diff --git a/data_dictionaries/README.md b/data_dictionaries/README.md index 5d656357b..e50736e0c 100644 --- a/data_dictionaries/README.md +++ b/data_dictionaries/README.md @@ -7,6 +7,7 @@ This part of the OSSEM project contains specific information about several secur |Data Set|Description| |---|---| |[macOS](macos/)|Data dictionaries for macOS based events.| +|[FreeBSD](freebsd/)|Data dictionaries for FreeBSD based events.| |[Linux](linux/)|Data dictionaries for Linux based events.| |[Zeek Event Logs](zeek/)|Zeek provides, network, metadata on over 40+ different applications and protocols. Additionally, Zeek provides a framework that enables the community to extend various functionality, protocol analzers/parsers, and or add additional (meta)data. The data is broken up into a log for each application/protocol. For example, all DNS data is stored in dns.log and all HTTP data is stored in http.log. Across all of the logs is over 1,000 fields that contain data ranging from common netflow (ie: bytes, packets, etc..) to application layer data (ie: HTTP headers, TLS Certificate info, etc..). To name just a few of the log types: Connection/Flow, HTTP, SSL/TLS, DNS, RDP, SMB, Kerberos, ModBus, Intel, FTP, SSH, GQUIC, SQL, etc.. It also hashes files and can extract them too. Zeek logs have a unique ability to pivot between logs the various logs via uid fields. For example: an HTTP connection results in a http.log and conn.log. Also, if a file was transferred/downloaded during the connection then there would be an additional files.log. Therefore, you not only obtain HTTP (header) fields, duration of connection, bytes sent/received, packets, hash of the file, size of the file, etc.. but you can pivot between the three logs too! The main field to pivot across will be normalized to event_uid and all other UIDs that can be pivoted/joined across will be set in any_event_uid| |[Windows](windows/)|Data dictionaries for Windows based events.| diff --git a/data_dictionaries/freebsd/README.md b/data_dictionaries/freebsd/README.md new file mode 100644 index 000000000..b3a6f289e --- /dev/null +++ b/data_dictionaries/freebsd/README.md @@ -0,0 +1,9 @@ +# FreeBSD + +## Description +Data dictionaries for FreeBSD based events. + +## Sub Data Sets +|Data Set|Description| +|---|---| +|[FreeBSD Osquery Event Logs](osquery/)|Osquery schema is defined in tables by osquery engineers.| diff --git a/data_dictionaries/freebsd/osquery/README.md b/data_dictionaries/freebsd/osquery/README.md new file mode 100644 index 000000000..74f472eb5 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/README.md @@ -0,0 +1,100 @@ +# FreeBSD Osquery Event Logs + +## Description +Osquery schema is defined in tables by osquery engineers. + +## Sub Data Sets +|events|Description|Tags| +|---|---|---| +|[apt_sources](events/apt_sources.md)|Current list of APT repositories or software channels.|version_4.4.2| +|[augeas](events/augeas.md)|Configuration files parsed by augeas.|version_4.4.2| +|[authorized_keys](events/authorized_keys.md)|A line-delimited authorized_keys table.|version_4.4.2| +|[azure_instance_metadata](events/azure_instance_metadata.md)|Azure instance metadata.|version_4.4.2| +|[azure_instance_tags](events/azure_instance_tags.md)|Azure instance tags.|version_4.4.2| +|[carbon_black_info](events/carbon_black_info.md)|Returns info about a Carbon Black sensor install.|version_4.4.2| +|[carves](events/carves.md)|Forensic Carves.|version_4.4.2| +|[chrome_extensions](events/chrome_extensions.md)|Chrome browser extensions.|version_4.4.2| +|[cpu_time](events/cpu_time.md)|Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.|version_4.4.2| +|[cpuid](events/cpuid.md)|Useful CPU features from the cpuid ASM call.|version_4.4.2| +|[crontab](events/crontab.md)|Line parsed values from system and user cron/tab.|version_4.4.2| +|[curl](events/curl.md)|Perform an http request and return stats about it.|version_4.4.2| +|[curl_certificate](events/curl_certificate.md)|Inspect TLS certificates by connecting to input hostnames.|version_4.4.2| +|[device_file](events/device_file.md)|Similar to the file table, but use TSK and allow block address access.|version_4.4.2| +|[device_hash](events/device_hash.md)|Similar to the hash table, but use TSK and allow block address access.|version_4.4.2| +|[device_partitions](events/device_partitions.md)|Use TSK to enumerate details about partitions on a disk device.|version_4.4.2| +|[dns_resolvers](events/dns_resolvers.md)|Resolvers used by this host.|version_4.4.2| +|[docker_container_labels](events/docker_container_labels.md)|Docker container labels.|version_4.4.2| +|[docker_container_mounts](events/docker_container_mounts.md)|Docker container mounts.|version_4.4.2| +|[docker_container_networks](events/docker_container_networks.md)|Docker container networks.|version_4.4.2| +|[docker_container_ports](events/docker_container_ports.md)|Docker container ports.|version_4.4.2| +|[docker_container_processes](events/docker_container_processes.md)|Docker container processes.|version_4.4.2| +|[docker_container_stats](events/docker_container_stats.md)|Docker container statistics. Queries on this table take at least one second.|version_4.4.2| +|[docker_containers](events/docker_containers.md)|Docker containers information.|version_4.4.2| +|[docker_image_labels](events/docker_image_labels.md)|Docker image labels.|version_4.4.2| +|[docker_image_layers](events/docker_image_layers.md)|Docker image layers information.|version_4.4.2| +|[docker_images](events/docker_images.md)|Docker images information.|version_4.4.2| +|[docker_info](events/docker_info.md)|Docker system information.|version_4.4.2| +|[docker_network_labels](events/docker_network_labels.md)|Docker network labels.|version_4.4.2| +|[docker_networks](events/docker_networks.md)|Docker networks information.|version_4.4.2| +|[docker_version](events/docker_version.md)|Docker version information.|version_4.4.2| +|[docker_volume_labels](events/docker_volume_labels.md)|Docker volume labels.|version_4.4.2| +|[docker_volumes](events/docker_volumes.md)|Docker volumes information.|version_4.4.2| +|[etc_hosts](events/etc_hosts.md)|Line-parsed /etc/hosts.|version_4.4.2| +|[etc_protocols](events/etc_protocols.md)|Line-parsed /etc/protocols.|version_4.4.2| +|[etc_services](events/etc_services.md)|Line-parsed /etc/services.|version_4.4.2| +|[example](events/example.md)|This is an example table spec.|version_4.4.2| +|[fbsd_kmods](events/fbsd_kmods.md)|Loaded FreeBSD kernel modules.|version_4.4.2| +|[file](events/file.md)|Interactive filesystem attributes and metadata.|version_4.4.2| +|[firefox_addons](events/firefox_addons.md)|Firefox browser extensions, webapps, and addons.|version_4.4.2| +|[groups](events/groups.md)|Local system groups.|version_4.4.2| +|[hash](events/hash.md)|Filesystem hash data.|version_4.4.2| +|[hvci_status](events/hvci_status.md)|Retrieve HVCI info of the machine.|version_4.4.2| +|[interface_addresses](events/interface_addresses.md)|Network interfaces and relevant metadata.|version_4.4.2| +|[interface_details](events/interface_details.md)|Detailed information and stats of network interfaces.|version_4.4.2| +|[interface_ipv6](events/interface_ipv6.md)|IPv6 configuration and stats of network interfaces.|version_4.4.2| +|[known_hosts](events/known_hosts.md)|A line-delimited known_hosts table.|version_4.4.2| +|[last](events/last.md)|System logins and logouts.|version_4.4.2| +|[listening_ports](events/listening_ports.md)|Processes with listening (bound) network sockets/ports.|version_4.4.2| +|[lldp_neighbors](events/lldp_neighbors.md)|LLDP neighbors of interfaces.|version_4.4.2| +|[load_average](events/load_average.md)|Displays information about the system wide load averages.|version_4.4.2| +|[logged_in_users](events/logged_in_users.md)|Users with an active shell on the system.|version_4.4.2| +|[magic](events/magic.md)|Magic number recognition library table.|version_4.4.2| +|[mounts](events/mounts.md)|System mounted devices and filesystems (not process specific).|version_4.4.2| +|[opera_extensions](events/opera_extensions.md)|Opera browser extensions.|version_4.4.2| +|[os_version](events/os_version.md)|A single row containing the operating system name and version.|version_4.4.2| +|[osquery_events](events/osquery_events.md)|Information about the event publishers and subscribers.|version_4.4.2| +|[osquery_extensions](events/osquery_extensions.md)|List of active osquery extensions.|version_4.4.2| +|[osquery_flags](events/osquery_flags.md)|Configurable flags that modify osquery's behavior.|version_4.4.2| +|[osquery_info](events/osquery_info.md)|Top level information about the running version of osquery.|version_4.4.2| +|[osquery_packs](events/osquery_packs.md)|Information about the current query packs that are loaded in osquery.|version_4.4.2| +|[osquery_registry](events/osquery_registry.md)|List the osquery registry plugins.|version_4.4.2| +|[osquery_schedule](events/osquery_schedule.md)|Information about the current queries that are scheduled in osquery.|version_4.4.2| +|[pkg_packages](events/pkg_packages.md)|pkgng packages that are currently installed on the host system.|version_4.4.2| +|[platform_info](events/platform_info.md)|Information about EFI/UEFI/ROM and platform/boot.|version_4.4.2| +|[process_envs](events/process_envs.md)|A key/value table of environment variables for each process.|version_4.4.2| +|[process_events](events/process_events.md)|Track time/action process executions.|version_4.4.2| +|[process_memory_map](events/process_memory_map.md)|Process memory mapped files and pseudo device/regions.|version_4.4.2| +|[process_open_files](events/process_open_files.md)|File descriptors for each process.|version_4.4.2| +|[process_open_sockets](events/process_open_sockets.md)|Processes which have open network sockets on the system.|version_4.4.2| +|[processes](events/processes.md)|All running processes on the host system.|version_4.4.2| +|[prometheus_metrics](events/prometheus_metrics.md)|Retrieve metrics from a Prometheus server.|version_4.4.2| +|[python_packages](events/python_packages.md)|Python packages installed in a system.|version_4.4.2| +|[routes](events/routes.md)|The active route table for the host system.|version_4.4.2| +|[shell_history](events/shell_history.md)|A line-delimited (command) table of per-user .*_history data.|version_4.4.2| +|[ssh_configs](events/ssh_configs.md)|A table of parsed ssh_configs.|version_4.4.2| +|[sudoers](events/sudoers.md)|Rules for running commands as other users via sudo.|version_4.4.2| +|[suid_bin](events/suid_bin.md)|suid binaries in common locations.|version_4.4.2| +|[system_controls](events/system_controls.md)|sysctl names, values, and settings information.|version_4.4.2| +|[system_info](events/system_info.md)|System information for identification.|version_4.4.2| +|[time](events/time.md)|Track current date and time in the system.|version_4.4.2| +|[ulimit_info](events/ulimit_info.md)|System resource usage limits.|version_4.4.2| +|[uptime](events/uptime.md)|Track time passed since last boot.|version_4.4.2| +|[user_events](events/user_events.md)|Track user events from the audit framework.|version_4.4.2| +|[user_ssh_keys](events/user_ssh_keys.md)|Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.|version_4.4.2| +|[users](events/users.md)|Local user accounts (including domain accounts that have logged on locally (Windows)).|version_4.4.2| +|[yara](events/yara.md)|Track YARA matches for files or PIDs.|version_4.4.2| +|[yum_sources](events/yum_sources.md)|Current list of Yum repositories or software channels.|version_4.4.2| + +## References +* [osquery schema 4.1.2 (website)](https://osquery.io/schema/4.1.2) +* [osquery schema linux specs (GitHub)](https://github.com/facebook/osquery/tree/master/specs/windows) \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/apt_sources.md b/data_dictionaries/freebsd/osquery/events/apt_sources.md new file mode 100644 index 000000000..47e3b3086 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/apt_sources.md @@ -0,0 +1,22 @@ +# Apt_sources Table + +## Description +Current list of APT repositories or software channels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Repository name|`TBD`| +|TBD|source|TEXT|Source file|`TBD`| +|TBD|base_uri|TEXT|Repository base URI|`TBD`| +|TBD|release|TEXT|Release name|`TBD`| +|TBD|version|TEXT|Repository source version|`TBD`| +|TBD|maintainer|TEXT|Repository maintainer|`TBD`| +|TBD|components|TEXT|Repository components|`TBD`| +|TBD|architectures|TEXT|Repository architectures|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#apt_sources) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/augeas.md b/data_dictionaries/freebsd/osquery/events/augeas.md new file mode 100644 index 000000000..9d20c63fa --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/augeas.md @@ -0,0 +1,18 @@ +# Augeas Table + +## Description +Configuration files parsed by augeas. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|node|TEXT|The node path of the configuration item|`TBD`| +|TBD|value|TEXT|The value of the configuration item|`TBD`| +|TBD|label|TEXT|The label of the configuration item|`TBD`| +|TBD|path|TEXT|The path to the configuration file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#augeas) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/authorized_keys.md b/data_dictionaries/freebsd/osquery/events/authorized_keys.md new file mode 100644 index 000000000..a63ce1764 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/authorized_keys.md @@ -0,0 +1,17 @@ +# Authorized_keys Table + +## Description +A line-delimited authorized_keys table. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local owner of authorized_keys file|`TBD`| +|TBD|key|TEXT|parsed authorized keys line|`TBD`| +|TBD|key_file|TEXT|Path to the authorized_keys file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#authorized_keys) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/azure_instance_metadata.md b/data_dictionaries/freebsd/osquery/events/azure_instance_metadata.md new file mode 100644 index 000000000..a5724217d --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/azure_instance_metadata.md @@ -0,0 +1,30 @@ +# Azure_instance_metadata Table + +## Description +Azure instance metadata. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|location|TEXT|Azure Region the VM is running in|`TBD`| +|TBD|name|TEXT|Name of the VM|`TBD`| +|TBD|offer|TEXT|Offer information for the VM image (Azure image gallery VMs only)|`TBD`| +|TBD|publisher|TEXT|Publisher of the VM image|`TBD`| +|TBD|sku|TEXT|SKU for the VM image|`TBD`| +|TBD|version|TEXT|Version of the VM image|`TBD`| +|TBD|os_type|TEXT|Linux or Windows|`TBD`| +|TBD|platform_update_domain|TEXT|Update domain the VM is running in|`TBD`| +|TBD|platform_fault_domain|TEXT|Fault domain the VM is running in|`TBD`| +|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`| +|TBD|vm_size|TEXT|VM size|`TBD`| +|TBD|subscription_id|TEXT|Azure subscription for the VM|`TBD`| +|TBD|resource_group_name|TEXT|Resource group for the VM|`TBD`| +|TBD|placement_group_id|TEXT|Placement group for the VM scale set|`TBD`| +|TBD|vm_scale_set_name|TEXT|VM scale set name|`TBD`| +|TBD|zone|TEXT|Availability zone of the VM|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_metadata) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/azure_instance_tags.md b/data_dictionaries/freebsd/osquery/events/azure_instance_tags.md new file mode 100644 index 000000000..1d237a229 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/azure_instance_tags.md @@ -0,0 +1,17 @@ +# Azure_instance_tags Table + +## Description +Azure instance tags. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`| +|TBD|key|TEXT|The tag key|`TBD`| +|TBD|value|TEXT|The tag value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_tags) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/carbon_black_info.md b/data_dictionaries/freebsd/osquery/events/carbon_black_info.md new file mode 100644 index 000000000..42d8e8146 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/carbon_black_info.md @@ -0,0 +1,35 @@ +# Carbon_black_info Table + +## Description +Returns info about a Carbon Black sensor install. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|sensor_id|INTEGER|Sensor ID of the Carbon Black sensor|`TBD`| +|TBD|config_name|TEXT|Sensor group|`TBD`| +|TBD|collect_store_files|INTEGER|If the sensor is configured to send back binaries to the Carbon Black server|`TBD`| +|TBD|collect_module_loads|INTEGER|If the sensor is configured to capture module loads|`TBD`| +|TBD|collect_module_info|INTEGER|If the sensor is configured to collect metadata of binaries|`TBD`| +|TBD|collect_file_mods|INTEGER|If the sensor is configured to collect file modification events|`TBD`| +|TBD|collect_reg_mods|INTEGER|If the sensor is configured to collect registry modification events|`TBD`| +|TBD|collect_net_conns|INTEGER|If the sensor is configured to collect network connections|`TBD`| +|TBD|collect_processes|INTEGER|If the sensor is configured to process events|`TBD`| +|TBD|collect_cross_processes|INTEGER|If the sensor is configured to cross process events|`TBD`| +|TBD|collect_emet_events|INTEGER|If the sensor is configured to EMET events|`TBD`| +|TBD|collect_data_file_writes|INTEGER|If the sensor is configured to collect non binary file writes|`TBD`| +|TBD|collect_process_user_context|INTEGER|If the sensor is configured to collect the user running a process|`TBD`| +|TBD|collect_sensor_operations|INTEGER|Unknown|`TBD`| +|TBD|log_file_disk_quota_mb|INTEGER|Event file disk quota in MB|`TBD`| +|TBD|log_file_disk_quota_percentage|INTEGER|Event file disk quota in a percentage|`TBD`| +|TBD|protection_disabled|INTEGER|If the sensor is configured to report tamper events|`TBD`| +|TBD|sensor_ip_addr|TEXT|IP address of the sensor|`TBD`| +|TBD|sensor_backend_server|TEXT|Carbon Black server|`TBD`| +|TBD|event_queue|INTEGER|Size in bytes of Carbon Black event files on disk|`TBD`| +|TBD|binary_queue|INTEGER|Size in bytes of binaries waiting to be sent to Carbon Black server|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#carbon_black_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/carves.md b/data_dictionaries/freebsd/osquery/events/carves.md new file mode 100644 index 000000000..aaffca4bd --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/carves.md @@ -0,0 +1,21 @@ +# Carves Table + +## Description +Forensic Carves. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|time|BIGINT|Time at which the carve was kicked off|`TBD`| +|TBD|sha256|TEXT|A SHA256 sum of the carved archive|`TBD`| +|TBD|size|INTEGER|Size of the carved archive|`TBD`| +|TBD|path|TEXT|The path of the requested carve|`TBD`| +|TBD|status|TEXT|Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED|`TBD`| +|TBD|carve_guid|TEXT|Identifying value of the carve session|`TBD`| +|TBD|carve|INTEGER|Set this value to '1' to start a file carve|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#carves) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/chrome_extensions.md b/data_dictionaries/freebsd/osquery/events/chrome_extensions.md new file mode 100644 index 000000000..1446387d9 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/chrome_extensions.md @@ -0,0 +1,26 @@ +# Chrome_extensions Table + +## Description +Chrome browser extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the extension|`TBD`| +|TBD|name|TEXT|Extension display name|`TBD`| +|TBD|profile|TEXT|The Chrome profile that contains this extension|`TBD`| +|TBD|identifier|TEXT|Extension identifier|`TBD`| +|TBD|version|TEXT|Extension-supplied version|`TBD`| +|TBD|description|TEXT|Extension-optional description|`TBD`| +|TBD|locale|TEXT|Default locale supported by extension|`TBD`| +|TBD|update_url|TEXT|Extension-supplied update URI|`TBD`| +|TBD|author|TEXT|Optional extension author|`TBD`| +|TBD|path|TEXT|Path to extension folder|`TBD`| +|TBD|permissions|TEXT|The permissions required by the extension|`TBD`| +|TBD|optional_permissions|TEXT|The permissions optionally required by the extensions|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#chrome_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/cpu_time.md b/data_dictionaries/freebsd/osquery/events/cpu_time.md new file mode 100644 index 000000000..615e81216 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/cpu_time.md @@ -0,0 +1,25 @@ +# Cpu_time Table + +## Description +Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|core|INTEGER|Name of the cpu (core)|`TBD`| +|TBD|user|BIGINT|Time spent in user mode|`TBD`| +|TBD|nice|BIGINT|Time spent in user mode with low priority (nice)|`TBD`| +|TBD|system|BIGINT|Time spent in system mode|`TBD`| +|TBD|idle|BIGINT|Time spent in the idle task|`TBD`| +|TBD|iowait|BIGINT|Time spent waiting for I/O to complete|`TBD`| +|TBD|irq|BIGINT|Time spent servicing interrupts|`TBD`| +|TBD|softirq|BIGINT|Time spent servicing softirqs|`TBD`| +|TBD|steal|BIGINT|Time spent in other operating systems when running in a virtualized environment|`TBD`| +|TBD|guest|BIGINT|Time spent running a virtual CPU for a guest OS under the control of the Linux kernel|`TBD`| +|TBD|guest_nice|BIGINT|Time spent running a niced guest |`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#cpu_time) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/cpuid.md b/data_dictionaries/freebsd/osquery/events/cpuid.md new file mode 100644 index 000000000..b8e27a7f5 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/cpuid.md @@ -0,0 +1,19 @@ +# Cpuid Table + +## Description +Useful CPU features from the cpuid ASM call. