Thomas Stromberg
|
9ea6486121
|
Fix start-iap-tunnel matching
|
2023-02-02 20:55:46 -05:00 |
|
Thomas Stromberg
|
2bdb9f2f3e
|
Add more macOS software authorities
|
2023-02-02 20:53:22 -05:00 |
|
Thomas Stromberg
|
668f012a92
|
Remove 'launchctl load' as an exotic event (too noisy)
|
2023-02-02 20:44:14 -05:00 |
|
Thomas Stromberg
|
1cf0a1e89d
|
Remove zsh from exotic list
|
2023-02-02 20:35:30 -05:00 |
|
Thomas Stromberg
|
f56930a05f
|
Merge remote-tracking branch 'upstream/main'
|
2023-02-02 20:34:19 -05:00 |
|
Thomas Strömberg
|
0eced9ec19
|
Merge pull request #159 from tstromberg/main
Add uid0 exception for Logitech
|
2023-02-02 20:34:10 -05:00 |
|
Thomas Stromberg
|
41ee6feced
|
Merge remote-tracking branch 'upstream/main'
|
2023-02-02 20:33:46 -05:00 |
|
Thomas Stromberg
|
91b20a98fd
|
Add uid0 exception for Logitech
|
2023-02-02 20:33:34 -05:00 |
|
Thomas Strömberg
|
d885578e28
|
Merge pull request #158 from tstromberg/fpr-again
Rewrite unexpecetd uid0 for Linux, include cgroup info
|
2023-02-02 20:33:01 -05:00 |
|
Thomas Stromberg
|
a3ec1bf2bf
|
Rewrite unexpecetd uid0 for Linux, include cgroup info
|
2023-02-02 20:30:55 -05:00 |
|
Thomas Strömberg
|
546cb47cef
|
Merge pull request #157 from tstromberg/fpr-again
Add new Kolide signing authority as a valid talker
|
2023-02-02 19:50:33 -05:00 |
|
Thomas Stromberg
|
d039449330
|
Add new Kolide signing authority as a valid talker
|
2023-02-02 19:50:13 -05:00 |
|
Thomas Strömberg
|
af32311d89
|
Merge pull request #156 from tstromberg/macos-perf
Decrease number of rows returned by process_memory_map, reformat
|
2023-02-02 17:59:09 -05:00 |
|
Thomas Stromberg
|
bb3e1f964e
|
Run make reformat, update max rows for incident response
|
2023-02-02 17:58:19 -05:00 |
|
Thomas Strömberg
|
d65e8a7638
|
Merge pull request #155 from tstromberg/macos-perf
Significant performance improvements for slowest macOS queries
|
2023-02-02 17:49:13 -05:00 |
|
Thomas Stromberg
|
5ce1e5c9fa
|
Decrease number of rows returned by process_memory_map
|
2023-02-02 17:47:16 -05:00 |
|
Thomas Stromberg
|
809645a3bf
|
Add new Kolide id, fix some debug lines
|
2023-02-02 17:42:46 -05:00 |
|
Thomas Stromberg
|
ba45449f7d
|
unexpected uid0: fix bug, make faster
|
2023-02-02 17:16:35 -05:00 |
|
Thomas Stromberg
|
05cfd6fa98
|
Speed up exotic-commands-macos from minutes to seconds
|
2023-02-02 17:16:17 -05:00 |
|
Thomas Stromberg
|
70019ff668
|
macOS: speed up missing parent check (2m to 1s)
|
2023-02-02 16:59:12 -05:00 |
|
Thomas Stromberg
|
bad629b783
|
Fix errant platform setting
|
2023-02-02 16:54:43 -05:00 |
|
Thomas Strömberg
|
561a7511da
|
Merge pull request #154 from tstromberg/macos-bugs
macOS: Add exceptions for AppleInstallType.plist & osquery
|
2023-02-02 16:36:36 -05:00 |
|
Thomas Stromberg
|
ccf7ba413e
|
macOS: Add exceptions for AppleInstallType.plist & osquery
|
2023-02-02 16:36:17 -05:00 |
|
Thomas Strömberg
|
79c88e6b94
|
Merge pull request #153 from tstromberg/macos-bugs
Fix broken macOS queries & include new macOS fragments
|
2023-02-02 15:34:00 -05:00 |
|
Thomas Stromberg
|
2093a26423
|
Fix broken macOS queries
|
2023-02-02 15:33:25 -05:00 |
|
Thomas Strömberg
|
afec68cd33
|
Merge pull request #152 from tstromberg/new-osqtool
Update configuration for osqtool v1.0
