "select * from package_receipts;",
85+
"version": "1.4.5"
86+
},
87+
{
88+
"id": "deb_packages",
89+
"interval": 86400,
90+
"platform": "linux",
91+
"query": "select * from deb_packages;",
92+
"version": "1.4.5"
93+
},
94+
{
95+
"id": "apt_sources",
96+
"interval": 86400,
97+
"platform": "linux",
98+
"query": "select * from apt_sources;",
99+
"version": "1.4.5"
100+
},
101+
{
102+
"id": "portage_packages",
103+
"interval": 86400,
104+
"platform": "linux",
105+
"query": "select * from portage_packages;",
106+
"version": "2.0.0"
107+
},
108+
{
109+
"id": "rpm_packages",
110+
"interval": 86400,
111+
"platform": "linux",
112+
"query": "select * from rpm_packages;",
113+
"version": "1.4.5"
114+
},
115+
{
116+
"id": "unauthenticated_sparkle_feeds",
117+
"interval": 86400,
118+
"platform": "darwin",
119+
"query": "select feeds.*, p2.value as sparkle_version from (select a.name as app_name, a.path as app_path, a.bundle_identifier as bundle_id, p.value as feed_url from (select name, path, bundle_identifier from apps) a, plist p where p.path = a.path || '/Contents/Info.plist' and p.key = 'SUFeedURL' and feed_url like 'http://%') feeds left outer join plist p2 on p2.path = app_path || '/Contents/Frameworks/Sparkle.framework/Resources/Info.plist' where (p2.key = 'CFBundleShortVersionString' OR coalesce(p2.key, '') = '');",
120+
"version": "1.4.5"
121+
},
122+
{
123+
"id": "backdoored_python_packages",
124+
"interval": 86400,
125+
"platform": "darwin,linux",
126+
"query": "select name as package_name, version as package_version, path as package_path from python_packages where package_name = 'acqusition' or package_name = 'apidev-coop' or package_name = 'bzip' or package_name = 'crypt' or package_name = 'django-server' or package_name = 'pwd' or package_name = 'setup-tools' or package_name = 'telnet' or package_name = 'urlib3' or package_name = 'urllib';",
127+
"version": "1.4.5"
128+
}
129+
]
130+
},
131+
"coreMigrationVersion": "8.2.0",
132+
"id": "good-osquery-pack-asset-1",
133+
"references": [],
134+
"type": "osquery-pack-asset"
135+
}

‎versions/1/changelog.yml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77
- description: Prepare for next version
88
type: enhancement
99
link: https://github.com/elastic/package-spec/pull/295
10+
- description: Add kibana/osquery-pack-asset
11+
type: enhancement
12+
link: https://github.com/elastic/package-spec/pull/299
1013
- version: 1.6.0
1114
changes:
1215
- description: Validate required fields

‎versions/1/kibana/spec.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -101,3 +101,12 @@
101101
type: file
102102
contentMediaType: "application/json"
103103
pattern: '^{PACKAGE_NAME}-.+\.json$'
104+
- description: Folder containing Osquery pack assets
105+
type: folder
106+
name: osquery_pack_asset
107+
required: false
108+
contents:
109+
- description: An osquery pack asset file
110+
type: file
111+
contentMediaType: "application/json"
112+
pattern: '^{PACKAGE_NAME}-.+\.json$'

0 commit comments

Comments
 (0)