RepoMirrors
/
osquery-defense-kit
mirror of https://github.com/chainguard-dev/osquery-defense-kit
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove wireless-networks rule, rename collection to collect

This commit is contained in:
Thomas Stromberg 2023-02-24 17:30:43 -05:00
parent 020145f207
commit b9cefa0d09
Failed to extract signature
2 changed files with 2 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
Makefile
View File

@ -19,11 +19,7 @@ out/odk-incident-response.conf: out/osqtool-$(ARCH) $(wildcard incident_respons
./out/osqtool-$(ARCH) --verify pack incident_response/ > out/.odk-incident_response.conf ./out/osqtool-$(ARCH) --verify pack incident_response/ > out/.odk-incident_response.conf
mv out/.odk-incident_response.conf out/odk-incident_response.conf mv out/.odk-incident_response.conf out/odk-incident_response.conf
# An alternative rules file for configurations where the "wireless_networks" table is forbidden for querying packs: out/odk-detection.conf out/odk-policy.conf out/odk-incident-response.conf
out/odk-incident-response-without-wireless-networks.conf: out/osqtool-$(ARCH)
./out/osqtool-$(ARCH) --max-total-daily-duration=90m --verify --exclude wireless_networks_macos pack incident_response/ > out/odk-incident-response-without-wireless-networks.conf
packs: out/odk-detection.conf out/odk-policy.conf out/odk-incident-response.conf out/odk-incident-response-no-wifi.conf
out/odk-packs.zip: packs out/odk-packs.zip: packs
cd out && zip odk-packs.zip *.conf cd out && zip odk-packs.zip *.conf
@ -36,7 +32,7 @@ reformat:
reformat-updates: reformat-updates:
git status -s | awk '{ print $$2 }' | grep ".sql" | perl -ne 'chomp; system("cp $$_ /tmp/fix.sql && npx sql-formatter -l sqlite /tmp/fix.sql > $$_");' git status -s | awk '{ print $$2 }' | grep ".sql" | perl -ne 'chomp; system("cp $$_ /tmp/fix.sql && npx sql-formatter -l sqlite /tmp/fix.sql > $$_");'
.PHONY: collection .PHONY: collect
collection: ./out/osqtool-$(ARCH) collection: ./out/osqtool-$(ARCH)
mkdir -p $(COLLECT_DIR) mkdir -p $(COLLECT_DIR)
@echo "Saving output to: $(COLLECT_DIR)" @echo "Saving output to: $(COLLECT_DIR)"

12
incident_response/wireless_networks_macos.sql
View File

@ -1,12 +0,0 @@
-- Retrieves all the remembered wireless network that the target machine has connected to.
SELECT
ssid,
network_name,
security_type,
last_connected,
captive_portal,
possibly_hidden,
roaming,
roaming_profile
FROM
wifi_networks;