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|feature|TEXT|Present feature flags|`TBD`| +|TBD|value|TEXT|Bit value or string|`TBD`| +|TBD|output_register|TEXT|Register used to for feature value|`TBD`| +|TBD|output_bit|INTEGER|Bit in register value for feature value|`TBD`| +|TBD|input_eax|TEXT|Value of EAX used|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#cpuid) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/crontab.md b/data_dictionaries/freebsd/osquery/events/crontab.md new file mode 100644 index 000000000..6739e030f --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/crontab.md @@ -0,0 +1,22 @@ +# Crontab Table + +## Description +Line parsed values from system and user cron/tab. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|event|TEXT|The job @event name (rare)|`TBD`| +|TBD|minute|TEXT|The exact minute for the job|`TBD`| +|TBD|hour|TEXT|The hour of the day for the job|`TBD`| +|TBD|day_of_month|TEXT|The day of the month for the job|`TBD`| +|TBD|month|TEXT|The month of the year for the job|`TBD`| +|TBD|day_of_week|TEXT|The day of the week for the job|`TBD`| +|TBD|command|TEXT|Raw command string|`TBD`| +|TBD|path|TEXT|File parsed|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#crontab) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/curl.md b/data_dictionaries/freebsd/osquery/events/curl.md new file mode 100644 index 000000000..22c52b63e --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/curl.md @@ -0,0 +1,21 @@ +# Curl Table + +## Description +Perform an http request and return stats about it. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|url|TEXT|The url for the request|`TBD`| +|TBD|method|TEXT|The HTTP method for the request|`TBD`| +|TBD|user_agent|TEXT|The user-agent string to use for the request|`TBD`| +|TBD|response_code|INTEGER|The HTTP status code for the response|`TBD`| +|TBD|round_trip_time|BIGINT|Time taken to complete the request|`TBD`| +|TBD|bytes|BIGINT|Number of bytes in the response|`TBD`| +|TBD|result|TEXT|The HTTP response body|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#curl) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/curl_certificate.md b/data_dictionaries/freebsd/osquery/events/curl_certificate.md new file mode 100644 index 000000000..19f77ef6d --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/curl_certificate.md @@ -0,0 +1,26 @@ +# Curl_certificate Table + +## Description +Inspect TLS certificates by connecting to input hostnames. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|hostname|TEXT|Hostname (domain[:port]) to CURL|`TBD`| +|TBD|common_name|TEXT|Common name of company issued to|`TBD`| +|TBD|organization|TEXT|Organization issued to|`TBD`| +|TBD|organization_unit|TEXT|Organization unit issued to|`TBD`| +|TBD|serial_number|TEXT|Certificate serial number|`TBD`| +|TBD|issuer_common_name|TEXT|Issuer common name|`TBD`| +|TBD|issuer_organization|TEXT|Issuer organization|`TBD`| +|TBD|issuer_organization_unit|TEXT|Issuer organization unit|`TBD`| +|TBD|valid_from|TEXT|Period of validity start date|`TBD`| +|TBD|valid_to|TEXT|Period of validity end date|`TBD`| +|TBD|sha256_fingerprint|TEXT|SHA-256 fingerprint|`TBD`| +|TBD|sha1_fingerprint|TEXT|SHA1 fingerprint|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#curl_certificate) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/device_file.md b/data_dictionaries/freebsd/osquery/events/device_file.md new file mode 100644 index 000000000..329e6d063 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/device_file.md @@ -0,0 +1,29 @@ +# Device_file Table + +## Description +Similar to the file table, but use TSK and allow block address access. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Absolute file path to device node|`TBD`| +|TBD|partition|TEXT|A partition number|`TBD`| +|TBD|path|TEXT|A logical path within the device node|`TBD`| +|TBD|filename|TEXT|Name portion of file path|`TBD`| +|TBD|inode|BIGINT|Filesystem inode number|`TBD`| +|TBD|uid|BIGINT|Owning user ID|`TBD`| +|TBD|gid|BIGINT|Owning group ID|`TBD`| +|TBD|mode|TEXT|Permission bits|`TBD`| +|TBD|size|BIGINT|Size of file in bytes|`TBD`| +|TBD|block_size|INTEGER|Block size of filesystem|`TBD`| +|TBD|atime|BIGINT|Last access time|`TBD`| +|TBD|mtime|BIGINT|Last modification time|`TBD`| +|TBD|ctime|BIGINT|Creation time|`TBD`| +|TBD|hard_links|INTEGER|Number of hard links|`TBD`| +|TBD|type|TEXT|File status|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#device_file) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/device_hash.md b/data_dictionaries/freebsd/osquery/events/device_hash.md new file mode 100644 index 000000000..2eb036856 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/device_hash.md @@ -0,0 +1,20 @@ +# Device_hash Table + +## Description +Similar to the hash table, but use TSK and allow block address access. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Absolute file path to device node|`TBD`| +|TBD|partition|TEXT|A partition number|`TBD`| +|TBD|inode|BIGINT|Filesystem inode number|`TBD`| +|TBD|md5|TEXT|MD5 hash of provided inode data|`TBD`| +|TBD|sha1|TEXT|SHA1 hash of provided inode data|`TBD`| +|TBD|sha256|TEXT|SHA256 hash of provided inode data|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#device_hash) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/device_partitions.md b/data_dictionaries/freebsd/osquery/events/device_partitions.md new file mode 100644 index 000000000..b89faea11 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/device_partitions.md @@ -0,0 +1,23 @@ +# Device_partitions Table + +## Description +Use TSK to enumerate details about partitions on a disk device. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Absolute file path to device node|`TBD`| +|TBD|partition|INTEGER|A partition number or description|`TBD`| +|TBD|label|TEXT||`TBD`| +|TBD|type|TEXT||`TBD`| +|TBD|offset|BIGINT||`TBD`| +|TBD|blocks_size|BIGINT|Byte size of each block|`TBD`| +|TBD|blocks|BIGINT|Number of blocks|`TBD`| +|TBD|inodes|BIGINT|Number of meta nodes|`TBD`| +|TBD|flags|INTEGER||`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#device_partitions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/dns_resolvers.md b/data_dictionaries/freebsd/osquery/events/dns_resolvers.md new file mode 100644 index 000000000..df610ce0a --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/dns_resolvers.md @@ -0,0 +1,19 @@ +# Dns_resolvers Table + +## Description +Resolvers used by this host. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|INTEGER|Address type index or order|`TBD`| +|TBD|type|TEXT|Address type: sortlist, nameserver, search|`TBD`| +|TBD|address|TEXT|Resolver IP/IPv6 address|`TBD`| +|TBD|netmask|TEXT|Address (sortlist) netmask length|`TBD`| +|TBD|options|BIGINT|Resolver options|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#dns_resolvers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_container_labels.md b/data_dictionaries/freebsd/osquery/events/docker_container_labels.md new file mode 100644 index 000000000..1bf096ccb --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_container_labels.md @@ -0,0 +1,17 @@ +# Docker_container_labels Table + +## Description +Docker container labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_container_mounts.md b/data_dictionaries/freebsd/osquery/events/docker_container_mounts.md new file mode 100644 index 000000000..1e6f4fb30 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_container_mounts.md @@ -0,0 +1,23 @@ +# Docker_container_mounts Table + +## Description +Docker container mounts. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|type|TEXT|Type of mount (bind, volume)|`TBD`| +|TBD|name|TEXT|Optional mount name|`TBD`| +|TBD|source|TEXT|Source path on host|`TBD`| +|TBD|destination|TEXT|Destination path inside container|`TBD`| +|TBD|driver|TEXT|Driver providing the mount|`TBD`| +|TBD|mode|TEXT|Mount options (rw, ro)|`TBD`| +|TBD|rw|INTEGER|1 if read/write. 0 otherwise|`TBD`| +|TBD|propagation|TEXT|Mount propagation|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_mounts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_container_networks.md b/data_dictionaries/freebsd/osquery/events/docker_container_networks.md new file mode 100644 index 000000000..cb77b5a02 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_container_networks.md @@ -0,0 +1,25 @@ +# Docker_container_networks Table + +## Description +Docker container networks. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|name|TEXT|Network name|`TBD`| +|TBD|network_id|TEXT|Network ID|`TBD`| +|TBD|endpoint_id|TEXT|Endpoint ID|`TBD`| +|TBD|gateway|TEXT|Gateway|`TBD`| +|TBD|ip_address|TEXT|IP address|`TBD`| +|TBD|ip_prefix_len|INTEGER|IP subnet prefix length|`TBD`| +|TBD|ipv6_gateway|TEXT|IPv6 gateway|`TBD`| +|TBD|ipv6_address|TEXT|IPv6 address|`TBD`| +|TBD|ipv6_prefix_len|INTEGER|IPv6 subnet prefix length|`TBD`| +|TBD|mac_address|TEXT|MAC address|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_networks) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_container_ports.md b/data_dictionaries/freebsd/osquery/events/docker_container_ports.md new file mode 100644 index 000000000..90daa6939 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_container_ports.md @@ -0,0 +1,19 @@ +# Docker_container_ports Table + +## Description +Docker container ports. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|type|TEXT|Protocol (tcp, udp)|`TBD`| +|TBD|port|INTEGER|Port inside the container|`TBD`| +|TBD|host_ip|TEXT|Host IP address on which public port is listening|`TBD`| +|TBD|host_port|INTEGER|Host port|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_ports) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_container_processes.md b/data_dictionaries/freebsd/osquery/events/docker_container_processes.md new file mode 100644 index 000000000..b00165be2 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_container_processes.md @@ -0,0 +1,36 @@ +# Docker_container_processes Table + +## Description +Docker container processes. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|pid|BIGINT|Process ID|`TBD`| +|TBD|name|TEXT|The process path or shorthand argv[0]|`TBD`| +|TBD|cmdline|TEXT|Complete argv|`TBD`| +|TBD|state|TEXT|Process state|`TBD`| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|gid|BIGINT|Group ID|`TBD`| +|TBD|euid|BIGINT|Effective user ID|`TBD`| +|TBD|egid|BIGINT|Effective group ID|`TBD`| +|TBD|suid|BIGINT|Saved user ID|`TBD`| +|TBD|sgid|BIGINT|Saved group ID|`TBD`| +|TBD|wired_size|BIGINT|Bytes of unpagable memory used by process|`TBD`| +|TBD|resident_size|BIGINT|Bytes of private memory used by process|`TBD`| +|TBD|total_size|BIGINT|Total virtual memory size|`TBD`| +|TBD|parent|BIGINT|Process parent's PID|`TBD`| +|TBD|pgroup|BIGINT|Process group|`TBD`| +|TBD|threads|INTEGER|Number of threads used by process|`TBD`| +|TBD|nice|INTEGER|Process nice level (-20 to 20, default 0)|`TBD`| +|TBD|user|TEXT|User name|`TBD`| +|TBD|time|TEXT|Cumulative CPU time. [DD-]HH:MM:SS format|`TBD`| +|TBD|cpu|DOUBLE|CPU utilization as percentage|`TBD`| +|TBD|mem|DOUBLE|Memory utilization as percentage|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_processes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_container_stats.md b/data_dictionaries/freebsd/osquery/events/docker_container_stats.md new file mode 100644 index 000000000..d9b42967f --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_container_stats.md @@ -0,0 +1,38 @@ +# Docker_container_stats Table + +## Description +Docker container statistics. Queries on this table take at least one second. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|name|TEXT|Container name|`TBD`| +|TBD|pids|INTEGER|Number of processes|`TBD`| +|TBD|read|BIGINT|UNIX time when stats were read|`TBD`| +|TBD|preread|BIGINT|UNIX time when stats were last read|`TBD`| +|TBD|interval|BIGINT|Difference between read and preread in nano-seconds|`TBD`| +|TBD|disk_read|BIGINT|Total disk read bytes|`TBD`| +|TBD|disk_write|BIGINT|Total disk write bytes|`TBD`| +|TBD|num_procs|INTEGER|Number of processors|`TBD`| +|TBD|cpu_total_usage|BIGINT|Total CPU usage|`TBD`| +|TBD|cpu_kernelmode_usage|BIGINT|CPU kernel mode usage|`TBD`| +|TBD|cpu_usermode_usage|BIGINT|CPU user mode usage|`TBD`| +|TBD|system_cpu_usage|BIGINT|CPU system usage|`TBD`| +|TBD|online_cpus|INTEGER|Online CPUs|`TBD`| +|TBD|pre_cpu_total_usage|BIGINT|Last read total CPU usage|`TBD`| +|TBD|pre_cpu_kernelmode_usage|BIGINT|Last read CPU kernel mode usage|`TBD`| +|TBD|pre_cpu_usermode_usage|BIGINT|Last read CPU user mode usage|`TBD`| +|TBD|pre_system_cpu_usage|BIGINT|Last read CPU system usage|`TBD`| +|TBD|pre_online_cpus|INTEGER|Last read online CPUs|`TBD`| +|TBD|memory_usage|BIGINT|Memory usage|`TBD`| +|TBD|memory_max_usage|BIGINT|Memory maximum usage|`TBD`| +|TBD|memory_limit|BIGINT|Memory limit|`TBD`| +|TBD|network_rx_bytes|BIGINT|Total network bytes read|`TBD`| +|TBD|network_tx_bytes|BIGINT|Total network bytes transmitted|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_stats) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_containers.md b/data_dictionaries/freebsd/osquery/events/docker_containers.md new file mode 100644 index 000000000..dcd4e2fa4 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_containers.md @@ -0,0 +1,38 @@ +# Docker_containers Table + +## Description +Docker containers information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|name|TEXT|Container name|`TBD`| +|TBD|image|TEXT|Docker image (name) used to launch this container|`TBD`| +|TBD|image_id|TEXT|Docker image ID|`TBD`| +|TBD|command|TEXT|Command with arguments|`TBD`| +|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`| +|TBD|state|TEXT|Container state (created, restarting, running, removing, paused, exited, dead)|`TBD`| +|TBD|status|TEXT|Container status information|`TBD`| +|TBD|pid|BIGINT|Identifier of the initial process|`TBD`| +|TBD|path|TEXT|Container path|`TBD`| +|TBD|config_entrypoint|TEXT|Container entrypoint(s)|`TBD`| +|TBD|started_at|TEXT|Container start time as string|`TBD`| +|TBD|finished_at|TEXT|Container finish time as string|`TBD`| +|TBD|privileged|INTEGER|Is the container privileged|`TBD`| +|TBD|security_options|TEXT|List of container security options|`TBD`| +|TBD|env_variables|TEXT|Container environmental variables|`TBD`| +|TBD|readonly_rootfs|INTEGER|Is the root filesystem mounted as read only|`TBD`| +|TBD|cgroup_namespace|TEXT|cgroup namespace [LINUX]|`TBD`| +|TBD|ipc_namespace|TEXT|IPC namespace [LINUX]|`TBD`| +|TBD|mnt_namespace|TEXT|Mount namespace [LINUX]|`TBD`| +|TBD|net_namespace|TEXT|Network namespace [LINUX]|`TBD`| +|TBD|pid_namespace|TEXT|PID namespace [LINUX]|`TBD`| +|TBD|user_namespace|TEXT|User namespace [LINUX]|`TBD`| +|TBD|uts_namespace|TEXT|UTS namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_containers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_image_labels.md b/data_dictionaries/freebsd/osquery/events/docker_image_labels.md new file mode 100644 index 000000000..1d0cc7a94 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_image_labels.md @@ -0,0 +1,17 @@ +# Docker_image_labels Table + +## Description +Docker image labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Image ID|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_image_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_image_layers.md b/data_dictionaries/freebsd/osquery/events/docker_image_layers.md new file mode 100644 index 000000000..04a45fba7 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_image_layers.md @@ -0,0 +1,17 @@ +# Docker_image_layers Table + +## Description +Docker image layers information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Image ID|`TBD`| +|TBD|layer_id|TEXT|Layer ID|`TBD`| +|TBD|layer_order|INTEGER|Layer Order (1 = base layer)|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_image_layers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_images.md b/data_dictionaries/freebsd/osquery/events/docker_images.md new file mode 100644 index 000000000..dfd27158e --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_images.md @@ -0,0 +1,18 @@ +# Docker_images Table + +## Description +Docker images information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Image ID|`TBD`| +|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`| +|TBD|size_bytes|BIGINT|Size of image in bytes|`TBD`| +|TBD|tags|TEXT|Comma-separated list of repository tags|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_images) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_info.md b/data_dictionaries/freebsd/osquery/events/docker_info.md new file mode 100644 index 000000000..30896cd19 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_info.md @@ -0,0 +1,46 @@ +# Docker_info Table + +## Description +Docker system information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Docker system ID|`TBD`| +|TBD|containers|INTEGER|Total number of containers|`TBD`| +|TBD|containers_running|INTEGER|Number of containers currently running|`TBD`| +|TBD|containers_paused|INTEGER|Number of containers in paused state|`TBD`| +|TBD|containers_stopped|INTEGER|Number of containers in stopped state|`TBD`| +|TBD|images|INTEGER|Number of images|`TBD`| +|TBD|storage_driver|TEXT|Storage driver|`TBD`| +|TBD|memory_limit|INTEGER|1 if memory limit support is enabled. 0 otherwise|`TBD`| +|TBD|swap_limit|INTEGER|1 if swap limit support is enabled. 0 otherwise|`TBD`| +|TBD|kernel_memory|INTEGER|1 if kernel memory limit support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_cfs_period|INTEGER|1 if CPU Completely Fair Scheduler (CFS) period support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_cfs_quota|INTEGER|1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_shares|INTEGER|1 if CPU share weighting support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_set|INTEGER|1 if CPU set selection support is enabled. 0 otherwise|`TBD`| +|TBD|ipv4_forwarding|INTEGER|1 if IPv4 forwarding is enabled. 0 otherwise|`TBD`| +|TBD|bridge_nf_iptables|INTEGER|1 if bridge netfilter iptables is enabled. 0 otherwise|`TBD`| +|TBD|bridge_nf_ip6tables|INTEGER|1 if bridge netfilter ip6tables is enabled. 0 otherwise|`TBD`| +|TBD|oom_kill_disable|INTEGER|1 if Out-of-memory kill is disabled. 