RepoMirrors/osquery-defense-kit
1
0
Fork 0
mirror of https://github.com/chainguard-dev/osquery-defense-kit synced 2025-01-18 11:30:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

gcp keys mdfind: filter out more filenames

Browse Source
This commit is contained in:
Thomas Stromberg 2023-03-17 10:15:07 -04:00
parent 2bfd736d37
commit 0aac121cbb
Failed to extract signature
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
policy/gcp-service-account-keys-mdfind.sql
View File

@ -53,11 +53,23 @@ WHERE
AND NOT file.directory LIKE '%/conformance/%'
AND NOT file.directory LIKE '%/third_party/%'
AND NOT file.directory LIKE '%/generated/%'
AND NOT file.directory LIKE '%/output/%'
AND NOT file.directory LIKE '%/tests%'
AND NOT file.directory LIKE '%/validation%'
AND NOT file.directory LIKE '%/data/%'
AND NOT file.directory LIKE '%/json%'
AND NOT file.directory LIKE '%/specs%'
AND NOT file.directory LIKE '%/schemas'
AND NOT file.directory LIKE '/Users/%/Library/Application Support/%'
AND NOT file.directory LIKE '%demo'
AND NOT file.filename LIKE 'ntia-conformance-%'
AND NOT file.filename LIKE '%-test.json'
AND NOT file.filename LIKE '%package%'
AND NOT file.filename LIKE '%expected%'
AND NOT file.filename LIKE '%.pom.%'
AND NOT file.filename LIKE '%latest%'
AND NOT file.filename LIKE '%2022%'
AND NOT file.filename LIKE '%2023%'
AND NOT file.filename LIKE '%spdx%'
AND NOT file.filename LIKE '%-v1%'
-- Well known demo keys