seph
02/28/2023, 8:34 PMseph
03/02/2023, 12:08 AMJanRC
03/02/2023, 3:36 PMwkleinhenz
03/13/2023, 3:48 PMseph
03/15/2023, 4:42 AM"diffResults": {
"removed": [],
"added": []
},
seph
03/15/2023, 4:46 AM"queries": {
"file_events_linux": {
"query": "SELECT * FROM file_events;",
"removed": true,
"version": "",
"interval": 300,
"platform": "linux",
"description": ""
}
seph
03/15/2023, 1:49 PMseph
03/22/2023, 11:59 AMseph
03/23/2023, 2:34 PMseph
03/28/2023, 5:19 PMseph
03/28/2023, 6:09 PMvictor_bui
03/29/2023, 6:47 AMvictor_bui
03/29/2023, 6:48 AMJanRC
03/31/2023, 11:12 AMvictor_bui
04/04/2023, 7:35 AMvictor_bui
04/04/2023, 7:35 AMzwass
04/06/2023, 4:54 PMseph
04/11/2023, 12:58 AMJames Pickett
04/11/2023, 5:06 PMwindows_search
that uses the windows search API, similar to the darwin mdfind table. I'm considering adding in support for specifying the item attribute names in the search. Since the attributes can be dynamic I would need to use and EAV style table so it might look something like this:
osquery> SELECT * FROM windows_search WHERE attributes = 'system.itempathdisplay,system.size' AND query = 'scope=''file:C:\Users\james\Pictures\Screenshots''';
+---------+------------------------+-------------------------------------------+-------------------------------------------------+
| entity | attribute | value | query |
+--------+------------------------+-------------------------------------------+--------------------------------------------------+
| 0 | system.itempathdisplay | C:\Users\james\Pictures\Screenshots\0.png | scope='file:C:\Users\james\Pictures\Screenshots' |
| 0 | system.size | 100000000 | scope='file:C:\Users\james\Pictures\Screenshots' |
| 1 | system.itempathdisplay | C:\Users\james\Pictures\Screenshots\1.png | scope='file:C:\Users\james\Pictures\Screenshots' |
| 1 | system.size | 100000000 | scope='file:C:\Users\james\Pictures\Screenshots' |
+--------+------------------------+-------------------------------------------+--------------------------------------------------+
what do yall think?Stefano Bonicatti
04/11/2023, 5:49 PMseph
04/12/2023, 12:32 PMzwass
04/12/2023, 4:14 PMthor
04/21/2023, 3:37 PMzwass
05/01/2023, 4:39 PMjson
table in core osquery. We already have a plist
table (https://osquery.io/schema/5.8.2/#plist) that I think has a similar level of privacy concern to what a json
table would have. Thoughts?JanRC
05/04/2023, 1:48 PMthor
05/12/2023, 4:07 AMthor
05/12/2023, 4:07 AMthor
05/12/2023, 4:17 AMStefano Bonicatti
05/24/2023, 11:08 AMfreight
https://github.com/freight-team/freight and for RPM the more official createrepo_c
https://github.com/rpm-software-management/createrepo_c
freight
does not seem to be developed anymore; I’m not sure if this is an issue right now. I think it was chosen mainly because with a command you tell it to add a new package file to the repo and it does everything for you, including signing the metadata of the repo (not the packages); this is configured in freight.deb.conf
For RPM we use createrepo_c
as mentioned before, which does something similar.seph
06/01/2023, 10:07 PMosquery-go
. But as a project we have very few go people in our committers list. (I think probably just @zwass and I). How do people feel about creating a go-committers, and adding some folks? I could nominate someone from Kolide, maybe there’s a Fleet person, and maybe there are some people from the broader community around