0 otherwise|`TBD`| +|TBD|logging_driver|TEXT|Logging driver|`TBD`| +|TBD|cgroup_driver|TEXT|Control groups driver|`TBD`| +|TBD|kernel_version|TEXT|Kernel version|`TBD`| +|TBD|os|TEXT|Operating system|`TBD`| +|TBD|os_type|TEXT|Operating system type|`TBD`| +|TBD|architecture|TEXT|Hardware architecture|`TBD`| +|TBD|cpus|INTEGER|Number of CPUs|`TBD`| +|TBD|memory|BIGINT|Total memory|`TBD`| +|TBD|http_proxy|TEXT|HTTP proxy|`TBD`| +|TBD|https_proxy|TEXT|HTTPS proxy|`TBD`| +|TBD|no_proxy|TEXT|Comma-separated list of domain extensions proxy should not be used for|`TBD`| +|TBD|name|TEXT|Name of the docker host|`TBD`| +|TBD|server_version|TEXT|Server version|`TBD`| +|TBD|root_dir|TEXT|Docker root directory|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_network_labels.md b/data_dictionaries/freebsd/osquery/events/docker_network_labels.md new file mode 100644 index 000000000..eeb318589 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_network_labels.md @@ -0,0 +1,17 @@ +# Docker_network_labels Table + +## Description +Docker network labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Network ID|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_network_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_networks.md b/data_dictionaries/freebsd/osquery/events/docker_networks.md new file mode 100644 index 000000000..dcf3f8884 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_networks.md @@ -0,0 +1,21 @@ +# Docker_networks Table + +## Description +Docker networks information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Network ID|`TBD`| +|TBD|name|TEXT|Network name|`TBD`| +|TBD|driver|TEXT|Network driver|`TBD`| +|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`| +|TBD|enable_ipv6|INTEGER|1 if IPv6 is enabled on this network. 0 otherwise|`TBD`| +|TBD|subnet|TEXT|Network subnet|`TBD`| +|TBD|gateway|TEXT|Network gateway|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_networks) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_version.md b/data_dictionaries/freebsd/osquery/events/docker_version.md new file mode 100644 index 000000000..d07a81814 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_version.md @@ -0,0 +1,23 @@ +# Docker_version Table + +## Description +Docker version information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version|TEXT|Docker version|`TBD`| +|TBD|api_version|TEXT|API version|`TBD`| +|TBD|min_api_version|TEXT|Minimum API version supported|`TBD`| +|TBD|git_commit|TEXT|Docker build git commit|`TBD`| +|TBD|go_version|TEXT|Go version|`TBD`| +|TBD|os|TEXT|Operating system|`TBD`| +|TBD|arch|TEXT|Hardware architecture|`TBD`| +|TBD|kernel_version|TEXT|Kernel version|`TBD`| +|TBD|build_time|TEXT|Build time|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_version) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_volume_labels.md b/data_dictionaries/freebsd/osquery/events/docker_volume_labels.md new file mode 100644 index 000000000..b253b7040 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_volume_labels.md @@ -0,0 +1,17 @@ +# Docker_volume_labels Table + +## Description +Docker volume labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Volume name|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_volume_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/docker_volumes.md b/data_dictionaries/freebsd/osquery/events/docker_volumes.md new file mode 100644 index 000000000..47222dd73 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/docker_volumes.md @@ -0,0 +1,18 @@ +# Docker_volumes Table + +## Description +Docker volumes information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Volume name|`TBD`| +|TBD|driver|TEXT|Volume driver|`TBD`| +|TBD|mount_point|TEXT|Mount point|`TBD`| +|TBD|type|TEXT|Volume type|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_volumes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/etc_hosts.md b/data_dictionaries/freebsd/osquery/events/etc_hosts.md new file mode 100644 index 000000000..e9d7d7b46 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/etc_hosts.md @@ -0,0 +1,16 @@ +# Etc_hosts Table + +## Description +Line-parsed /etc/hosts. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|address|TEXT|IP address mapping|`TBD`| +|TBD|hostnames|TEXT|Raw hosts mapping|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_hosts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/etc_protocols.md b/data_dictionaries/freebsd/osquery/events/etc_protocols.md new file mode 100644 index 000000000..2f64147da --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/etc_protocols.md @@ -0,0 +1,18 @@ +# Etc_protocols Table + +## Description +Line-parsed /etc/protocols. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Protocol name|`TBD`| +|TBD|number|INTEGER|Protocol number|`TBD`| +|TBD|alias|TEXT|Protocol alias|`TBD`| +|TBD|comment|TEXT|Comment with protocol description|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_protocols) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/etc_services.md b/data_dictionaries/freebsd/osquery/events/etc_services.md new file mode 100644 index 000000000..07d2dc4d7 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/etc_services.md @@ -0,0 +1,19 @@ +# Etc_services Table + +## Description +Line-parsed /etc/services. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Service name|`TBD`| +|TBD|port|INTEGER|Service port number|`TBD`| +|TBD|protocol|TEXT|Transport protocol (TCP/UDP)|`TBD`| +|TBD|aliases|TEXT|Optional space separated list of other names for a service|`TBD`| +|TBD|comment|TEXT|Optional comment for a service.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_services) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/example.md b/data_dictionaries/freebsd/osquery/events/example.md new file mode 100644 index 000000000..4c7554cd9 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/example.md @@ -0,0 +1,20 @@ +# Example Table + +## Description +This is an example table spec. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Description for name column|`TBD`| +|TBD|points|INTEGER|This is a signed SQLite int column|`TBD`| +|TBD|size|BIGINT|This is a signed SQLite bigint column|`TBD`| +|TBD|action|TEXT|Action performed in generation|`TBD`| +|TBD|id|INTEGER|An index of some sort|`TBD`| +|TBD|path|TEXT|Path of example|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#example) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/fbsd_kmods.md b/data_dictionaries/freebsd/osquery/events/fbsd_kmods.md new file mode 100644 index 000000000..173ebf54c --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/fbsd_kmods.md @@ -0,0 +1,18 @@ +# Fbsd_kmods Table + +## Description +Loaded FreeBSD kernel modules. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Module name|`TBD`| +|TBD|size|INTEGER|Size of module content|`TBD`| +|TBD|refs|INTEGER|Module reverse dependencies|`TBD`| +|TBD|address|TEXT|Kernel module address|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#fbsd_kmods) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/file.md b/data_dictionaries/freebsd/osquery/events/file.md new file mode 100644 index 000000000..e17c3785f --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/file.md @@ -0,0 +1,31 @@ +# File Table + +## Description +Interactive filesystem attributes and metadata. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|file_path|path|TEXT|Absolute file path|`file_directory`| +|TBD|directory|TEXT|Directory of file(s)|`TBD`| +|file_name|filename|TEXT|Name portion of file path|`TBD`| +|file_inode|inode|BIGINT|Filesystem inode number|`TBD`| +|user_uid|uid|BIGINT|Owning user ID|`TBD`| +|user_gid|gid|BIGINT|Owning group ID|`TBD`| +|user_permissions|mode|TEXT|Permission bits|`TBD`| +|device_id|device|BIGINT|Device ID (optional)|`TBD`| +|file_size|size|BIGINT|Size of file in bytes|`TBD`| +|file_system_block_size|block_size|INTEGER|Block size of filesystem|`TBD`| +|date_last_access|atime|BIGINT|Last access time|`TBD`| +|date_last_modification|mtime|BIGINT|Last modification time|`TBD`| +|date_last_status_change|ctime|BIGINT|Last status change time|`TBD`| +|date_creation_time|btime|BIGINT|(B)irth or (cr)eate time|`TBD`| +|file_hard_links|hard_links|INTEGER|Number of hard links|`TBD`| +|file_symlink|symlink|INTEGER|1 if the path is a symlink, otherwise 0|`TBD`| +|file_type|type|TEXT|File status|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#file) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/firefox_addons.md b/data_dictionaries/freebsd/osquery/events/firefox_addons.md new file mode 100644 index 000000000..e84713206 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/firefox_addons.md @@ -0,0 +1,26 @@ +# Firefox_addons Table + +## Description +Firefox browser extensions, webapps, and addons. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the addon|`TBD`| +|TBD|name|TEXT|Addon display name|`TBD`| +|TBD|identifier|TEXT|Addon identifier|`TBD`| +|TBD|creator|TEXT|Addon-supported creator string|`TBD`| +|TBD|type|TEXT|Extension, addon, webapp|`TBD`| +|TBD|version|TEXT|Addon-supplied version string|`TBD`| +|TBD|description|TEXT|Addon-supplied description string|`TBD`| +|TBD|source_url|TEXT|URL that installed the addon|`TBD`| +|TBD|visible|INTEGER|1 If the addon is shown in browser else 0|`TBD`| +|TBD|active|INTEGER|1 If the addon is active else 0|`TBD`| +|TBD|location|TEXT|Global, profile location|`TBD`| +|TBD|path|TEXT|Path to plugin bundle|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#firefox_addons) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/groups.md b/data_dictionaries/freebsd/osquery/events/groups.md new file mode 100644 index 000000000..7f3d58f79 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/groups.md @@ -0,0 +1,20 @@ +# Groups Table + +## Description +Local system groups. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|gid|BIGINT|Unsigned int64 group ID|`TBD`| +|TBD|gid_signed|BIGINT|A signed int64 version of gid|`TBD`| +|TBD|groupname|TEXT|Canonical local group name|`TBD`| +|TBD|group_sid|TEXT|Unique group ID [WINDOWS]|`TBD`| +|TBD|comment|TEXT|Remarks or comments associated with the group [WINDOWS]|`TBD`| +|TBD|is_hidden|INTEGER|IsHidden attribute set in OpenDirectory [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#groups) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/hash.md b/data_dictionaries/freebsd/osquery/events/hash.md new file mode 100644 index 000000000..75df7954d --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/hash.md @@ -0,0 +1,20 @@ +# Hash Table + +## Description +Filesystem hash data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Must provide a path or directory|`TBD`| +|TBD|directory|TEXT|Must provide a path or directory|`TBD`| +|TBD|md5|TEXT|MD5 hash of provided filesystem data|`TBD`| +|TBD|sha1|TEXT|SHA1 hash of provided filesystem data|`TBD`| +|TBD|sha256|TEXT|SHA256 hash of provided filesystem data|`TBD`| +|TBD|ssdeep|TEXT|ssdeep hash of provided filesystem data [POSIX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#hash) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/hvci_status.md b/data_dictionaries/freebsd/osquery/events/hvci_status.md new file mode 100644 index 000000000..37f762ef8 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/hvci_status.md @@ -0,0 +1,19 @@ +# Hvci_status Table + +## Description +Retrieve HVCI info of the machine. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version|TEXT|The version number of the Device Guard build.|`TBD`| +|TBD|instance_identifier|TEXT|The instance ID of Device Guard.|`TBD`| +|TBD|vbs_status|TEXT|The status of the virtualization based security settings. Returns UNKNOWN if an error is encountered.|`TBD`| +|TBD|code_integrity_policy_enforcement_status|TEXT|The status of the code integrity policy enforcement settings. Returns UNKNOWN if an error is encountered.|`TBD`| +|TBD|umci_policy_status|TEXT|The status of the User Mode Code Integrity security settings. Returns UNKNOWN if an error is encountered.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#hvci_status) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/interface_addresses.md b/data_dictionaries/freebsd/osquery/events/interface_addresses.md new file mode 100644 index 000000000..195a93f94 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/interface_addresses.md @@ -0,0 +1,21 @@ +# Interface_addresses Table + +## Description +Network interfaces and relevant metadata. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|address|TEXT|Specific address for interface|`TBD`| +|TBD|mask|TEXT|Interface netmask|`TBD`| +|TBD|broadcast|TEXT|Broadcast address for the interface|`TBD`| +|TBD|point_to_point|TEXT|PtP address for the interface|`TBD`| +|TBD|type|TEXT|Type of address. One of dhcp, manual, auto, other, unknown|`TBD`| +|TBD|friendly_name|TEXT|The friendly display name of the interface. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_addresses) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/interface_details.md b/data_dictionaries/freebsd/osquery/events/interface_details.md new file mode 100644 index 000000000..48f42856b --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/interface_details.md @@ -0,0 +1,49 @@ +# Interface_details Table + +## Description +Detailed information and stats of network interfaces. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|mac|TEXT|MAC of interface (optional)|`TBD`| +|TBD|type|INTEGER|Interface type (includes virtual)|`TBD`| +|TBD|mtu|INTEGER|Network MTU|`TBD`| +|TBD|metric|INTEGER|Metric based on the speed of the interface|`TBD`| +|TBD|flags|INTEGER|Flags (netdevice) for the device|`TBD`| +|TBD|ipackets|BIGINT|Input packets|`TBD`| +|TBD|opackets|BIGINT|Output packets|`TBD`| +|TBD|ibytes|BIGINT|Input bytes|`TBD`| +|TBD|obytes|BIGINT|Output bytes|`TBD`| +|TBD|ierrors|BIGINT|Input errors|`TBD`| +|TBD|oerrors|BIGINT|Output errors|`TBD`| +|TBD|idrops|BIGINT|Input drops|`TBD`| +|TBD|odrops|BIGINT|Output drops|`TBD`| +|TBD|collisions|BIGINT|Packet Collisions detected|`TBD`| +|TBD|last_change|BIGINT|Time of last device modification (optional)|`TBD`| +|TBD|link_speed|BIGINT|Interface speed in Mb/s [POSIX]|`TBD`| +|TBD|pci_slot|TEXT|PCI slot number [LINUX]|`TBD`| +|TBD|friendly_name|TEXT|The friendly display name of the interface. [WINDOWS]|`TBD`| +|TBD|description|TEXT|Short description of the object a one-line string. [WINDOWS]|`TBD`| +|TBD|manufacturer|TEXT|Name of the network adapter's manufacturer. [WINDOWS]|`TBD`| +|TBD|connection_id|TEXT|Name of the network connection as it appears in the Network Connections Control Panel program. [WINDOWS]|`TBD`| +|TBD|connection_status|TEXT|State of the network adapter connection to the network. [WINDOWS]|`TBD`| +|TBD|enabled|INTEGER|Indicates whether the adapter is enabled or not. [WINDOWS]|`TBD`| +|TBD|physical_adapter|INTEGER|Indicates whether the adapter is a physical or a logical adapter. [WINDOWS]|`TBD`| +|TBD|speed|INTEGER|Estimate of the current bandwidth in bits per second. [WINDOWS]|`TBD`| +|TBD|service|TEXT|The name of the service the network adapter uses. [WINDOWS]|`TBD`| +|TBD|dhcp_enabled|INTEGER|If TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection. [WINDOWS]|`TBD`| +|TBD|dhcp_lease_expires|TEXT|Expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dhcp_lease_obtained|TEXT|Date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dhcp_server|TEXT|IP address of the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dns_domain|TEXT|Organization name followed by a period and an extension that indicates the type of organization, such as 'microsoft.com'. [WINDOWS]|`TBD`| +|TBD|dns_domain_suffix_search_order|TEXT|Array of DNS domain suffixes to be appended to the end of host names during name resolution. [WINDOWS]|`TBD`| +|TBD|dns_host_name|TEXT|Host name used to identify the local computer for authentication by some utilities. [WINDOWS]|`TBD`| +|TBD|dns_server_search_order|TEXT|Array of server IP addresses to be used in querying for DNS servers. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_details) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/interface_ipv6.md b/data_dictionaries/freebsd/osquery/events/interface_ipv6.md new file mode 100644 index 000000000..17e5dc4a0 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/interface_ipv6.md @@ -0,0 +1,19 @@ +# Interface_ipv6 Table + +## Description +IPv6 configuration and stats of network interfaces. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|hop_limit|INTEGER|Current Hop Limit|`TBD`| +|TBD|forwarding_enabled|INTEGER|Enable IP forwarding|`TBD`| +|TBD|redirect_accept|INTEGER|Accept ICMP redirect messages|`TBD`| +|TBD|rtadv_accept|INTEGER|Accept ICMP Router Advertisement|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_ipv6) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/known_hosts.md b/data_dictionaries/freebsd/osquery/events/known_hosts.md new file mode 100644 index 000000000..3500f22c0 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/known_hosts.md @@ -0,0 +1,17 @@ +# Known_hosts Table + +## Description +A line-delimited known_hosts table. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the known_hosts file|`TBD`| +|TBD|key|TEXT|parsed authorized keys line|`TBD`| +|TBD|key_file|TEXT|Path to known_hosts file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#known_hosts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/last.md b/data_dictionaries/freebsd/osquery/events/last.md new file mode 100644 index 000000000..ab8d94bcf --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/last.md @@ -0,0 +1,20 @@ +# Last Table + +## Description +System logins and logouts. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|username|TEXT|Entry username|`TBD`| +|TBD|tty|TEXT|Entry terminal|`TBD`| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|type|INTEGER|Entry type, according to ut_type types (utmp.h)|`TBD`| +|TBD|time|INTEGER|Entry timestamp|`TBD`| +|TBD|host|TEXT|Entry hostname|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#last) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/listening_ports.md b/data_dictionaries/freebsd/osquery/events/listening_ports.md new file mode 100644 index 000000000..2d8444045 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/listening_ports.md @@ -0,0 +1,23 @@ +# Listening_ports Table + +## Description +Processes with listening (bound) network sockets/ports. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|port|INTEGER|Transport layer port|`TBD`| +|TBD|protocol|INTEGER|Transport protocol (TCP/UDP)|`TBD`| +|TBD|family|INTEGER|Network protocol (IPv4, IPv6)|`TBD`| +|TBD|address|TEXT|Specific address for bind|`TBD`| +|TBD|fd|BIGINT|Socket file descriptor number|`TBD`| +|TBD|socket|BIGINT|Socket handle or inode number|`TBD`| +|TBD|path|TEXT|Path for UNIX domain sockets|`TBD`| +|TBD|net_namespace|TEXT|The inode number of the network namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#listening_ports) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/lldp_neighbors.md b/data_dictionaries/freebsd/osquery/events/lldp_neighbors.md new file mode 100644 index 000000000..a0e8405bb --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/lldp_neighbors.md @@ -0,0 +1,83 @@ +# Lldp_neighbors Table + +## Description +LLDP neighbors of interfaces. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|rid|INTEGER|Neighbor chassis index|`TBD`| +|TBD|chassis_id_type|TEXT|Neighbor chassis ID type|`TBD`| +|TBD|chassis_id|TEXT|Neighbor chassis ID value|`TBD`| +|TBD|chassis_sysname|TEXT|CPU brand string, contains vendor and model|`TBD`| +|TBD|chassis_sys_description|INTEGER|Max number of CPU physical cores|`TBD`| +|TBD|chassis_bridge_capability_available|INTEGER|Chassis bridge capability availability|`TBD`| +|TBD|chassis_bridge_capability_enabled|INTEGER|Is chassis bridge capability enabled.