RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update for osqtool v1.0

This commit is contained in:
Thomas Stromberg 2023-02-02 12:04:26 -05:00
parent fd1b5d28c4
commit 2d81061df3
Failed to extract signature
2 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Makefile
View File

@ -3,17 +3,17 @@ out/osqtool:
GOBIN=$(CURDIR)/out go install github.com/chainguard-dev/osqtool/cmd/osqtool@latest
out/odk-detection.conf: out/osqtool
./out/osqtool --verify pack detection/ > out/odk-detection.conf
./out/osqtool --max-results=0 --verify pack detection/ > out/odk-detection.conf
out/odk-policy.conf: out/osqtool
./out/osqtool --verify pack policy/ > out/odk-policy.conf
./out/osqtool --max-results=0 --verify pack policy/ > out/odk-policy.conf
out/odk-incident-response.conf: out/osqtool
./out/osqtool --max-duration=8s --verify pack incident_response/ > out/odk-incident-response.conf
./out/osqtool --max-results=40960 --max-query-duration=8s --max-total-daily-duration=90m --verify pack incident_response/ > out/odk-incident-response.conf
# An alternative rules file for configurations where the "wireless_networks" table is forbidden for querying
out/odk-incident-response-no-wifi.conf: out/osqtool
./out/osqtool --max-duration=8s --verify --exclude wireless_networks_macos pack incident_response/ > out/odk-incident-response-no-wifi.conf
./out/osqtool --max-results=40960 --max-query-duration=8s --max-total-daily-duration=90m --verify --exclude wireless_networks_macos pack incident_response/ > out/odk-incident-response-no-wifi.conf
packs: out/odk-detection.conf out/odk-policy.conf out/odk-incident-response.conf out/odk-incident-response-no-wifi.conf

2
detection/privesc/setxid-env-overflow-attempt.sql
View File

@ -11,7 +11,7 @@
-- platform: posix
--
-- Uncomment once the underlying problem is addressed:
-- XintervalX: 60
-- interval: 60
SELECT
file.mode AS p0_binary_mode,
pe.env AS p0_env,