mirror of
https://github.com/OTRF/OSSEM-DD
synced 2026-06-08 12:05:33 +00:00
Swann Legras
54 lines
1.3 KiB
YAML
54 lines
1.3 KiB
YAML
name: Disk_encryption Table
|
|
description: Disk encryption status and information.
|
|
platform: linux
|
|
log_source: osquery
|
|
event_id: disk_encryption
|
|
event_version: 4.4.2
|
|
event_fields:
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: name
|
|
type: TEXT
|
|
description: Disk name
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: uuid
|
|
type: TEXT
|
|
description: Disk Universally Unique Identifier
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: encrypted
|
|
type: INTEGER
|
|
description: '1 If encrypted: true (disk is encrypted), else 0'
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: type
|
|
type: TEXT
|
|
description: Description of cipher type and mode if available
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: uid
|
|
type: TEXT
|
|
description: Currently authenticated user if available (Apple)
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: user_uuid
|
|
type: TEXT
|
|
description: UUID of authenticated user if available (Apple)
|
|
sample_value: TBD
|
|
- standard_name: TBD
|
|
standard_type: TBD
|
|
name: encryption_status
|
|
type: TEXT
|
|
description: 'Disk encryption status with one of following values: encrypted | not encrypted | undefined'
|
|
sample_value: TBD
|
|
references:
|
|
- text: OSQuery table documentation
|
|
link: https://osquery.io/schema/current#disk_encryption
|
|
tags: []
|