|`TBD`| +|TBD|chassis_router_capability_available|INTEGER|Chassis router capability availability|`TBD`| +|TBD|chassis_router_capability_enabled|INTEGER|Chassis router capability enabled|`TBD`| +|TBD|chassis_repeater_capability_available|INTEGER|Chassis repeater capability availability|`TBD`| +|TBD|chassis_repeater_capability_enabled|INTEGER|Chassis repeater capability enabled|`TBD`| +|TBD|chassis_wlan_capability_available|INTEGER|Chassis wlan capability availability|`TBD`| +|TBD|chassis_wlan_capability_enabled|INTEGER|Chassis wlan capability enabled|`TBD`| +|TBD|chassis_tel_capability_available|INTEGER|Chassis telephone capability availability|`TBD`| +|TBD|chassis_tel_capability_enabled|INTEGER|Chassis telephone capability enabled|`TBD`| +|TBD|chassis_docsis_capability_available|INTEGER|Chassis DOCSIS capability availability|`TBD`| +|TBD|chassis_docsis_capability_enabled|INTEGER|Chassis DOCSIS capability enabled|`TBD`| +|TBD|chassis_station_capability_available|INTEGER|Chassis station capability availability|`TBD`| +|TBD|chassis_station_capability_enabled|INTEGER|Chassis station capability enabled|`TBD`| +|TBD|chassis_other_capability_available|INTEGER|Chassis other capability availability|`TBD`| +|TBD|chassis_other_capability_enabled|INTEGER|Chassis other capability enabled|`TBD`| +|TBD|chassis_mgmt_ips|TEXT|Comma delimited list of chassis management IPS|`TBD`| +|TBD|port_id_type|TEXT|Port ID type|`TBD`| +|TBD|port_id|TEXT|Port ID value|`TBD`| +|TBD|port_description|TEXT|Port description|`TBD`| +|TBD|port_ttl|BIGINT|Age of neighbor port|`TBD`| +|TBD|port_mfs|BIGINT|Port max frame size|`TBD`| +|TBD|port_aggregation_id|TEXT|Port aggregation ID|`TBD`| +|TBD|port_autoneg_supported|INTEGER|Auto negotiation supported|`TBD`| +|TBD|port_autoneg_enabled|INTEGER|Is auto negotiation enabled|`TBD`| +|TBD|port_mau_type|TEXT|MAU type|`TBD`| +|TBD|port_autoneg_10baset_hd_enabled|INTEGER|10Base-T HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_10baset_fd_enabled|INTEGER|10Base-T FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100basetx_hd_enabled|INTEGER|100Base-TX HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100basetx_fd_enabled|INTEGER|100Base-TX FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset2_hd_enabled|INTEGER|100Base-T2 HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset2_fd_enabled|INTEGER|100Base-T2 FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset4_hd_enabled|INTEGER|100Base-T4 HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset4_fd_enabled|INTEGER|100Base-T4 FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000basex_hd_enabled|INTEGER|1000Base-X HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000basex_fd_enabled|INTEGER|1000Base-X FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000baset_hd_enabled|INTEGER|1000Base-T HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000baset_fd_enabled|INTEGER|1000Base-T FD auto negotiation enabled|`TBD`| +|TBD|power_device_type|TEXT|Dot3 power device type|`TBD`| +|TBD|power_mdi_supported|INTEGER|MDI power supported|`TBD`| +|TBD|power_mdi_enabled|INTEGER|Is MDI power enabled|`TBD`| +|TBD|power_paircontrol_enabled|INTEGER|Is power pair control enabled|`TBD`| +|TBD|power_pairs|TEXT|Dot3 power pairs|`TBD`| +|TBD|power_class|TEXT|Power class|`TBD`| +|TBD|power_8023at_enabled|INTEGER|Is 802.3at enabled|`TBD`| +|TBD|power_8023at_power_type|TEXT|802.3at power type|`TBD`| +|TBD|power_8023at_power_source|TEXT|802.3at power source|`TBD`| +|TBD|power_8023at_power_priority|TEXT|802.3at power priority|`TBD`| +|TBD|power_8023at_power_allocated|TEXT|802.3at power allocated|`TBD`| +|TBD|power_8023at_power_requested|TEXT|802.3at power requested|`TBD`| +|TBD|med_device_type|TEXT|Chassis MED type|`TBD`| +|TBD|med_capability_capabilities|INTEGER|Is MED capabilities enabled|`TBD`| +|TBD|med_capability_policy|INTEGER|Is MED policy capability enabled|`TBD`| +|TBD|med_capability_location|INTEGER|Is MED location capability enabled|`TBD`| +|TBD|med_capability_mdi_pse|INTEGER|Is MED MDI PSE capability enabled|`TBD`| +|TBD|med_capability_mdi_pd|INTEGER|Is MED MDI PD capability enabled|`TBD`| +|TBD|med_capability_inventory|INTEGER|Is MED inventory capability enabled|`TBD`| +|TBD|med_policies|TEXT|Comma delimited list of MED policies|`TBD`| +|TBD|vlans|TEXT|Comma delimited list of vlan ids|`TBD`| +|TBD|pvid|TEXT|Primary VLAN id|`TBD`| +|TBD|ppvids_supported|TEXT|Comma delimited list of supported PPVIDs|`TBD`| +|TBD|ppvids_enabled|TEXT|Comma delimited list of enabled PPVIDs|`TBD`| +|TBD|pids|TEXT|Comma delimited list of PIDs|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#lldp_neighbors) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/load_average.md b/data_dictionaries/freebsd/osquery/events/load_average.md new file mode 100644 index 000000000..f5aaa4ad1 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/load_average.md @@ -0,0 +1,16 @@ +# Load_average Table + +## Description +Displays information about the system wide load averages. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|period|TEXT|Period over which the average is calculated.|`TBD`| +|TBD|average|TEXT|Load average over the specified period.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#load_average) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/logged_in_users.md b/data_dictionaries/freebsd/osquery/events/logged_in_users.md new file mode 100644 index 000000000..4a6a32b34 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/logged_in_users.md @@ -0,0 +1,22 @@ +# Logged_in_users Table + +## Description +Users with an active shell on the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|Login type|`TBD`| +|TBD|user|TEXT|User login name|`TBD`| +|TBD|tty|TEXT|Device name|`TBD`| +|TBD|host|TEXT|Remote hostname|`TBD`| +|TBD|time|INTEGER|Time entry was made|`TBD`| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|sid|TEXT|The user's unique security identifier [WINDOWS]|`TBD`| +|TBD|registry_hive|TEXT|HKEY_USERS registry hive [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#logged_in_users) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/magic.md b/data_dictionaries/freebsd/osquery/events/magic.md new file mode 100644 index 000000000..5c0be36a8 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/magic.md @@ -0,0 +1,19 @@ +# Magic Table + +## Description +Magic number recognition library table. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Absolute path to target file|`TBD`| +|TBD|magic_db_files|TEXT|Colon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgc|`TBD`| +|TBD|data|TEXT|Magic number data from libmagic|`TBD`| +|TBD|mime_type|TEXT|MIME type data from libmagic|`TBD`| +|TBD|mime_encoding|TEXT|MIME encoding data from libmagic|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#magic) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/mounts.md b/data_dictionaries/freebsd/osquery/events/mounts.md new file mode 100644 index 000000000..6d0f2a622 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/mounts.md @@ -0,0 +1,25 @@ +# Mounts Table + +## Description +System mounted devices and filesystems (not process specific). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Mounted device|`TBD`| +|TBD|device_alias|TEXT|Mounted device alias|`TBD`| +|TBD|path|TEXT|Mounted device path|`TBD`| +|TBD|type|TEXT|Mounted device type|`TBD`| +|TBD|blocks_size|BIGINT|Block size in bytes|`TBD`| +|TBD|blocks|BIGINT|Mounted device used blocks|`TBD`| +|TBD|blocks_free|BIGINT|Mounted device free blocks|`TBD`| +|TBD|blocks_available|BIGINT|Mounted device available blocks|`TBD`| +|TBD|inodes|BIGINT|Mounted device used inodes|`TBD`| +|TBD|inodes_free|BIGINT|Mounted device free inodes|`TBD`| +|TBD|flags|TEXT|Mounted device flags|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#mounts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/opera_extensions.md b/data_dictionaries/freebsd/osquery/events/opera_extensions.md new file mode 100644 index 000000000..7a3888d19 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/opera_extensions.md @@ -0,0 +1,23 @@ +# Opera_extensions Table + +## Description +Opera browser extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the extension|`TBD`| +|TBD|name|TEXT|Extension display name|`TBD`| +|TBD|identifier|TEXT|Extension identifier|`TBD`| +|TBD|version|TEXT|Extension-supplied version|`TBD`| +|TBD|description|TEXT|Extension-optional description|`TBD`| +|TBD|locale|TEXT|Default locale supported by extension|`TBD`| +|TBD|update_url|TEXT|Extension-supplied update URI|`TBD`| +|TBD|author|TEXT|Optional extension author|`TBD`| +|TBD|path|TEXT|Path to extension folder|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#opera_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/os_version.md b/data_dictionaries/freebsd/osquery/events/os_version.md new file mode 100644 index 000000000..0f7d5cd88 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/os_version.md @@ -0,0 +1,24 @@ +# Os_version Table + +## Description +A single row containing the operating system name and version. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Distribution or product name|`TBD`| +|TBD|version|TEXT|Pretty, suitable for presentation, OS version|`TBD`| +|TBD|major|INTEGER|Major release version|`TBD`| +|TBD|minor|INTEGER|Minor release version|`TBD`| +|TBD|patch|INTEGER|Optional patch release|`TBD`| +|TBD|build|TEXT|Optional build-specific or variant string|`TBD`| +|TBD|platform|TEXT|OS Platform or ID|`TBD`| +|TBD|platform_like|TEXT|Closely related platforms|`TBD`| +|TBD|codename|TEXT|OS version codename|`TBD`| +|TBD|install_date|TEXT|The install date of the OS. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#os_version) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/osquery_events.md b/data_dictionaries/freebsd/osquery/events/osquery_events.md new file mode 100644 index 000000000..8f658b32f --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/osquery_events.md @@ -0,0 +1,18 @@ +# Osquery_events Table + +## Description +Information about the event publishers and subscribers. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Event publisher or subscriber name|`TBD`| +|TBD|publisher|TEXT|Name of the associated publisher|`TBD`| +|TBD|type|TEXT|Either publisher or subscriber|`TBD`| +|TBD|refreshes|INTEGER|Publisher only: number of runloop restarts|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/osquery_extensions.md b/data_dictionaries/freebsd/osquery/events/osquery_extensions.md new file mode 100644 index 000000000..2052c8dec --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/osquery_extensions.md @@ -0,0 +1,20 @@ +# Osquery_extensions Table + +## Description +List of active osquery extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uuid|BIGINT|The transient ID assigned for communication|`TBD`| +|TBD|name|TEXT|Extension's name|`TBD`| +|TBD|version|TEXT|Extension's version|`TBD`| +|TBD|sdk_version|TEXT|osquery SDK version used to build the extension|`TBD`| +|TBD|path|TEXT|Path of the extenion's domain socket or library path|`TBD`| +|TBD|type|TEXT|SDK extension type: extension or module|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/osquery_flags.md b/data_dictionaries/freebsd/osquery/events/osquery_flags.md new file mode 100644 index 000000000..ac0ec4a46 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/osquery_flags.md @@ -0,0 +1,20 @@ +# Osquery_flags Table + +## Description +Configurable flags that modify osquery's behavior. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Flag name|`TBD`| +|TBD|type|TEXT|Flag type|`TBD`| +|TBD|description|TEXT|Flag description|`TBD`| +|TBD|default_value|TEXT|Flag default value|`TBD`| +|TBD|value|TEXT|Flag value|`TBD`| +|TBD|shell_only|INTEGER|Is the flag shell only?|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_flags) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/osquery_info.md b/data_dictionaries/freebsd/osquery/events/osquery_info.md new file mode 100644 index 000000000..823c21bfc --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/osquery_info.md @@ -0,0 +1,26 @@ +# Osquery_info Table + +## Description +Top level information about the running version of osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread/handle) ID|`TBD`| +|TBD|uuid|TEXT|Unique ID provided by the system|`TBD`| +|TBD|instance_id|TEXT|Unique, long-lived ID per instance of osquery|`TBD`| +|TBD|version|TEXT|osquery toolkit version|`TBD`| +|TBD|config_hash|TEXT|Hash of the working configuration state|`TBD`| +|TBD|config_valid|INTEGER|1 if the config was loaded and considered valid, else 0|`TBD`| +|TBD|extensions|TEXT|osquery extensions status|`TBD`| +|TBD|build_platform|TEXT|osquery toolkit build platform|`TBD`| +|TBD|build_distro|TEXT|osquery toolkit platform distribution name (os version)|`TBD`| +|TBD|start_time|INTEGER|UNIX time in seconds when the process started|`TBD`| +|TBD|watcher|INTEGER|Process (or thread/handle) ID of optional watcher process|`TBD`| +|TBD|platform_mask|INTEGER|The osquery platform bitmask|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/osquery_packs.md b/data_dictionaries/freebsd/osquery/events/osquery_packs.md new file mode 100644 index 000000000..ac1c811f3 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/osquery_packs.md @@ -0,0 +1,21 @@ +# Osquery_packs Table + +## Description +Information about the current query packs that are loaded in osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The given name for this query pack|`TBD`| +|TBD|platform|TEXT|Platforms this query is supported on|`TBD`| +|TBD|version|TEXT|Minimum osquery version that this query will run on|`TBD`| +|TBD|shard|INTEGER|Shard restriction limit, 1-100, 0 meaning no restriction|`TBD`| +|TBD|discovery_cache_hits|INTEGER|The number of times that the discovery query used cached values since the last time the config was reloaded|`TBD`| +|TBD|discovery_executions|INTEGER|The number of times that the discovery queries have been executed since the last time the config was reloaded|`TBD`| +|TBD|active|INTEGER|Whether this pack is active (the version, platform and discovery queries match) yes=1, no=0.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_packs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/osquery_registry.md b/data_dictionaries/freebsd/osquery/events/osquery_registry.md new file mode 100644 index 000000000..7d1432b37 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/osquery_registry.md @@ -0,0 +1,19 @@ +# Osquery_registry Table + +## Description +List the osquery registry plugins. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|registry|TEXT|Name of the osquery registry|`TBD`| +|TBD|name|TEXT|Name of the plugin item|`TBD`| +|TBD|owner_uuid|INTEGER|Extension route UUID (0 for core)|`TBD`| +|TBD|internal|INTEGER|1 If the plugin is internal else 0|`TBD`| +|TBD|active|INTEGER|1 If this plugin is active else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_registry) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/osquery_schedule.md b/data_dictionaries/freebsd/osquery/events/osquery_schedule.md new file mode 100644 index 000000000..f63371227 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/osquery_schedule.md @@ -0,0 +1,21 @@ +# Osquery_schedule Table + +## Description +Information about the current queries that are scheduled in osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The given name for this query|`TBD`| +|TBD|query|TEXT|The exact query to run|`TBD`| +|TBD|executions|BIGINT|Number of times the query was executed|`TBD`| +|TBD|blacklisted|INTEGER|1 if the query is blacklisted else 0|`TBD`| +|TBD|wall_time|BIGINT|Total wall time spent executing|`TBD`| +|TBD|user_time|BIGINT|Total user time spent executing|`TBD`| +|TBD|system_time|BIGINT|Total system time spent executing|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_schedule) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/pkg_packages.md b/data_dictionaries/freebsd/osquery/events/pkg_packages.md new file mode 100644 index 000000000..b66ef8ab4 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/pkg_packages.md @@ -0,0 +1,18 @@ +# Pkg_packages Table + +## Description +pkgng packages that are currently installed on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package name|`TBD`| +|TBD|version|TEXT|Package version|`TBD`| +|TBD|flatsize|BIGINT|Package size in bytes|`TBD`| +|TBD|arch|TEXT|Architecture(s) supported|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#pkg_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/platform_info.md b/data_dictionaries/freebsd/osquery/events/platform_info.md new file mode 100644 index 000000000..ee430f192 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/platform_info.md @@ -0,0 +1,22 @@ +# Platform_info Table + +## Description +Information about EFI/UEFI/ROM and platform/boot. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|vendor|TEXT|Platform code vendor|`TBD`| +|TBD|version|TEXT|Platform code version|`TBD`| +|TBD|date|TEXT|Self-reported platform code update date|`TBD`| +|TBD|revision|TEXT|BIOS major and minor revision|`TBD`| +|TBD|address|TEXT|Relative address of firmware mapping|`TBD`| +|TBD|size|TEXT|Size in bytes of firmware|`TBD`| +|TBD|volume_size|INTEGER|(Optional) size of firmware volume|`TBD`| +|TBD|extra|TEXT|Platform-specific additional information|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#platform_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/process_envs.md b/data_dictionaries/freebsd/osquery/events/process_envs.md new file mode 100644 index 000000000..2cdc24e28 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/process_envs.md @@ -0,0 +1,17 @@ +# Process_envs Table + +## Description +A key/value table of environment variables for each process. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|key|TEXT|Environment variable name|`TBD`| +|TBD|value|TEXT|Environment variable value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_envs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/process_events.md b/data_dictionaries/freebsd/osquery/events/process_events.md new file mode 100644 index 000000000..95a38e6aa --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/process_events.md @@ -0,0 +1,41 @@ +# Process_events Table + +## Description +Track time/action process executions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|path|TEXT|Path of executed file|`TBD`| +|TBD|mode|TEXT|File mode permissions|`TBD`| +|TBD|cmdline|TEXT|Command line arguments (argv)|`TBD`| +|TBD|cmdline_size|BIGINT|Actual size (bytes) of command line arguments|`TBD`| +|TBD|env|TEXT|Environment variables delimited by spaces|`TBD`| +|TBD|env_count|BIGINT|Number of environment variables|`TBD`| +|TBD|env_size|BIGINT|Actual size (bytes) of environment list|`TBD`| +|TBD|cwd|TEXT|The process current working directory|`TBD`| +|TBD|auid|BIGINT|Audit User ID at process start|`TBD`| +|TBD|uid|BIGINT|User ID at process start|`TBD`| +|TBD|euid|BIGINT|Effective user ID at process start|`TBD`| +|TBD|gid|BIGINT|Group ID at process start|`TBD`| +|TBD|egid|BIGINT|Effective group ID at process start|`TBD`| +|TBD|owner_uid|BIGINT|File owner user ID|`TBD`| +|TBD|owner_gid|BIGINT|File owner group ID|`TBD`| +|TBD|atime|BIGINT|File last access in UNIX time|`TBD`| +|TBD|mtime|BIGINT|File modification in UNIX time|`TBD`| +|TBD|ctime|BIGINT|File last metadata change in UNIX time|`TBD`| +|TBD|btime|BIGINT|File creation in UNIX time|`TBD`| +|TBD|overflows|TEXT|List of structures that overflowed|`TBD`| +|TBD|parent|BIGINT|Process parent's PID, or -1 if cannot be determined.|`TBD`| +|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`| +|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| +|TBD|status|BIGINT|OpenBSM Attribute: Status of the process [DARWIN]|`TBD`| +|TBD|syscall|TEXT|Syscall name: fork, vfork, clone, execve, execveat [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/process_memory_map.md b/data_dictionaries/freebsd/osquery/events/process_memory_map.md new file mode 100644 index 000000000..16fabc750 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/process_memory_map.md @@ -0,0 +1,23 @@ +# Process_memory_map Table + +## Description +Process memory mapped files and pseudo device/regions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|start|TEXT|Virtual start address (hex)|`TBD`| +|TBD|end|TEXT|Virtual end address (hex)|`TBD`| +|TBD|permissions|TEXT|r=read, w=write, x=execute, p=private (cow)|`TBD`| +|TBD|offset|BIGINT|Offset into mapped path|`TBD`| +|TBD|device|TEXT|MA:MI Major/minor device ID|`TBD`| +|TBD|inode|INTEGER|Mapped path inode, 0 means uninitialized (BSS)|`TBD`| +|TBD|path|TEXT|Path to mapped file or mapped type|`TBD`| +|TBD|pseudo|INTEGER|1 If path is a pseudo path, else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_memory_map) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/process_open_files.md b/data_dictionaries/freebsd/osquery/events/process_open_files.md new file mode 100644 index 000000000..7ccd4e03e --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/process_open_files.md @@ -0,0 +1,17 @@ +# Process_open_files Table + +## Description +File descriptors for each process. