RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add privacy-aware version of the IR rules

This commit is contained in:
Thomas Stromberg 2023-02-24 17:47:07 -05:00
parent b9cefa0d09
commit 063eb1691c
Failed to extract signature
2 changed files with 10 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
Makefile
View File

@ -16,13 +16,18 @@ out/odk-policy.conf: out/osqtool-$(ARCH) $(wildcard policy/*.sql)
mv out/.odk-policy.conf out/odk-policy.conf
out/odk-incident-response.conf: out/osqtool-$(ARCH) $(wildcard incident_response/*.sql)
./out/osqtool-$(ARCH) --verify pack incident_response/ > out/.odk-incident_response.conf
mv out/.odk-incident_response.conf out/odk-incident_response.conf
./out/osqtool-$(ARCH) --verify pack incident_response/ > out/.odk-incident-response.conf
mv out/.odk-incident-response.conf out/odk-incident_response.conf
packs: out/odk-detection.conf out/odk-policy.conf out/odk-incident-response.conf
# A privacy-aware variation of IR rules
out/odk-incident-response-privacy.conf: out/osqtool-$(ARCH) $(wildcard incident_response/*.sql)
./out/osqtool-$(ARCH) --exclude-tags=disabled,disabled-privacy pack incident_response/ > out/.odk-incident-response-privacy.conf
mv out/.odk-incident-response-privacy.conf out/odk-incident-response-privacy.conf
packs: out/odk-detection.conf out/odk-policy.conf out/odk-incident-response.conf out/odk-incident-response-privacy.conf
out/odk-packs.zip: packs
cd out && zip odk-packs.zip *.conf
cd out && rm -f .*.conf && zip odk-packs.zip *.conf
.PHONY: reformat
reformat:

2
incident_response/running_apps_macos.sql
View File

@ -1,6 +1,6 @@
-- Retrieves currently running applications
--
-- tags: postmortem often
-- tags: postmortem disabled-privacy
-- platform: darwin
SELECT
*