|
2023-02-02 12:05:02 -05:00 |
|
Thomas Stromberg
|
2d81061df3
|
Update for osqtool v1.0
|
2023-02-02 12:04:26 -05:00 |
|
Thomas Strömberg
|
fd1b5d28c4
|
Merge pull request #151 from tstromberg/perf-analysis
Tune queries to decrease CPU overhead on macOS
|
2023-02-01 16:18:54 -05:00 |
|
Thomas Stromberg
|
cdcb2d48f3
|
Slow queries down, minor improvements
|
2023-02-01 16:17:36 -05:00 |
|
Thomas Stromberg
|
393b83168f
|
Merge to head
|
2023-02-01 15:11:51 -05:00 |
|
Thomas Stromberg
|
23f436f906
|
Minor perf improvements for macOS queries
|
2023-02-01 15:06:58 -05:00 |
|
Thomas Strömberg
|
97a3661e1d
|
Merge pull request #150 from tstromberg/fp4
Include more process information across queries
|
2023-02-01 13:57:04 -05:00 |
|
Thomas Stromberg
|
f9dce0a72d
|
Include more process information across queries
|
2023-02-01 13:55:55 -05:00 |
|
Thomas Strömberg
|
3ee82708c8
|
Merge pull request #149 from tstromberg/fp4
Fix typo with zed entry
|
2023-01-30 15:02:06 -05:00 |
|
Thomas Stromberg
|
bc2cde9673
|
Fix typo with zed entry
|
2023-01-30 15:01:21 -05:00 |
|
Thomas Strömberg
|
825552bec4
|
Merge pull request #148 from tstromberg/fp4
fpr: Chrome exts, vbox, chrome, gcloud, gdm3, yay, hangouts, etc
|
2023-01-30 14:59:28 -05:00 |
|
Thomas Stromberg
|
45ab183557
|
fpr: New Chrome etxensions, vbox, chrome, gcloud, gdm3, yay, etc
|
2023-01-30 14:58:47 -05:00 |
|
Thomas Stromberg
|
5621d9ecd1
|
Add exception for wrapped Firefox talking to port 19305 (Hangouts)
|
2023-01-27 10:41:55 -05:00 |
|
Thomas Strömberg
|
fbb452c564
|
Merge pull request #147 from tstromberg/fp4
Include possible sources in unexpected-volume-names, reduce false positives
|
2023-01-27 10:39:10 -05:00 |
|
Thomas Stromberg
|
141ab28310
|
False positives: autodocs, jupyter, apko
|
2023-01-27 10:38:01 -05:00 |
|
Thomas Stromberg
|
bd9320acfa
|
Include possible volume sources
|
2023-01-27 10:36:37 -05:00 |
|
Thomas Strömberg
|
69b9734c56
|
Merge pull request #146 from tstromberg/fp4
Remove unused active fields, add WhatsApp ioreg exception
|
2023-01-27 08:47:26 -05:00 |
|
Thomas Stromberg
|
66ee3484c0
|
Remove unused active fields, add WhatsApp ioreg exception
|
2023-01-27 08:46:48 -05:00 |
|
Thomas Strömberg
|
508f254896
|
Merge pull request #145 from tstromberg/fp4
Make unexpected-chrome-extensions easier to maintain, address false-positives
|
2023-01-26 20:41:47 -05:00 |
|
Thomas Stromberg
|
d51bd731a1
|
fpr: Parallels, nerdctl, Xorg, nvidia, Stream, etc
|
2023-01-26 20:40:47 -05:00 |
|
Thomas Stromberg
|
b671e30fce
|
Simplify unexpected-chrome-extensions exceptions for maintainability
|
2023-01-26 20:40:22 -05:00 |
|
Thomas Stromberg
|
7d8fa35eb4
|
fpr: Github Absolute Date, Snagit, Figma, Seagate, aws, etc
|
2023-01-26 16:30:14 -05:00 |
|
Thomas Strömberg
|
1b541f402e
|
Merge pull request #144 from tstromberg/fp4
Refactor process_events queries, improve shlayer detection, fix fps
|
2023-01-26 11:42:14 -05:00 |
|
Thomas Stromberg
|
f5fe9a4aac
|
Refactor process_events queries for more accurate parenting
|
2023-01-26 11:40:54 -05:00 |
|
Thomas Strömberg
|
b435a2055c
|
Merge pull request #143 from tstromberg/fp4
fpr: minikube, tailscale, dex, pacman, virtualbox, steam, lsmod, busybox, kue, libinput, etc
|
2023-01-23 20:34:31 -05:00 |
|