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|fd|BIGINT|Process-specific file descriptor number|`TBD`| +|TBD|path|TEXT|Filesystem path of descriptor|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_open_files) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/process_open_sockets.md b/data_dictionaries/freebsd/osquery/events/process_open_sockets.md new file mode 100644 index 000000000..25cedbac6 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/process_open_sockets.md @@ -0,0 +1,26 @@ +# Process_open_sockets Table + +## Description +Processes which have open network sockets on the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|fd|BIGINT|Socket file descriptor number|`TBD`| +|TBD|socket|BIGINT|Socket handle or inode number|`TBD`| +|TBD|family|INTEGER|Network protocol (IPv4, IPv6)|`TBD`| +|TBD|protocol|INTEGER|Transport protocol (TCP/UDP)|`TBD`| +|TBD|local_address|TEXT|Socket local address|`TBD`| +|TBD|remote_address|TEXT|Socket remote address|`TBD`| +|TBD|local_port|INTEGER|Socket local port|`TBD`| +|TBD|remote_port|INTEGER|Socket remote port|`TBD`| +|TBD|path|TEXT|For UNIX sockets (family=AF_UNIX), the domain path|`TBD`| +|TBD|state|TEXT|TCP socket state [lambda: LINUX() or DARWIN() or WINDOWS()]|`TBD`| +|TBD|net_namespace|TEXT|The inode number of the network namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_open_sockets) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/processes.md b/data_dictionaries/freebsd/osquery/events/processes.md new file mode 100644 index 000000000..b2f1687d7 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/processes.md @@ -0,0 +1,47 @@ +# Processes Table + +## Description +All running processes on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|name|TEXT|The process path or shorthand argv[0]|`TBD`| +|TBD|path|TEXT|Path to executed binary|`TBD`| +|TBD|cmdline|TEXT|Complete argv|`TBD`| +|TBD|state|TEXT|Process state|`TBD`| +|TBD|cwd|TEXT|Process current working directory|`TBD`| +|TBD|root|TEXT|Process virtual root directory|`TBD`| +|TBD|uid|BIGINT|Unsigned user ID|`TBD`| +|TBD|gid|BIGINT|Unsigned group ID|`TBD`| +|TBD|euid|BIGINT|Unsigned effective user ID|`TBD`| +|TBD|egid|BIGINT|Unsigned effective group ID|`TBD`| +|TBD|suid|BIGINT|Unsigned saved user ID|`TBD`| +|TBD|sgid|BIGINT|Unsigned saved group ID|`TBD`| +|TBD|wired_size|BIGINT|Bytes of unpagable memory used by process|`TBD`| +|TBD|resident_size|BIGINT|Bytes of private memory used by process|`TBD`| +|TBD|total_size|BIGINT|Total virtual memory size|`TBD`| +|TBD|user_time|BIGINT|CPU time in milliseconds spent in user space|`TBD`| +|TBD|system_time|BIGINT|CPU time in milliseconds spent in kernel space|`TBD`| +|TBD|disk_bytes_read|BIGINT|Bytes read from disk|`TBD`| +|TBD|disk_bytes_written|BIGINT|Bytes written to disk|`TBD`| +|TBD|start_time|BIGINT|Process start time in seconds since Epoch, in case of error -1|`TBD`| +|TBD|parent|BIGINT|Process parent's PID|`TBD`| +|TBD|pgroup|BIGINT|Process group|`TBD`| +|TBD|threads|INTEGER|Number of threads used by process|`TBD`| +|TBD|nice|INTEGER|Process nice level (-20 to 20, default 0)|`TBD`| +|TBD|is_elevated_token|INTEGER|Process uses elevated token yes=1, no=0 [WINDOWS]|`TBD`| +|TBD|elapsed_time|BIGINT|Elapsed time in seconds this process has been running. [WINDOWS]|`TBD`| +|TBD|handle_count|BIGINT|Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process. [WINDOWS]|`TBD`| +|TBD|percent_processor_time|BIGINT|Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks. [WINDOWS]|`TBD`| +|TBD|upid|BIGINT|A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|uppid|BIGINT|The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|cpu_type|INTEGER|A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|cpu_subtype|INTEGER|The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#processes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/prometheus_metrics.md b/data_dictionaries/freebsd/osquery/events/prometheus_metrics.md new file mode 100644 index 000000000..b709485b8 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/prometheus_metrics.md @@ -0,0 +1,18 @@ +# Prometheus_metrics Table + +## Description +Retrieve metrics from a Prometheus server. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|target_name|TEXT|Address of prometheus target|`TBD`| +|TBD|metric_name|TEXT|Name of collected Prometheus metric|`TBD`| +|TBD|metric_value|DOUBLE|Value of collected Prometheus metric|`TBD`| +|TBD|timestamp_ms|BIGINT|Unix timestamp of collected data in MS|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#prometheus_metrics) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/python_packages.md b/data_dictionaries/freebsd/osquery/events/python_packages.md new file mode 100644 index 000000000..af502ce5b --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/python_packages.md @@ -0,0 +1,21 @@ +# Python_packages Table + +## Description +Python packages installed in a system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package display name|`TBD`| +|TBD|version|TEXT|Package-supplied version|`TBD`| +|TBD|summary|TEXT|Package-supplied summary|`TBD`| +|TBD|author|TEXT|Optional package author|`TBD`| +|TBD|license|TEXT|License under which package is launched|`TBD`| +|TBD|path|TEXT|Path at which this module resides|`TBD`| +|TBD|directory|TEXT|Directory where Python modules are located|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#python_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/routes.md b/data_dictionaries/freebsd/osquery/events/routes.md new file mode 100644 index 000000000..5197fbf35 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/routes.md @@ -0,0 +1,24 @@ +# Routes Table + +## Description +The active route table for the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|destination|TEXT|Destination IP address|`TBD`| +|TBD|netmask|INTEGER|Netmask length|`TBD`| +|TBD|gateway|TEXT|Route gateway|`TBD`| +|TBD|source|TEXT|Route source|`TBD`| +|TBD|flags|INTEGER|Flags to describe route|`TBD`| +|TBD|interface|TEXT|Route local interface|`TBD`| +|TBD|mtu|INTEGER|Maximum Transmission Unit for the route|`TBD`| +|TBD|metric|INTEGER|Cost of route. Lowest is preferred|`TBD`| +|TBD|type|TEXT|Type of route|`TBD`| +|TBD|hopcount|INTEGER|Max hops expected [POSIX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#routes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/shell_history.md b/data_dictionaries/freebsd/osquery/events/shell_history.md new file mode 100644 index 000000000..6a16aabea --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/shell_history.md @@ -0,0 +1,18 @@ +# Shell_history Table + +## Description +A line-delimited (command) table of per-user .*_history data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|Shell history owner|`TBD`| +|TBD|time|INTEGER|Entry timestamp. It could be absent, default value is 0.|`TBD`| +|TBD|command|TEXT|Unparsed date/line/command history line|`TBD`| +|TBD|history_file|TEXT|Path to the .*_history for this user|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#shell_history) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/ssh_configs.md b/data_dictionaries/freebsd/osquery/events/ssh_configs.md new file mode 100644 index 000000000..66ac48247 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/ssh_configs.md @@ -0,0 +1,17 @@ +# Ssh_configs Table + +## Description +A table of parsed ssh_configs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local owner of the ssh_config file|`TBD`| +|TBD|option|TEXT|The option and value|`TBD`| +|TBD|ssh_config_file|TEXT|Path to the ssh_config file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ssh_configs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/sudoers.md b/data_dictionaries/freebsd/osquery/events/sudoers.md new file mode 100644 index 000000000..29e671554 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/sudoers.md @@ -0,0 +1,17 @@ +# Sudoers Table + +## Description +Rules for running commands as other users via sudo. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|source|TEXT|Source file containing the given rule|`TBD`| +|TBD|header|TEXT|Symbol for given rule|`TBD`| +|TBD|rule_details|TEXT|Rule definition|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#sudoers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/suid_bin.md b/data_dictionaries/freebsd/osquery/events/suid_bin.md new file mode 100644 index 000000000..f3ea944a8 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/suid_bin.md @@ -0,0 +1,18 @@ +# Suid_bin Table + +## Description +suid binaries in common locations. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Binary path|`TBD`| +|TBD|username|TEXT|Binary owner username|`TBD`| +|TBD|groupname|TEXT|Binary owner group|`TBD`| +|TBD|permissions|TEXT|Binary permissions|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#suid_bin) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/system_controls.md b/data_dictionaries/freebsd/osquery/events/system_controls.md new file mode 100644 index 000000000..e180727c0 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/system_controls.md @@ -0,0 +1,21 @@ +# System_controls Table + +## Description +sysctl names, values, and settings information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Full sysctl MIB name|`TBD`| +|TBD|oid|TEXT|Control MIB|`TBD`| +|TBD|subsystem|TEXT|Subsystem ID, control type|`TBD`| +|TBD|current_value|TEXT|Value of setting|`TBD`| +|TBD|config_value|TEXT|The MIB value set in /etc/sysctl.conf|`TBD`| +|TBD|type|TEXT|Data type|`TBD`| +|TBD|field_name|TEXT|Specific attribute of opaque type [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#system_controls) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/system_info.md b/data_dictionaries/freebsd/osquery/events/system_info.md new file mode 100644 index 000000000..482c3c621 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/system_info.md @@ -0,0 +1,29 @@ +# System_info Table + +## Description +System information for identification. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|hostname|TEXT|Network hostname including domain|`TBD`| +|TBD|uuid|TEXT|Unique ID provided by the system|`TBD`| +|TBD|cpu_type|TEXT|CPU type|`TBD`| +|TBD|cpu_subtype|TEXT|CPU subtype|`TBD`| +|TBD|cpu_brand|TEXT|CPU brand string, contains vendor and model|`TBD`| +|TBD|cpu_physical_cores|INTEGER|Number of physical CPU cores in to the system|`TBD`| +|TBD|cpu_logical_cores|INTEGER|Number of logical CPU cores available to the system|`TBD`| +|TBD|cpu_microcode|TEXT|Microcode version|`TBD`| +|TBD|physical_memory|BIGINT|Total physical memory in bytes|`TBD`| +|TBD|hardware_vendor|TEXT|Hardware or board vendor|`TBD`| +|TBD|hardware_model|TEXT|Hardware or board model|`TBD`| +|TBD|hardware_version|TEXT|Hardware or board version|`TBD`| +|TBD|hardware_serial|TEXT|Device or board serial number|`TBD`| +|TBD|computer_name|TEXT|Friendly computer name (optional)|`TBD`| +|TBD|local_hostname|TEXT|Local hostname (optional)|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#system_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/time.md b/data_dictionaries/freebsd/osquery/events/time.md new file mode 100644 index 000000000..9f9b27746 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/time.md @@ -0,0 +1,28 @@ +# Time Table + +## Description +Track current date and time in the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|weekday|TEXT|Current weekday in the system|`TBD`| +|TBD|year|INTEGER|Current year in the system|`TBD`| +|TBD|month|INTEGER|Current month in the system|`TBD`| +|TBD|day|INTEGER|Current day in the system|`TBD`| +|TBD|hour|INTEGER|Current hour in the system|`TBD`| +|TBD|minutes|INTEGER|Current minutes in the system|`TBD`| +|TBD|seconds|INTEGER|Current seconds in the system|`TBD`| +|TBD|timezone|TEXT|Current timezone in the system|`TBD`| +|TBD|local_time|INTEGER|Current local UNIX time in the system|`TBD`| +|TBD|local_timezone|TEXT|Current local timezone in the system|`TBD`| +|TBD|timestamp|TEXT|Current timestamp (log format) in the system|`TBD`| +|TBD|datetime|TEXT|Current date and time (ISO format) in the system|`TBD`| +|TBD|iso_8601|TEXT|Current time (ISO format) in the system|`TBD`| +|TBD|win_timestamp|BIGINT|Timestamp value in 100 nanosecond units. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#time) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/ulimit_info.md b/data_dictionaries/freebsd/osquery/events/ulimit_info.md new file mode 100644 index 000000000..84b753a00 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/ulimit_info.md @@ -0,0 +1,17 @@ +# Ulimit_info Table + +## Description +System resource usage limits. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|System resource to be limited|`TBD`| +|TBD|soft_limit|TEXT|Current limit value|`TBD`| +|TBD|hard_limit|TEXT|Maximum limit value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ulimit_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/uptime.md b/data_dictionaries/freebsd/osquery/events/uptime.md new file mode 100644 index 000000000..932b0c6f9 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/uptime.md @@ -0,0 +1,19 @@ +# Uptime Table + +## Description +Track time passed since last boot. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|days|INTEGER|Days of uptime|`TBD`| +|TBD|hours|INTEGER|Hours of uptime|`TBD`| +|TBD|minutes|INTEGER|Minutes of uptime|`TBD`| +|TBD|seconds|INTEGER|Seconds of uptime|`TBD`| +|TBD|total_seconds|BIGINT|Total uptime seconds|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#uptime) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/user_events.md b/data_dictionaries/freebsd/osquery/events/user_events.md new file mode 100644 index 000000000..7df9bde68 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/user_events.md @@ -0,0 +1,25 @@ +# User_events Table + +## Description +Track user events from the audit framework. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|auid|BIGINT|Audit User ID|`TBD`| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|message|TEXT|Message from the event|`TBD`| +|TBD|type|INTEGER|The file description for the process socket|`TBD`| +|TBD|path|TEXT|Supplied path from event|`TBD`| +|TBD|address|TEXT|The Internet protocol address or family ID|`TBD`| +|TBD|terminal|TEXT|The network protocol ID|`TBD`| +|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`| +|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/user_ssh_keys.md b/data_dictionaries/freebsd/osquery/events/user_ssh_keys.md new file mode 100644 index 000000000..3629444fc --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/user_ssh_keys.md @@ -0,0 +1,17 @@ +# User_ssh_keys Table + +## Description +Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the key file|`TBD`| +|TBD|path|TEXT|Path to key file|`TBD`| +|TBD|encrypted|INTEGER|1 if key is encrypted, 0 otherwise|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_ssh_keys) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/users.md b/data_dictionaries/freebsd/osquery/events/users.md new file mode 100644 index 000000000..e67c033ca --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/users.md @@ -0,0 +1,25 @@ +# Users Table + +## Description +Local user accounts (including domain accounts that have logged on locally (Windows)). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|gid|BIGINT|Group ID (unsigned)|`TBD`| +|TBD|uid_signed|BIGINT|User ID as int64 signed (Apple)|`TBD`| +|TBD|gid_signed|BIGINT|Default group ID as int64 signed (Apple)|`TBD`| +|TBD|username|TEXT|Username|`TBD`| +|TBD|description|TEXT|Optional user description|`TBD`| +|TBD|directory|TEXT|User's home directory|`TBD`| +|TBD|shell|TEXT|User's configured default shell|`TBD`| +|TBD|uuid|TEXT|User's UUID (Apple) or SID (Windows)|`TBD`| +|TBD|type|TEXT|Whether the account is roaming (domain), local, or a system profile [WINDOWS]|`TBD`| +|TBD|is_hidden|INTEGER|IsHidden attribute set in OpenDirectory [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#users) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/yara.md b/data_dictionaries/freebsd/osquery/events/yara.md new file mode 100644 index 000000000..141f9ed96 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/yara.md @@ -0,0 +1,21 @@ +# Yara Table + +## Description +Track YARA matches for files or PIDs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|The path scanned|`TBD`| +|TBD|matches|TEXT|List of YARA matches|`TBD`| +|TBD|count|INTEGER|Number of YARA matches|`TBD`| +|TBD|sig_group|TEXT|Signature group used|`TBD`| +|TBD|sigfile|TEXT|Signature file used|`TBD`| +|TBD|strings|TEXT|Matching strings|`TBD`| +|TBD|tags|TEXT|Matching tags|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#yara) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/freebsd/osquery/events/yum_sources.md b/data_dictionaries/freebsd/osquery/events/yum_sources.md new file mode 100644 index 000000000..0c8265bf4 --- /dev/null +++ b/data_dictionaries/freebsd/osquery/events/yum_sources.md @@ -0,0 +1,19 @@ +# Yum_sources Table + +## Description +Current list of Yum repositories or software channels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Repository name|`TBD`| +|TBD|baseurl|TEXT|Repository base URL|`TBD`| +|TBD|enabled|TEXT|Whether the repository is used|`TBD`| +|TBD|gpgcheck|TEXT|Whether packages are GPG checked|`TBD`| +|TBD|gpgkey|TEXT|URL to GPG key|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#yum_sources) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/README.md b/data_dictionaries/linux/osquery/README.md index 35efc9aa5..d7ae38e26 100644 --- a/data_dictionaries/linux/osquery/README.md +++ b/data_dictionaries/linux/osquery/README.md @@ -6,8 +6,146 @@ Osquery schema is defined in tables by osquery engineers. ## Sub Data Sets |events|Description|Tags| |---|---|---| -|[file](events/file.md)|Interactive filesystem attributes and metadata.|| +|[acpi_tables](events/acpi_tables.md)|Firmware ACPI functional table common metadata and content.|version_4.4.2| +|[apparmor_profiles](events/apparmor_profiles.md)|Track active AppArmor profiles.|version_4.4.2| +|[apt_sources](events/apt_sources.md)|Current list of APT repositories or software channels.|version_4.4.2| +|[arp_cache](events/arp_cache.md)|Address resolution cache, both static and dynamic (from ARP, NDP).|version_4.4.2| +|[atom_packages](events/atom_packages.md)|Lists all atom packages in a directory or globally installed in a system.|version_4.4.2| +|[augeas](events/augeas.md)|Configuration files parsed by augeas.|version_4.4.2| +|[authorized_keys](events/authorized_keys.md)|A line-delimited authorized_keys table.|version_4.4.2| +|[azure_instance_metadata](events/azure_instance_metadata.md)|Azure instance metadata.|version_4.4.2| +|[azure_instance_tags](events/azure_instance_tags.md)|Azure instance tags.|version_4.4.2| +|[block_devices](events/block_devices.md)|Block (buffered access) device file nodes: disks, ramdisks, and DMG containers.|version_4.4.2| +|[carbon_black_info](events/carbon_black_info.md)|Returns info about a Carbon Black sensor install.|version_4.4.2| +|[carves](events/carves.md)|Forensic Carves.|version_4.4.2| +|[chrome_extensions](events/chrome_extensions.md)|Chrome browser extensions.|version_4.4.2| +|[cpu_time](events/cpu_time.md)|Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.|version_4.4.2| +|[cpuid](events/cpuid.md)|Useful CPU features from the cpuid ASM call.|version_4.4.2| +|[crontab](events/crontab.md)|Line parsed values from system and user cron/tab.|version_4.4.2| +|[curl](events/curl.md)|Perform an http request and return stats about it.|version_4.4.2| +|[curl_certificate](events/curl_certificate.md)|Inspect TLS certificates by connecting to input hostnames.