D7net
Home
Console
Upload
information
Create File
Create Folder
About
Tools
:
/
opt
/
osquery
/
share
/
osquery
/
packs
/
Filename :
it-compliance.conf
back
Copy
{ "queries": { "osquery_info": { "query" : "select * from time, osquery_info;", "interval" : "86400", "version" : "1.4.5", "description" : "Retrieves the current version of the running osquery in the target system and where the configuration was loaded from.", "value" : "Identify if your infrastructure is running the correct osquery version and which hosts may have drifted" }, "ad_config": { "query" : "select * from ad_config;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves the Active Directory configuration for the target machine, attached to the domain (requires sudo).", "value" : "Helps you debug domain binding / Active Directory issues in your environment." }, "kernel_info": { "query" : "select * from kernel_info;", "interval" : "86400", "version" : "1.4.5", "description" : "Retrieves information from the current kernel in the target system.", "value" : "Identify out of date kernels or version drift across your infrastructure" }, "os_version": { "query" : "select * from os_version;", "interval" : "86400", "version" : "1.4.5", "description" : "Retrieves information from the Operative System where osquery is currently running.", "value" : "Identify out of date operating systems or version drift across your infrastructure" }, "alf": { "query" : "select * from alf;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves the configuration values for the Application Layer Firewall for OSX.", "value" : "Verify firewall settings are as expected" }, "alf_exceptions": { "query" : "select * from alf_exceptions;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves the exceptions for the Application Layer Firewall in OSX.", "value" : "Verify firewall settings are as expected" }, "alf_services": { "query" : "select * from alf_services;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves the services for the Application Layer Firewall in OSX.", "value" : "Verify firewall settings are as expected" }, "alf_explicit_auths": { "query" : "select * from alf_explicit_auths;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves the list of processes with explicit authorization for the Application Layer Firewall.", "value" : "Verify firewall settings are as expected" }, "mounts": { "query" : "select * from mounts;", "interval" : "86400", "version" : "1.4.5", "description" : "Retrieves the current list of mounted drives in the target system.", "value" : "Verify if mounts are accessible to those who need it" }, "nfs_shares": { "query" : "select * from nfs_shares;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves the current list of Network File System mounted shares.", "value" : "Verify if shares are accessible to those who need it" }, "windows_shared_resources": { "query" : "select * from shared_resources;", "interval" : "86400", "platform" : "windows", "version" : "2.0.0", "description" : "Retrieves the list of shared resources in the target Windows system.", "value" : "General security posture." }, "browser_plugins": { "query" : "select * from users join browser_plugins using (uid);", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves the list of C/NPAPI browser plugins in the target system.", "value" : "General security posture." }, "safari_extensions": { "query" : "select * from users join safari_extensions using (uid);", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves the list of extensions for Safari in the target system.", "value" : "General security posture." }, "chrome_extensions": { "query" : "select * from users join chrome_extensions using (uid);", "interval" : "86400", "version" : "1.4.5", "description" : "Retrieves the list of extensions for Chrome in the target system.", "value" : "General security posture." }, "firefox_addons": { "query" : "select * from users join firefox_addons using (uid);", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves the list of addons for Firefox in the target system.", "value" : "General security posture." }, "homebrew_packages": { "query" : "select * from homebrew_packages;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves the list of brew packages installed in the target OSX system.", "value" : "General security posture." }, "windows_programs": { "query" : "select * from programs;", "interval" : "86400", "platform" : "windows", "version" : "2.0.0", "description" : "Retrieves the list of products as they are installed by Windows Installer in the target Windows system.", "value" : "General security posture." }, "windows_patches": { "query" : "select * from patches;", "interval" : "86400", "platform" : "windows", "version" : "2.2.0", "description" : "Retrieves all the information for the current windows drivers in the target Windows system." }, "package_receipts": { "query" : "select * from package_receipts;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves all the PKG related information stored in OSX.", "value" : "General security posture." }, "usb_devices": { "query" : "select * from usb_devices;", "interval" : "86400", "platform" : "posix", "version" : "1.4.5", "description" : "Retrieves the current list of USB devices in the target system.", "value" : "General security posture." }, "keychain_items": { "query" : "select * from keychain_items;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves all the items contained in the keychain in the target OSX system.", "value" : "General security posture." }, "deb_packages": { "query" : "select * from deb_packages;", "interval" : "86400", "platform" : "ubuntu", "version" : "1.4.5", "description" : "Retrieves all the installed DEB packages in the target Linux system.", "value" : "General security posture." }, "apt_sources": { "query" : "select * from apt_sources;", "interval" : "86400", "platform" : "ubuntu", "version" : "1.4.5", "description" : "Retrieves all the APT sources to install packages from in the target Linux system.", "value" : "General security posture." }, "portage_packages": { "query" : "select * from portage_use;", "interval" : "86400", "platform" : "gentoo", "version" : "2.0.0", "description" : "Retrieves all the packages installed with portage from the target Linux system.", "value" : "General security posture." }, "kernel_modules": { "query" : "select * from kernel_modules;", "interval" : "86400", "platform" : "linux", "version" : "1.4.5", "description" : "Retrieves the current list of loaded kernel modules in the target Linux system.", "value" : "General security posture." }, "windows_drivers": { "query" : "select * from drivers;", "interval" : "86400", "platform" : "windows", "version" : "2.2.0", "description" : "Retrieves all the information for the current windows drivers in the target Windows system." }, "rpm_packages": { "query" : "select * from rpm_packages;", "interval" : "86400", "platform" : "linux", "version" : "1.4.5", "description" : "Retrieves all the installed RPM packages in the target Linux system.", "value" : "General security posture." }, "installed_applications": { "query" : "select * from apps;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves all the currently installed applications in the target OSX system.", "value" : "Find currently installed applications and versions of each." }, "disk_encryption": { "query" : "select * from disk_encryption;", "interval" : "86400", "version" : "1.4.5", "platform" : "posix", "description" : "Retrieves the current disk encryption status for the target system.", "value" : "Identifies a system potentially vulnerable to disk cloning." }, "launchd": { "query" : "select * from launchd;", "interval" : "86400", "platform" : "darwin", "version" : "1.4.5", "description" : "Retrieves all the daemons that will run in the start of the target OSX system.", "value" : "Visibility on what starts in the system." }, "iptables": { "query" : "select * from iptables;", "interval" : "86400", "platform" : "linux", "version" : "1.4.5", "description" : "Retrieves the current filters and chains per filter in the target system.", "value" : "General security posture." }, "sip_config": { "query" : "select * from sip_config;", "interval" : "86400", "platform" : "darwin", "version" : "1.7.0", "description" : "Retrieves the current System Integrity Protection configuration in the target system.", "value" : "General security posture." } } }