|version_4.4.2| +|[deb_packages](events/deb_packages.md)|The installed DEB package database.|version_4.4.2| +|[device_file](events/device_file.md)|Similar to the file table, but use TSK and allow block address access.|version_4.4.2| +|[device_hash](events/device_hash.md)|Similar to the hash table, but use TSK and allow block address access.|version_4.4.2| +|[device_partitions](events/device_partitions.md)|Use TSK to enumerate details about partitions on a disk device.|version_4.4.2| +|[disk_encryption](events/disk_encryption.md)|Disk encryption status and information.|version_4.4.2| +|[dns_resolvers](events/dns_resolvers.md)|Resolvers used by this host.|version_4.4.2| +|[docker_container_labels](events/docker_container_labels.md)|Docker container labels.|version_4.4.2| +|[docker_container_mounts](events/docker_container_mounts.md)|Docker container mounts.|version_4.4.2| +|[docker_container_networks](events/docker_container_networks.md)|Docker container networks.|version_4.4.2| +|[docker_container_ports](events/docker_container_ports.md)|Docker container ports.|version_4.4.2| +|[docker_container_processes](events/docker_container_processes.md)|Docker container processes.|version_4.4.2| +|[docker_container_stats](events/docker_container_stats.md)|Docker container statistics. Queries on this table take at least one second.|version_4.4.2| +|[docker_containers](events/docker_containers.md)|Docker containers information.|version_4.4.2| +|[docker_image_labels](events/docker_image_labels.md)|Docker image labels.|version_4.4.2| +|[docker_image_layers](events/docker_image_layers.md)|Docker image layers information.|version_4.4.2| +|[docker_images](events/docker_images.md)|Docker images information.|version_4.4.2| +|[docker_info](events/docker_info.md)|Docker system information.|version_4.4.2| +|[docker_network_labels](events/docker_network_labels.md)|Docker network labels.|version_4.4.2| +|[docker_networks](events/docker_networks.md)|Docker networks information.|version_4.4.2| +|[docker_version](events/docker_version.md)|Docker version information.|version_4.4.2| +|[docker_volume_labels](events/docker_volume_labels.md)|Docker volume labels.|version_4.4.2| +|[docker_volumes](events/docker_volumes.md)|Docker volumes information.|version_4.4.2| +|[ec2_instance_metadata](events/ec2_instance_metadata.md)|EC2 instance metadata.|version_4.4.2| +|[ec2_instance_tags](events/ec2_instance_tags.md)|EC2 instance tag key value pairs.|version_4.4.2| +|[elf_dynamic](events/elf_dynamic.md)|ELF dynamic section information.|version_4.4.2| +|[elf_info](events/elf_info.md)|ELF file information.|version_4.4.2| +|[elf_sections](events/elf_sections.md)|ELF section information.|version_4.4.2| +|[elf_segments](events/elf_segments.md)|ELF segment information.|version_4.4.2| +|[elf_symbols](events/elf_symbols.md)|ELF symbol list.|version_4.4.2| +|[etc_hosts](events/etc_hosts.md)|Line-parsed /etc/hosts.|version_4.4.2| +|[etc_protocols](events/etc_protocols.md)|Line-parsed /etc/protocols.|version_4.4.2| +|[etc_services](events/etc_services.md)|Line-parsed /etc/services.|version_4.4.2| +|[example](events/example.md)|This is an example table spec.|version_4.4.2| +|[file](events/file.md)|Interactive filesystem attributes and metadata.|version_4.4.2| +|[file_events](events/file_events.md)|Track time/action changes to files specified in configuration data.|version_4.4.2| +|[firefox_addons](events/firefox_addons.md)|Firefox browser extensions, webapps, and addons.|version_4.4.2| +|[groups](events/groups.md)|Local system groups.|version_4.4.2| +|[hardware_events](events/hardware_events.md)|Hardware (PCI/USB/HID) events from UDEV or IOKit.|version_4.4.2| +|[hash](events/hash.md)|Filesystem hash data.|version_4.4.2| +|[hvci_status](events/hvci_status.md)|Retrieve HVCI info of the machine.|version_4.4.2| +|[intel_me_info](events/intel_me_info.md)|Intel ME/CSE Info.|version_4.4.2| +|[interface_addresses](events/interface_addresses.md)|Network interfaces and relevant metadata.|version_4.4.2| +|[interface_details](events/interface_details.md)|Detailed information and stats of network interfaces.|version_4.4.2| +|[interface_ipv6](events/interface_ipv6.md)|IPv6 configuration and stats of network interfaces.|version_4.4.2| +|[iptables](events/iptables.md)|Linux IP packet filtering and NAT tool.|version_4.4.2| +|[kernel_info](events/kernel_info.md)|Basic active kernel information.|version_4.4.2| +|[kernel_modules](events/kernel_modules.md)|Linux kernel modules both loaded and within the load search path.|version_4.4.2| +|[known_hosts](events/known_hosts.md)|A line-delimited known_hosts table.|version_4.4.2| +|[last](events/last.md)|System logins and logouts.|version_4.4.2| +|[listening_ports](events/listening_ports.md)|Processes with listening (bound) network sockets/ports.|version_4.4.2| +|[lldp_neighbors](events/lldp_neighbors.md)|LLDP neighbors of interfaces.|version_4.4.2| +|[load_average](events/load_average.md)|Displays information about the system wide load averages.|version_4.4.2| +|[logged_in_users](events/logged_in_users.md)|Users with an active shell on the system.|version_4.4.2| +|[magic](events/magic.md)|Magic number recognition library table.|version_4.4.2| +|[md_devices](events/md_devices.md)|Software RAID array settings.|version_4.4.2| +|[md_drives](events/md_drives.md)|Drive devices used for Software RAID.|version_4.4.2| +|[md_personalities](events/md_personalities.md)|Software RAID setting supported by the kernel.|version_4.4.2| +|[memory_array_mapped_addresses](events/memory_array_mapped_addresses.md)|Data associated for address mapping of physical memory arrays.|version_4.4.2| +|[memory_arrays](events/memory_arrays.md)|Data associated with collection of memory devices that operate to form a memory address.|version_4.4.2| +|[memory_device_mapped_addresses](events/memory_device_mapped_addresses.md)|Data associated for address mapping of physical memory devices.|version_4.4.2| +|[memory_devices](events/memory_devices.md)|Physical memory device (type 17) information retrieved from SMBIOS.|version_4.4.2| +|[memory_error_info](events/memory_error_info.md)|Data associated with errors of a physical memory array.|version_4.4.2| +|[memory_info](events/memory_info.md)|Main memory information in bytes.|version_4.4.2| +|[memory_map](events/memory_map.md)|OS memory region map.|version_4.4.2| +|[mounts](events/mounts.md)|System mounted devices and filesystems (not process specific).|version_4.4.2| +|[msr](events/msr.md)|Various pieces of data stored in the model specific register per |version_4.4.2| +|[npm_packages](events/npm_packages.md)|Lists all npm packages in a directory or globally installed in a system.|version_4.4.2| +|[oem_strings](events/oem_strings.md)|OEM defined strings retrieved from SMBIOS.|version_4.4.2| +|[opera_extensions](events/opera_extensions.md)|Opera browser extensions.|version_4.4.2| +|[os_version](events/os_version.md)|A single row containing the operating system name and version.|version_4.4.2| +|[osquery_events](events/osquery_events.md)|Information about the event publishers and subscribers.|version_4.4.2| +|[osquery_extensions](events/osquery_extensions.md)|List of active osquery extensions.|version_4.4.2| +|[osquery_flags](events/osquery_flags.md)|Configurable flags that modify osquery's behavior.|version_4.4.2| +|[osquery_info](events/osquery_info.md)|Top level information about the running version of osquery.|version_4.4.2| +|[osquery_packs](events/osquery_packs.md)|Information about the current query packs that are loaded in osquery.|version_4.4.2| +|[osquery_registry](events/osquery_registry.md)|List the osquery registry plugins.|version_4.4.2| +|[osquery_schedule](events/osquery_schedule.md)|Information about the current queries that are scheduled in osquery.|version_4.4.2| +|[pci_devices](events/pci_devices.md)|PCI devices active on the host system.|version_4.4.2| +|[platform_info](events/platform_info.md)|Information about EFI/UEFI/ROM and platform/boot.|version_4.4.2| +|[portage_keywords](events/portage_keywords.md)|A summary about portage configurations like keywords, mask and unmask.|version_4.4.2| +|[portage_packages](events/portage_packages.md)|List of currently installed packages.|version_4.4.2| +|[portage_use](events/portage_use.md)|List of enabled portage USE values for specific package.|version_4.4.2| +|[process_envs](events/process_envs.md)|A key/value table of environment variables for each process.|version_4.4.2| +|[process_events](events/process_events.md)|Track time/action process executions.|version_4.4.2| +|[process_file_events](events/process_file_events.md)|A File Integrity Monitor implementation using the audit service.|version_4.4.2| +|[process_memory_map](events/process_memory_map.md)|Process memory mapped files and pseudo device/regions.|version_4.4.2| +|[process_namespaces](events/process_namespaces.md)|Linux namespaces for processes running on the host system.|version_4.4.2| +|[process_open_files](events/process_open_files.md)|File descriptors for each process.|version_4.4.2| +|[process_open_pipes](events/process_open_pipes.md)|Pipes and partner processes for each process.|version_4.4.2| +|[process_open_sockets](events/process_open_sockets.md)|Processes which have open network sockets on the system.|version_4.4.2| +|[processes](events/processes.md)|All running processes on the host system.|version_4.4.2| +|[prometheus_metrics](events/prometheus_metrics.md)|Retrieve metrics from a Prometheus server.|version_4.4.2| +|[python_packages](events/python_packages.md)|Python packages installed in a system.|version_4.4.2| +|[routes](events/routes.md)|The active route table for the host system.|version_4.4.2| +|[rpm_package_files](events/rpm_package_files.md)|RPM packages that are currently installed on the host system.|version_4.4.2| +|[rpm_packages](events/rpm_packages.md)|RPM packages that are currently installed on the host system.|version_4.4.2| +|[selinux_events](events/selinux_events.md)|Track SELinux events.|version_4.4.2| +|[selinux_settings](events/selinux_settings.md)|Track active SELinux settings.|version_4.4.2| +|[shadow](events/shadow.md)|Local system users encrypted passwords and related information. Please note, that you usually need superuser rights to access `/etc/shadow`.|version_4.4.2| +|[shared_memory](events/shared_memory.md)|OS shared memory regions.|version_4.4.2| +|[shell_history](events/shell_history.md)|A line-delimited (command) table of per-user .*_history data.|version_4.4.2| +|[smart_drive_info](events/smart_drive_info.md)|Drive information read by SMART controller utilizing autodetect.|version_4.4.2| +|[smbios_tables](events/smbios_tables.md)|BIOS (DMI) structure common details and content.|version_4.4.2| +|[socket_events](events/socket_events.md)|Track network socket opens and closes.|version_4.4.2| +|[ssh_configs](events/ssh_configs.md)|A table of parsed ssh_configs.|version_4.4.2| +|[sudoers](events/sudoers.md)|Rules for running commands as other users via sudo.|version_4.4.2| +|[suid_bin](events/suid_bin.md)|suid binaries in common locations.|version_4.4.2| +|[syslog_events](events/syslog_events.md)||version_4.4.2| +|[system_controls](events/system_controls.md)|sysctl names, values, and settings information.|version_4.4.2| +|[system_info](events/system_info.md)|System information for identification.|version_4.4.2| +|[time](events/time.md)|Track current date and time in the system.|version_4.4.2| +|[ulimit_info](events/ulimit_info.md)|System resource usage limits.|version_4.4.2| +|[uptime](events/uptime.md)|Track time passed since last boot.|version_4.4.2| +|[usb_devices](events/usb_devices.md)|USB devices that are actively plugged into the host system.|version_4.4.2| +|[user_events](events/user_events.md)|Track user events from the audit framework.|version_4.4.2| +|[user_groups](events/user_groups.md)|Local system user group relationships.|version_4.4.2| +|[user_ssh_keys](events/user_ssh_keys.md)|Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.|version_4.4.2| +|[users](events/users.md)|Local user accounts (including domain accounts that have logged on locally (Windows)).|version_4.4.2| +|[yara](events/yara.md)|Track YARA matches for files or PIDs.|version_4.4.2| +|[yara_events](events/yara_events.md)|Track YARA matches for files specified in configuration data.|version_4.4.2| +|[yum_sources](events/yum_sources.md)|Current list of Yum repositories or software channels.|version_4.4.2| ## References -* [osquery schema 3.2.4 (website)](https://osquery.io/schema/3.2.4) +* [osquery schema 4.1.2 (website)](https://osquery.io/schema/4.1.2) * [osquery schema linux specs (GitHub)](https://github.com/facebook/osquery/tree/master/specs/linux) \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/acpi_tables.md b/data_dictionaries/linux/osquery/events/acpi_tables.md new file mode 100644 index 000000000..7c5b960f9 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/acpi_tables.md @@ -0,0 +1,17 @@ +# Acpi_tables Table + +## Description +Firmware ACPI functional table common metadata and content. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|ACPI table name|`TBD`| +|TBD|size|INTEGER|Size of compiled table data|`TBD`| +|TBD|md5|TEXT|MD5 hash of table content|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#acpi_tables) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/apparmor_profiles.md b/data_dictionaries/linux/osquery/events/apparmor_profiles.md new file mode 100644 index 000000000..1bc2fa1bd --- /dev/null +++ b/data_dictionaries/linux/osquery/events/apparmor_profiles.md @@ -0,0 +1,19 @@ +# Apparmor_profiles Table + +## Description +Track active AppArmor profiles. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Unique, aa-status compatible, policy identifier.|`TBD`| +|TBD|name|TEXT|Policy name.|`TBD`| +|TBD|attach|TEXT|Which executable(s) a profile will attach to.|`TBD`| +|TBD|mode|TEXT|How the policy is applied.|`TBD`| +|TBD|sha1|TEXT|A unique hash that identifies this policy.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#apparmor_profiles) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/apt_sources.md b/data_dictionaries/linux/osquery/events/apt_sources.md new file mode 100644 index 000000000..47e3b3086 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/apt_sources.md @@ -0,0 +1,22 @@ +# Apt_sources Table + +## Description +Current list of APT repositories or software channels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Repository name|`TBD`| +|TBD|source|TEXT|Source file|`TBD`| +|TBD|base_uri|TEXT|Repository base URI|`TBD`| +|TBD|release|TEXT|Release name|`TBD`| +|TBD|version|TEXT|Repository source version|`TBD`| +|TBD|maintainer|TEXT|Repository maintainer|`TBD`| +|TBD|components|TEXT|Repository components|`TBD`| +|TBD|architectures|TEXT|Repository architectures|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#apt_sources) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/arp_cache.md b/data_dictionaries/linux/osquery/events/arp_cache.md new file mode 100644 index 000000000..3d2ae205d --- /dev/null +++ b/data_dictionaries/linux/osquery/events/arp_cache.md @@ -0,0 +1,18 @@ +# Arp_cache Table + +## Description +Address resolution cache, both static and dynamic (from ARP, NDP). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|address|TEXT|IPv4 address target|`TBD`| +|TBD|mac|TEXT|MAC address of broadcasted address|`TBD`| +|TBD|interface|TEXT|Interface of the network for the MAC|`TBD`| +|TBD|permanent|TEXT|1 for true, 0 for false|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#arp_cache) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/atom_packages.md b/data_dictionaries/linux/osquery/events/atom_packages.md new file mode 100644 index 000000000..6b717bddf --- /dev/null +++ b/data_dictionaries/linux/osquery/events/atom_packages.md @@ -0,0 +1,21 @@ +# Atom_packages Table + +## Description +Lists all atom packages in a directory or globally installed in a system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package display name|`TBD`| +|TBD|version|TEXT|Package supplied version|`TBD`| +|TBD|description|TEXT|Package supplied description|`TBD`| +|TBD|path|TEXT|Package's package.json path|`TBD`| +|TBD|license|TEXT|License for package|`TBD`| +|TBD|homepage|TEXT|Package supplied homepage|`TBD`| +|TBD|uid|BIGINT|The local user that owns the plugin|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#atom_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/augeas.md b/data_dictionaries/linux/osquery/events/augeas.md new file mode 100644 index 000000000..9d20c63fa --- /dev/null +++ b/data_dictionaries/linux/osquery/events/augeas.md @@ -0,0 +1,18 @@ +# Augeas Table + +## Description +Configuration files parsed by augeas. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|node|TEXT|The node path of the configuration item|`TBD`| +|TBD|value|TEXT|The value of the configuration item|`TBD`| +|TBD|label|TEXT|The label of the configuration item|`TBD`| +|TBD|path|TEXT|The path to the configuration file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#augeas) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/authorized_keys.md b/data_dictionaries/linux/osquery/events/authorized_keys.md new file mode 100644 index 000000000..a63ce1764 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/authorized_keys.md @@ -0,0 +1,17 @@ +# Authorized_keys Table + +## Description +A line-delimited authorized_keys table. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local owner of authorized_keys file|`TBD`| +|TBD|key|TEXT|parsed authorized keys line|`TBD`| +|TBD|key_file|TEXT|Path to the authorized_keys file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#authorized_keys) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/azure_instance_metadata.md b/data_dictionaries/linux/osquery/events/azure_instance_metadata.md new file mode 100644 index 000000000..a5724217d --- /dev/null +++ b/data_dictionaries/linux/osquery/events/azure_instance_metadata.md @@ -0,0 +1,30 @@ +# Azure_instance_metadata Table + +## Description +Azure instance metadata. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|location|TEXT|Azure Region the VM is running in|`TBD`| +|TBD|name|TEXT|Name of the VM|`TBD`| +|TBD|offer|TEXT|Offer information for the VM image (Azure image gallery VMs only)|`TBD`| +|TBD|publisher|TEXT|Publisher of the VM image|`TBD`| +|TBD|sku|TEXT|SKU for the VM image|`TBD`| +|TBD|version|TEXT|Version of the VM image|`TBD`| +|TBD|os_type|TEXT|Linux or Windows|`TBD`| +|TBD|platform_update_domain|TEXT|Update domain the VM is running in|`TBD`| +|TBD|platform_fault_domain|TEXT|Fault domain the VM is running in|`TBD`| +|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`| +|TBD|vm_size|TEXT|VM size|`TBD`| +|TBD|subscription_id|TEXT|Azure subscription for the VM|`TBD`| +|TBD|resource_group_name|TEXT|Resource group for the VM|`TBD`| +|TBD|placement_group_id|TEXT|Placement group for the VM scale set|`TBD`| +|TBD|vm_scale_set_name|TEXT|VM scale set name|`TBD`| +|TBD|zone|TEXT|Availability zone of the VM|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_metadata) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/azure_instance_tags.md b/data_dictionaries/linux/osquery/events/azure_instance_tags.md new file mode 100644 index 000000000..1d237a229 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/azure_instance_tags.md @@ -0,0 +1,17 @@ +# Azure_instance_tags Table + +## Description +Azure instance tags. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`| +|TBD|key|TEXT|The tag key|`TBD`| +|TBD|value|TEXT|The tag value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_tags) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/block_devices.md b/data_dictionaries/linux/osquery/events/block_devices.md new file mode 100644 index 000000000..e831c63fd --- /dev/null +++ b/data_dictionaries/linux/osquery/events/block_devices.md @@ -0,0 +1,23 @@ +# Block_devices Table + +## Description +Block (buffered access) device file nodes: disks, ramdisks, and DMG containers. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Block device name|`TBD`| +|TBD|parent|TEXT|Block device parent name|`TBD`| +|TBD|vendor|TEXT|Block device vendor string|`TBD`| +|TBD|model|TEXT|Block device model string identifier|`TBD`| +|TBD|size|BIGINT|Block device size in blocks|`TBD`| +|TBD|block_size|INTEGER|Block size in bytes|`TBD`| +|TBD|uuid|TEXT|Block device Universally Unique Identifier|`TBD`| +|TBD|type|TEXT|Block device type string|`TBD`| +|TBD|label|TEXT|Block device label string|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#block_devices) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/carbon_black_info.md b/data_dictionaries/linux/osquery/events/carbon_black_info.md new file mode 100644 index 000000000..42d8e8146 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/carbon_black_info.md @@ -0,0 +1,35 @@ +# Carbon_black_info Table + +## Description +Returns info about a Carbon Black sensor install. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|sensor_id|INTEGER|Sensor ID of the Carbon Black sensor|`TBD`| +|TBD|config_name|TEXT|Sensor group|`TBD`| +|TBD|collect_store_files|INTEGER|If the sensor is configured to send back binaries to the Carbon Black server|`TBD`| +|TBD|collect_module_loads|INTEGER|If the sensor is configured to capture module loads|`TBD`| +|TBD|collect_module_info|INTEGER|If the sensor is configured to collect metadata of binaries|`TBD`| +|TBD|collect_file_mods|INTEGER|If the sensor is configured to collect file modification events|`TBD`| +|TBD|collect_reg_mods|INTEGER|If the sensor is configured to collect registry modification events|`TBD`| +|TBD|collect_net_conns|INTEGER|If the sensor is configured to collect network connections|`TBD`| +|TBD|collect_processes|INTEGER|If the sensor is configured to process events|`TBD`| +|TBD|collect_cross_processes|INTEGER|If the sensor is configured to cross process events|`TBD`| +|TBD|collect_emet_events|INTEGER|If the sensor is configured to EMET events|`TBD`| +|TBD|collect_data_file_writes|INTEGER|If the sensor is configured to collect non binary file writes|`TBD`| +|TBD|collect_process_user_context|INTEGER|If the sensor is configured to collect the user running a process|`TBD`| +|TBD|collect_sensor_operations|INTEGER|Unknown|`TBD`| +|TBD|log_file_disk_quota_mb|INTEGER|Event file disk quota in MB|`TBD`| +|TBD|log_file_disk_quota_percentage|INTEGER|Event file disk quota in a percentage|`TBD`| +|TBD|protection_disabled|INTEGER|If the sensor is configured to report tamper events|`TBD`| +|TBD|sensor_ip_addr|TEXT|IP address of the sensor|`TBD`| +|TBD|sensor_backend_server|TEXT|Carbon Black server|`TBD`| +|TBD|event_queue|INTEGER|Size in bytes of Carbon Black event files on disk|`TBD`| +|TBD|binary_queue|INTEGER|Size in bytes of binaries waiting to be sent to Carbon Black server|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#carbon_black_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/carves.md b/data_dictionaries/linux/osquery/events/carves.md new file mode 100644 index 000000000..aaffca4bd --- /dev/null +++ b/data_dictionaries/linux/osquery/events/carves.md @@ -0,0 +1,21 @@ +# Carves Table + +## Description +Forensic Carves. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|time|BIGINT|Time at which the carve was kicked off|`TBD`| +|TBD|sha256|TEXT|A SHA256 sum of the carved archive|`TBD`| +|TBD|size|INTEGER|Size of the carved archive|`TBD`| +|TBD|path|TEXT|The path of the requested carve|`TBD`| +|TBD|status|TEXT|Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED|`TBD`| +|TBD|carve_guid|TEXT|Identifying value of the carve session|`TBD`| +|TBD|carve|INTEGER|Set this value to '1' to start a file carve|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#carves) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/chrome_extensions.md b/data_dictionaries/linux/osquery/events/chrome_extensions.md new file mode 100644 index 000000000..1446387d9 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/chrome_extensions.md @@ -0,0 +1,26 @@ +# Chrome_extensions Table + +## Description +Chrome browser extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the extension|`TBD`| +|TBD|name|TEXT|Extension display name|`TBD`| +|TBD|profile|TEXT|The Chrome profile that contains this extension|`TBD`| +|TBD|identifier|TEXT|Extension identifier|`TBD`| +|TBD|version|TEXT|Extension-supplied version|`TBD`| +|TBD|description|TEXT|Extension-optional description|`TBD`| +|TBD|locale|TEXT|Default locale supported by extension|`TBD`| +|TBD|update_url|TEXT|Extension-supplied update URI|`TBD`| +|TBD|author|TEXT|Optional extension author|`TBD`| +|TBD|path|TEXT|Path to extension folder|`TBD`| +|TBD|permissions|TEXT|The permissions required by the extension|`TBD`| +|TBD|optional_permissions|TEXT|The permissions optionally required by the extensions|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#chrome_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/cpu_time.md b/data_dictionaries/linux/osquery/events/cpu_time.md new file mode 100644 index 000000000..615e81216 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/cpu_time.md @@ -0,0 +1,25 @@ +# Cpu_time Table + +## Description +Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|core|INTEGER|Name of the cpu (core)|`TBD`| +|TBD|user|BIGINT|Time spent in user mode|`TBD`| +|TBD|nice|BIGINT|Time spent in user mode with low priority (nice)|`TBD`| +|TBD|system|BIGINT|Time spent in system mode|`TBD`| +|TBD|idle|BIGINT|Time spent in the idle task|`TBD`| +|TBD|iowait|BIGINT|Time spent waiting for I/O to complete|`TBD`| +|TBD|irq|BIGINT|Time spent servicing interrupts|`TBD`| +|TBD|softirq|BIGINT|Time spent servicing softirqs|`TBD`| +|TBD|steal|BIGINT|Time spent in other operating systems when running in a virtualized environment|`TBD`| +|TBD|guest|BIGINT|Time spent running a virtual CPU for a guest OS under the control of the Linux kernel|`TBD`| +|TBD|guest_nice|BIGINT|Time spent running a niced guest |`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#cpu_time) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/cpuid.md b/data_dictionaries/linux/osquery/events/cpuid.md new file mode 100644 index 000000000..b8e27a7f5 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/cpuid.md @@ -0,0 +1,19 @@ +# Cpuid Table + +## Description +Useful CPU features from the cpuid ASM call. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|feature|TEXT|Present feature flags|`TBD`| +|TBD|value|TEXT|Bit value or string|`TBD`| +|TBD|output_register|TEXT|Register used to for feature value|`TBD`| +|TBD|output_bit|INTEGER|Bit in register value for feature value|`TBD`| +|TBD|input_eax|TEXT|Value of EAX used|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#cpuid) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/crontab.md b/data_dictionaries/linux/osquery/events/crontab.md new file mode 100644 index 000000000..6739e030f --- /dev/null +++ b/data_dictionaries/linux/osquery/events/crontab.md @@ -0,0 +1,22 @@ +# Crontab Table + +## Description +Line parsed values from system and user cron/tab. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|event|TEXT|The job @event name (rare)|`TBD`| +|TBD|minute|TEXT|The exact minute for the job|`TBD`| +|TBD|hour|TEXT|The hour of the day for the job|`TBD`| +|TBD|day_of_month|TEXT|The day of the month for the job|`TBD`| +|TBD|month|TEXT|The month of the year for the job|`TBD`| +|TBD|day_of_week|TEXT|The day of the week for the job|`TBD`| +|TBD|command|TEXT|Raw command string|`TBD`| +|TBD|path|TEXT|File parsed|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#crontab) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/curl.md b/data_dictionaries/linux/osquery/events/curl.md new file mode 100644 index 000000000..22c52b63e --- /dev/null +++ b/data_dictionaries/linux/osquery/events/curl.md @@ -0,0 +1,21 @@ +# Curl Table + +## Description +Perform an http request and return stats about it. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|url|TEXT|The url for the request|`TBD`| +|TBD|method|TEXT|The HTTP method for the request|`TBD`| +|TBD|user_agent|TEXT|The user-agent string to use for the request|`TBD`| +|TBD|response_code|INTEGER|The HTTP status code for the response|`TBD`| +|TBD|round_trip_time|BIGINT|Time taken to complete the request|`TBD`| +|TBD|bytes|BIGINT|Number of bytes in the response|`TBD`| +|TBD|result|TEXT|The HTTP response body|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#curl) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/curl_certificate.md b/data_dictionaries/linux/osquery/events/curl_certificate.md new file mode 100644 index 000000000..19f77ef6d --- /dev/null +++ b/data_dictionaries/linux/osquery/events/curl_certificate.md @@ -0,0 +1,26 @@ +# Curl_certificate Table + +## Description +Inspect TLS certificates by connecting to input hostnames. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|hostname|TEXT|Hostname (domain[:port]) to CURL|`TBD`| +|TBD|common_name|TEXT|Common name of company issued to|`TBD`| +|TBD|organization|TEXT|Organization issued to|`TBD`| +|TBD|organization_unit|TEXT|Organization unit issued to|`TBD`| +|TBD|serial_number|TEXT|Certificate serial number|`TBD`| +|TBD|issuer_common_name|TEXT|Issuer common name|`TBD`| +|TBD|issuer_organization|TEXT|Issuer organization|`TBD`| +|TBD|issuer_organization_unit|TEXT|Issuer organization unit|`TBD`| +|TBD|valid_from|TEXT|Period of validity start date|`TBD`| +|TBD|valid_to|TEXT|Period of validity end date|`TBD`| +|TBD|sha256_fingerprint|TEXT|SHA-256 fingerprint|`TBD`| +|TBD|sha1_fingerprint|TEXT|SHA1 fingerprint|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#curl_certificate) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/deb_packages.md b/data_dictionaries/linux/osquery/events/deb_packages.md new file mode 100644 index 000000000..7f0b5f42a --- /dev/null +++ b/data_dictionaries/linux/osquery/events/deb_packages.md @@ -0,0 +1,20 @@ +# Deb_packages Table + +## Description +The installed DEB package database. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package name|`TBD`| +|TBD|version|TEXT|Package version|`TBD`| +|TBD|source|TEXT|Package source|`TBD`| +|TBD|size|BIGINT|Package size in bytes|`TBD`| +|TBD|arch|TEXT|Package architecture|`TBD`| +|TBD|revision|TEXT|Package revision|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#deb_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/device_file.md b/data_dictionaries/linux/osquery/events/device_file.md new file mode 100644 index 000000000..329e6d063 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/device_file.md @@ -0,0 +1,29 @@ +# Device_file Table + +## Description +Similar to the file table, but use TSK and allow block address access. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Absolute file path to device node|`TBD`| +|TBD|partition|TEXT|A partition number|`TBD`| +|TBD|path|TEXT|A logical path within the device node|`TBD`| +|TBD|filename|TEXT|Name portion of file path|`TBD`| +|TBD|inode|BIGINT|Filesystem inode number|`TBD`| +|TBD|uid|BIGINT|Owning user ID|`TBD`| +|TBD|gid|BIGINT|Owning group ID|`TBD`| +|TBD|mode|TEXT|Permission bits|`TBD`| +|TBD|size|BIGINT|Size of file in bytes|`TBD`| +|TBD|block_size|INTEGER|Block size of filesystem|`TBD`| +|TBD|atime|BIGINT|Last access time|`TBD`| +|TBD|mtime|BIGINT|Last modification time|`TBD`| +|TBD|ctime|BIGINT|Creation time|`TBD`| +|TBD|hard_links|INTEGER|Number of hard links|`TBD`| +|TBD|type|TEXT|File status|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#device_file) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/device_hash.md b/data_dictionaries/linux/osquery/events/device_hash.md new file mode 100644 index 000000000..2eb036856 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/device_hash.md @@ -0,0 +1,20 @@ +# Device_hash Table + +## Description +Similar to the hash table, but use TSK and allow block address access. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Absolute file path to device node|`TBD`| +|TBD|partition|TEXT|A partition number|`TBD`| +|TBD|inode|BIGINT|Filesystem inode number|`TBD`| +|TBD|md5|TEXT|MD5 hash of provided inode data|`TBD`| +|TBD|sha1|TEXT|SHA1 hash of provided inode data|`TBD`| +|TBD|sha256|TEXT|SHA256 hash of provided inode data|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#device_hash) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/device_partitions.md b/data_dictionaries/linux/osquery/events/device_partitions.md new file mode 100644 index 000000000..b89faea11 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/device_partitions.md @@ -0,0 +1,23 @@ +# Device_partitions Table + +## Description +Use TSK to enumerate details about partitions on a disk device. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Absolute file path to device node|`TBD`| +|TBD|partition|INTEGER|A partition number or description|`TBD`| +|TBD|label|TEXT||`TBD`| +|TBD|type|TEXT||`TBD`| +|TBD|offset|BIGINT||`TBD`| +|TBD|blocks_size|BIGINT|Byte size of each block|`TBD`| +|TBD|blocks|BIGINT|Number of blocks|`TBD`| +|TBD|inodes|BIGINT|Number of meta nodes|`TBD`| +|TBD|flags|INTEGER||`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#device_partitions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/disk_encryption.md b/data_dictionaries/linux/osquery/events/disk_encryption.md new file mode 100644 index 000000000..f9cfdff6e --- /dev/null +++ b/data_dictionaries/linux/osquery/events/disk_encryption.md @@ -0,0 +1,21 @@ +# Disk_encryption Table + +## Description +Disk encryption status and information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Disk name|`TBD`| +|TBD|uuid|TEXT|Disk Universally Unique Identifier|`TBD`| +|TBD|encrypted|INTEGER|1 If encrypted: true (disk is encrypted), else 0|`TBD`| +|TBD|type|TEXT|Description of cipher type and mode if available|`TBD`| +|TBD|uid|TEXT|Currently authenticated user if available (Apple)|`TBD`| +|TBD|user_uuid|TEXT|UUID of authenticated user if available (Apple)|`TBD`| +|TBD|encryption_status|TEXT|Disk encryption status with one of following values: encrypted | not encrypted | undefined|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#disk_encryption) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/dns_resolvers.md b/data_dictionaries/linux/osquery/events/dns_resolvers.md new file mode 100644 index 000000000..df610ce0a --- /dev/null +++ b/data_dictionaries/linux/osquery/events/dns_resolvers.md @@ -0,0 +1,19 @@ +# Dns_resolvers Table + +## Description +Resolvers used by this host. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|INTEGER|Address type index or order|`TBD`| +|TBD|type|TEXT|Address type: sortlist, nameserver, search|`TBD`| +|TBD|address|TEXT|Resolver IP/IPv6 address|`TBD`| +|TBD|netmask|TEXT|Address (sortlist) netmask length|`TBD`| +|TBD|options|BIGINT|Resolver options|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#dns_resolvers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_container_labels.md b/data_dictionaries/linux/osquery/events/docker_container_labels.md new file mode 100644 index 000000000..1bf096ccb --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_container_labels.md @@ -0,0 +1,17 @@ +# Docker_container_labels Table + +## Description +Docker container labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_container_mounts.md b/data_dictionaries/linux/osquery/events/docker_container_mounts.md new file mode 100644 index 000000000..1e6f4fb30 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_container_mounts.md @@ -0,0 +1,23 @@ +# Docker_container_mounts Table + +## Description +Docker container mounts. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|type|TEXT|Type of mount (bind, volume)|`TBD`| +|TBD|name|TEXT|Optional mount name|`TBD`| +|TBD|source|TEXT|Source path on host|`TBD`| +|TBD|destination|TEXT|Destination path inside container|`TBD`| +|TBD|driver|TEXT|Driver providing the mount|`TBD`| +|TBD|mode|TEXT|Mount options (rw, ro)|`TBD`| +|TBD|rw|INTEGER|1 if read/write. 0 otherwise|`TBD`| +|TBD|propagation|TEXT|Mount propagation|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_mounts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_container_networks.md b/data_dictionaries/linux/osquery/events/docker_container_networks.md new file mode 100644 index 000000000..cb77b5a02 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_container_networks.md @@ -0,0 +1,25 @@ +# Docker_container_networks Table + +## Description +Docker container networks. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|name|TEXT|Network name|`TBD`| +|TBD|network_id|TEXT|Network ID|`TBD`| +|TBD|endpoint_id|TEXT|Endpoint ID|`TBD`| +|TBD|gateway|TEXT|Gateway|`TBD`| +|TBD|ip_address|TEXT|IP address|`TBD`| +|TBD|ip_prefix_len|INTEGER|IP subnet prefix length|`TBD`| +|TBD|ipv6_gateway|TEXT|IPv6 gateway|`TBD`| +|TBD|ipv6_address|TEXT|IPv6 address|`TBD`| +|TBD|ipv6_prefix_len|INTEGER|IPv6 subnet prefix length|`TBD`| +|TBD|mac_address|TEXT|MAC address|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_networks) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_container_ports.md b/data_dictionaries/linux/osquery/events/docker_container_ports.md new file mode 100644 index 000000000..90daa6939 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_container_ports.md @@ -0,0 +1,19 @@ +# Docker_container_ports Table + +## Description +Docker container ports. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|type|TEXT|Protocol (tcp, udp)|`TBD`| +|TBD|port|INTEGER|Port inside the container|`TBD`| +|TBD|host_ip|TEXT|Host IP address on which public port is listening|`TBD`| +|TBD|host_port|INTEGER|Host port|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_ports) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_container_processes.md b/data_dictionaries/linux/osquery/events/docker_container_processes.md new file mode 100644 index 000000000..b00165be2 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_container_processes.md @@ -0,0 +1,36 @@ +# Docker_container_processes Table + +## Description +Docker container processes. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|pid|BIGINT|Process ID|`TBD`| +|TBD|name|TEXT|The process path or shorthand argv[0]|`TBD`| +|TBD|cmdline|TEXT|Complete argv|`TBD`| +|TBD|state|TEXT|Process state|`TBD`| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|gid|BIGINT|Group ID|`TBD`| +|TBD|euid|BIGINT|Effective user ID|`TBD`| +|TBD|egid|BIGINT|Effective group ID|`TBD`| +|TBD|suid|BIGINT|Saved user ID|`TBD`| +|TBD|sgid|BIGINT|Saved group ID|`TBD`| +|TBD|wired_size|BIGINT|Bytes of unpagable memory used by process|`TBD`| +|TBD|resident_size|BIGINT|Bytes of private memory used by process|`TBD`| +|TBD|total_size|BIGINT|Total virtual memory size|`TBD`| +|TBD|parent|BIGINT|Process parent's PID|`TBD`| +|TBD|pgroup|BIGINT|Process group|`TBD`| +|TBD|threads|INTEGER|Number of threads used by process|`TBD`| +|TBD|nice|INTEGER|Process nice level (-20 to 20, default 0)|`TBD`| +|TBD|user|TEXT|User name|`TBD`| +|TBD|time|TEXT|Cumulative CPU time. [DD-]HH:MM:SS format|`TBD`| +|TBD|cpu|DOUBLE|CPU utilization as percentage|`TBD`| +|TBD|mem|DOUBLE|Memory utilization as percentage|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_processes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_container_stats.md b/data_dictionaries/linux/osquery/events/docker_container_stats.md new file mode 100644 index 000000000..d9b42967f --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_container_stats.md @@ -0,0 +1,38 @@ +# Docker_container_stats Table + +## Description +Docker container statistics. Queries on this table take at least one second. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|name|TEXT|Container name|`TBD`| +|TBD|pids|INTEGER|Number of processes|`TBD`| +|TBD|read|BIGINT|UNIX time when stats were read|`TBD`| +|TBD|preread|BIGINT|UNIX time when stats were last read|`TBD`| +|TBD|interval|BIGINT|Difference between read and preread in nano-seconds|`TBD`| +|TBD|disk_read|BIGINT|Total disk read bytes|`TBD`| +|TBD|disk_write|BIGINT|Total disk write bytes|`TBD`| +|TBD|num_procs|INTEGER|Number of processors|`TBD`| +|TBD|cpu_total_usage|BIGINT|Total CPU usage|`TBD`| +|TBD|cpu_kernelmode_usage|BIGINT|CPU kernel mode usage|`TBD`| +|TBD|cpu_usermode_usage|BIGINT|CPU user mode usage|`TBD`| +|TBD|system_cpu_usage|BIGINT|CPU system usage|`TBD`| +|TBD|online_cpus|INTEGER|Online CPUs|`TBD`| +|TBD|pre_cpu_total_usage|BIGINT|Last read total CPU usage|`TBD`| +|TBD|pre_cpu_kernelmode_usage|BIGINT|Last read CPU kernel mode usage|`TBD`| +|TBD|pre_cpu_usermode_usage|BIGINT|Last read CPU user mode usage|`TBD`| +|TBD|pre_system_cpu_usage|BIGINT|Last read CPU system usage|`TBD`| +|TBD|pre_online_cpus|INTEGER|Last read online CPUs|`TBD`| +|TBD|memory_usage|BIGINT|Memory usage|`TBD`| +|TBD|memory_max_usage|BIGINT|Memory maximum usage|`TBD`| +|TBD|memory_limit|BIGINT|Memory limit|`TBD`| +|TBD|network_rx_bytes|BIGINT|Total network bytes read|`TBD`| +|TBD|network_tx_bytes|BIGINT|Total network bytes transmitted|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_stats) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_containers.md b/data_dictionaries/linux/osquery/events/docker_containers.md new file mode 100644 index 000000000..dcd4e2fa4 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_containers.md @@ -0,0 +1,38 @@ +# Docker_containers Table + +## Description +Docker containers information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|name|TEXT|Container name|`TBD`| +|TBD|image|TEXT|Docker image (name) used to launch this container|`TBD`| +|TBD|image_id|TEXT|Docker image ID|`TBD`| +|TBD|command|TEXT|Command with arguments|`TBD`| +|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`| +|TBD|state|TEXT|Container state (created, restarting, running, removing, paused, exited, dead)|`TBD`| +|TBD|status|TEXT|Container status information|`TBD`| +|TBD|pid|BIGINT|Identifier of the initial process|`TBD`| +|TBD|path|TEXT|Container path|`TBD`| +|TBD|config_entrypoint|TEXT|Container entrypoint(s)|`TBD`| +|TBD|started_at|TEXT|Container start time as string|`TBD`| +|TBD|finished_at|TEXT|Container finish time as string|`TBD`| +|TBD|privileged|INTEGER|Is the container privileged|`TBD`| +|TBD|security_options|TEXT|List of container security options|`TBD`| +|TBD|env_variables|TEXT|Container environmental variables|`TBD`| +|TBD|readonly_rootfs|INTEGER|Is the root filesystem mounted as read only|`TBD`| +|TBD|cgroup_namespace|TEXT|cgroup namespace [LINUX]|`TBD`| +|TBD|ipc_namespace|TEXT|IPC namespace [LINUX]|`TBD`| +|TBD|mnt_namespace|TEXT|Mount namespace [LINUX]|`TBD`| +|TBD|net_namespace|TEXT|Network namespace [LINUX]|`TBD`| +|TBD|pid_namespace|TEXT|PID namespace [LINUX]|`TBD`| +|TBD|user_namespace|TEXT|User namespace [LINUX]|`TBD`| +|TBD|uts_namespace|TEXT|UTS namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_containers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_image_labels.md b/data_dictionaries/linux/osquery/events/docker_image_labels.md new file mode 100644 index 000000000..1d0cc7a94 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_image_labels.md @@ -0,0 +1,17 @@ +# Docker_image_labels Table + +## Description +Docker image labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Image ID|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_image_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_image_layers.md b/data_dictionaries/linux/osquery/events/docker_image_layers.md new file mode 100644 index 000000000..04a45fba7 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_image_layers.md @@ -0,0 +1,17 @@ +# Docker_image_layers Table + +## Description +Docker image layers information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Image ID|`TBD`| +|TBD|layer_id|TEXT|Layer ID|`TBD`| +|TBD|layer_order|INTEGER|Layer Order (1 = base layer)|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_image_layers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_images.md b/data_dictionaries/linux/osquery/events/docker_images.md new file mode 100644 index 000000000..dfd27158e --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_images.md @@ -0,0 +1,18 @@ +# Docker_images Table + +## Description +Docker images information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Image ID|`TBD`| +|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`| +|TBD|size_bytes|BIGINT|Size of image in bytes|`TBD`| +|TBD|tags|TEXT|Comma-separated list of repository tags|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_images) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_info.md b/data_dictionaries/linux/osquery/events/docker_info.md new file mode 100644 index 000000000..30896cd19 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_info.md @@ -0,0 +1,46 @@ +# Docker_info Table + +## Description +Docker system information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Docker system ID|`TBD`| +|TBD|containers|INTEGER|Total number of containers|`TBD`| +|TBD|containers_running|INTEGER|Number of containers currently running|`TBD`| +|TBD|containers_paused|INTEGER|Number of containers in paused state|`TBD`| +|TBD|containers_stopped|INTEGER|Number of containers in stopped state|`TBD`| +|TBD|images|INTEGER|Number of images|`TBD`| +|TBD|storage_driver|TEXT|Storage driver|`TBD`| +|TBD|memory_limit|INTEGER|1 if memory limit support is enabled. 0 otherwise|`TBD`| +|TBD|swap_limit|INTEGER|1 if swap limit support is enabled. 0 otherwise|`TBD`| +|TBD|kernel_memory|INTEGER|1 if kernel memory limit support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_cfs_period|INTEGER|1 if CPU Completely Fair Scheduler (CFS) period support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_cfs_quota|INTEGER|1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_shares|INTEGER|1 if CPU share weighting support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_set|INTEGER|1 if CPU set selection support is enabled. 0 otherwise|`TBD`| +|TBD|ipv4_forwarding|INTEGER|1 if IPv4 forwarding is enabled. 0 otherwise|`TBD`| +|TBD|bridge_nf_iptables|INTEGER|1 if bridge netfilter iptables is enabled. 0 otherwise|`TBD`| +|TBD|bridge_nf_ip6tables|INTEGER|1 if bridge netfilter ip6tables is enabled. 0 otherwise|`TBD`| +|TBD|oom_kill_disable|INTEGER|1 if Out-of-memory kill is disabled. 0 otherwise|`TBD`| +|TBD|logging_driver|TEXT|Logging driver|`TBD`| +|TBD|cgroup_driver|TEXT|Control groups driver|`TBD`| +|TBD|kernel_version|TEXT|Kernel version|`TBD`| +|TBD|os|TEXT|Operating system|`TBD`| +|TBD|os_type|TEXT|Operating system type|`TBD`| +|TBD|architecture|TEXT|Hardware architecture|`TBD`| +|TBD|cpus|INTEGER|Number of CPUs|`TBD`| +|TBD|memory|BIGINT|Total memory|`TBD`| +|TBD|http_proxy|TEXT|HTTP proxy|`TBD`| +|TBD|https_proxy|TEXT|HTTPS proxy|`TBD`| +|TBD|no_proxy|TEXT|Comma-separated list of domain extensions proxy should not be used for|`TBD`| +|TBD|name|TEXT|Name of the docker host|`TBD`| +|TBD|server_version|TEXT|Server version|`TBD`| +|TBD|root_dir|TEXT|Docker root directory|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_network_labels.md b/data_dictionaries/linux/osquery/events/docker_network_labels.md new file mode 100644 index 000000000..eeb318589 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_network_labels.md @@ -0,0 +1,17 @@ +# Docker_network_labels Table + +## Description +Docker network labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Network ID|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_network_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_networks.md b/data_dictionaries/linux/osquery/events/docker_networks.md new file mode 100644 index 000000000..dcf3f8884 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_networks.md @@ -0,0 +1,21 @@ +# Docker_networks Table + +## Description +Docker networks information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Network ID|`TBD`| +|TBD|name|TEXT|Network name|`TBD`| +|TBD|driver|TEXT|Network driver|`TBD`| +|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`| +|TBD|enable_ipv6|INTEGER|1 if IPv6 is enabled on this network. 0 otherwise|`TBD`| +|TBD|subnet|TEXT|Network subnet|`TBD`| +|TBD|gateway|TEXT|Network gateway|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_networks) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_version.md b/data_dictionaries/linux/osquery/events/docker_version.md new file mode 100644 index 000000000..d07a81814 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_version.md @@ -0,0 +1,23 @@ +# Docker_version Table + +## Description +Docker version information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version|TEXT|Docker version|`TBD`| +|TBD|api_version|TEXT|API version|`TBD`| +|TBD|min_api_version|TEXT|Minimum API version supported|`TBD`| +|TBD|git_commit|TEXT|Docker build git commit|`TBD`| +|TBD|go_version|TEXT|Go version|`TBD`| +|TBD|os|TEXT|Operating system|`TBD`| +|TBD|arch|TEXT|Hardware architecture|`TBD`| +|TBD|kernel_version|TEXT|Kernel version|`TBD`| +|TBD|build_time|TEXT|Build time|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_version) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_volume_labels.md b/data_dictionaries/linux/osquery/events/docker_volume_labels.md new file mode 100644 index 000000000..b253b7040 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_volume_labels.md @@ -0,0 +1,17 @@ +# Docker_volume_labels Table + +## Description +Docker volume labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Volume name|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_volume_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/docker_volumes.md b/data_dictionaries/linux/osquery/events/docker_volumes.md new file mode 100644 index 000000000..47222dd73 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/docker_volumes.md @@ -0,0 +1,18 @@ +# Docker_volumes Table + +## Description +Docker volumes information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Volume name|`TBD`| +|TBD|driver|TEXT|Volume driver|`TBD`| +|TBD|mount_point|TEXT|Mount point|`TBD`| +|TBD|type|TEXT|Volume type|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_volumes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/ec2_instance_metadata.md b/data_dictionaries/linux/osquery/events/ec2_instance_metadata.md new file mode 100644 index 000000000..624f00069 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/ec2_instance_metadata.md @@ -0,0 +1,28 @@ +# Ec2_instance_metadata Table + +## Description +EC2 instance metadata. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|instance_id|TEXT|EC2 instance ID|`TBD`| +|TBD|instance_type|TEXT|EC2 instance type|`TBD`| +|TBD|architecture|TEXT|Hardware architecture of this EC2 instance|`TBD`| +|TBD|region|TEXT|AWS region in which this instance launched|`TBD`| +|TBD|availability_zone|TEXT|Availability zone in which this instance launched|`TBD`| +|TBD|local_hostname|TEXT|Private IPv4 DNS hostname of the first interface of this instance|`TBD`| +|TBD|local_ipv4|TEXT|Private IPv4 address of the first interface of this instance|`TBD`| +|TBD|mac|TEXT|MAC address for the first network interface of this EC2 instance|`TBD`| +|TBD|security_groups|TEXT|Comma separated list of security group names|`TBD`| +|TBD|iam_arn|TEXT|If there is an IAM role associated with the instance, contains instance profile ARN|`TBD`| +|TBD|ami_id|TEXT|AMI ID used to launch this EC2 instance|`TBD`| +|TBD|reservation_id|TEXT|ID of the reservation|`TBD`| +|TBD|account_id|TEXT|AWS account ID which owns this EC2 instance|`TBD`| +|TBD|ssh_public_key|TEXT|SSH public key. Only available if supplied at instance launch time|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ec2_instance_metadata) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/ec2_instance_tags.md b/data_dictionaries/linux/osquery/events/ec2_instance_tags.md new file mode 100644 index 000000000..0cf6a280a --- /dev/null +++ b/data_dictionaries/linux/osquery/events/ec2_instance_tags.md @@ -0,0 +1,17 @@ +# Ec2_instance_tags Table + +## Description +EC2 instance tag key value pairs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|instance_id|TEXT|EC2 instance ID|`TBD`| +|TBD|key|TEXT|Tag key|`TBD`| +|TBD|value|TEXT|Tag value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ec2_instance_tags) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/elf_dynamic.md b/data_dictionaries/linux/osquery/events/elf_dynamic.md new file mode 100644 index 000000000..419a765aa --- /dev/null +++ b/data_dictionaries/linux/osquery/events/elf_dynamic.md @@ -0,0 +1,18 @@ +# Elf_dynamic Table + +## Description +ELF dynamic section information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|tag|INTEGER|Tag ID|`TBD`| +|TBD|value|INTEGER|Tag value|`TBD`| +|TBD|class|INTEGER|Class (32 or 64)|`TBD`| +|TBD|path|TEXT|Path to ELF file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#elf_dynamic) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/elf_info.md b/data_dictionaries/linux/osquery/events/elf_info.md new file mode 100644 index 000000000..4ffbc384e --- /dev/null +++ b/data_dictionaries/linux/osquery/events/elf_info.md @@ -0,0 +1,23 @@ +# Elf_info Table + +## Description +ELF file information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|class|TEXT|Class type, 32 or 64bit|`TBD`| +|TBD|abi|TEXT|Section type|`TBD`| +|TBD|abi_version|INTEGER|Section virtual address in memory|`TBD`| +|TBD|type|TEXT|Offset of section in file|`TBD`| +|TBD|machine|INTEGER|Machine type|`TBD`| +|TBD|version|INTEGER|Object file version|`TBD`| +|TBD|entry|BIGINT|Entry point address|`TBD`| +|TBD|flags|INTEGER|ELF header flags|`TBD`| +|TBD|path|TEXT|Path to ELF file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#elf_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/elf_sections.md b/data_dictionaries/linux/osquery/events/elf_sections.md new file mode 100644 index 000000000..41070d69a --- /dev/null +++ b/data_dictionaries/linux/osquery/events/elf_sections.md @@ -0,0 +1,23 @@ +# Elf_sections Table + +## Description +ELF section information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Section name|`TBD`| +|TBD|type|INTEGER|Section type|`TBD`| +|TBD|vaddr|INTEGER|Section virtual address in memory|`TBD`| +|TBD|offset|INTEGER|Offset of section in file|`TBD`| +|TBD|size|INTEGER|Size of section|`TBD`| +|TBD|flags|TEXT|Section attributes|`TBD`| +|TBD|link|TEXT|Link to other section|`TBD`| +|TBD|align|INTEGER|Segment alignment|`TBD`| +|TBD|path|TEXT|Path to ELF file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#elf_sections) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/elf_segments.md b/data_dictionaries/linux/osquery/events/elf_segments.md new file mode 100644 index 000000000..74e69e372 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/elf_segments.md @@ -0,0 +1,22 @@ +# Elf_segments Table + +## Description +ELF segment information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Segment type/name|`TBD`| +|TBD|offset|INTEGER|Segment offset in file|`TBD`| +|TBD|vaddr|INTEGER|Segment virtual address in memory|`TBD`| +|TBD|psize|INTEGER|Size of segment in file|`TBD`| +|TBD|msize|INTEGER|Segment offset in memory|`TBD`| +|TBD|flags|TEXT|Segment attributes|`TBD`| +|TBD|align|INTEGER|Segment alignment|`TBD`| +|TBD|path|TEXT|Path to ELF file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#elf_segments) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/elf_symbols.md b/data_dictionaries/linux/osquery/events/elf_symbols.md new file mode 100644 index 000000000..180ca5b52 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/elf_symbols.md @@ -0,0 +1,22 @@ +# Elf_symbols Table + +## Description +ELF symbol list. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Symbol name|`TBD`| +|TBD|addr|INTEGER|Symbol address (value)|`TBD`| +|TBD|size|INTEGER|Size of object|`TBD`| +|TBD|type|TEXT|Symbol type|`TBD`| +|TBD|binding|TEXT|Binding type|`TBD`| +|TBD|offset|INTEGER|Section table index|`TBD`| +|TBD|table|TEXT|Table name containing symbol|`TBD`| +|TBD|path|TEXT|Path to ELF file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#elf_symbols) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/etc_hosts.md b/data_dictionaries/linux/osquery/events/etc_hosts.md new file mode 100644 index 000000000..e9d7d7b46 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/etc_hosts.md @@ -0,0 +1,16 @@ +# Etc_hosts Table + +## Description +Line-parsed /etc/hosts. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|address|TEXT|IP address mapping|`TBD`| +|TBD|hostnames|TEXT|Raw hosts mapping|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_hosts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/etc_protocols.md b/data_dictionaries/linux/osquery/events/etc_protocols.md new file mode 100644 index 000000000..2f64147da --- /dev/null +++ b/data_dictionaries/linux/osquery/events/etc_protocols.md @@ -0,0 +1,18 @@ +# Etc_protocols Table + +## Description +Line-parsed /etc/protocols. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Protocol name|`TBD`| +|TBD|number|INTEGER|Protocol number|`TBD`| +|TBD|alias|TEXT|Protocol alias|`TBD`| +|TBD|comment|TEXT|Comment with protocol description|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_protocols) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/etc_services.md b/data_dictionaries/linux/osquery/events/etc_services.md new file mode 100644 index 000000000..07d2dc4d7 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/etc_services.md @@ -0,0 +1,19 @@ +# Etc_services Table + +## Description +Line-parsed /etc/services. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Service name|`TBD`| +|TBD|port|INTEGER|Service port number|`TBD`| +|TBD|protocol|TEXT|Transport protocol (TCP/UDP)|`TBD`| +|TBD|aliases|TEXT|Optional space separated list of other names for a service|`TBD`| +|TBD|comment|TEXT|Optional comment for a service.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_services) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/example.md b/data_dictionaries/linux/osquery/events/example.md new file mode 100644 index 000000000..4c7554cd9 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/example.md @@ -0,0 +1,20 @@ +# Example Table + +## Description +This is an example table spec. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Description for name column|`TBD`| +|TBD|points|INTEGER|This is a signed SQLite int column|`TBD`| +|TBD|size|BIGINT|This is a signed SQLite bigint column|`TBD`| +|TBD|action|TEXT|Action performed in generation|`TBD`| +|TBD|id|INTEGER|An index of some sort|`TBD`| +|TBD|path|TEXT|Path of example|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#example) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/file.md b/data_dictionaries/linux/osquery/events/file.md index ce884d974..e17c3785f 100644 --- a/data_dictionaries/linux/osquery/events/file.md +++ b/data_dictionaries/linux/osquery/events/file.md @@ -6,23 +6,26 @@ Interactive filesystem attributes and metadata. ## Data Dictionary |Standard Name|Field Name|Type|Description|Sample Value| |---|---|---|---|---| -|file _path|path|TEXT|Absolute file path|``| -|file_directory|directory|TEXT|Directory of file(s)|``| -|file_name|filename|TEXT|Name portion of file path|``| -|file_inode|inode|BIGINT|Filesystem inode number|``| -|user_uid|uid|BIGINT|Owning user ID|``| -|user_gid|gid|BIGINT|Owning group ID|``| -|user_permissions|mode|TEXT|Permission bits|``| -|device_id|device|BIGINT|Device ID (optional)|``| -|file_size|size|BIGINT|Size of file in bytes|``| -|file_system_block_size|block_size|INTEGER|Block size of filesystem|``| -|date_last_access|atime|BIGINT|Last access time|``| -|date_last_modification|mtime|BIGINT|Last modification time|``| -|date_last_status_change|ctime|BIGINT|Last status change time|``| -|date_creation_time|btime|BIGINT|(B)irth or (cr)eate time|``| -|file_hard_links|hard_links|INTEGER|Number of hard links|``| -|file_symlink|symlink|INTEGER|1 if the path is a symlink, otherwise 0|``| -|file_type|type|TEXT|File status|``| +|file_path|path|TEXT|Absolute file path|`file_directory`| +|TBD|directory|TEXT|Directory of file(s)|`TBD`| +|file_name|filename|TEXT|Name portion of file path|`TBD`| +|file_inode|inode|BIGINT|Filesystem inode number|`TBD`| +|user_uid|uid|BIGINT|Owning user ID|`TBD`| +|user_gid|gid|BIGINT|Owning group ID|`TBD`| +|user_permissions|mode|TEXT|Permission bits|`TBD`| +|device_id|device|BIGINT|Device ID (optional)|`TBD`| +|file_size|size|BIGINT|Size of file in bytes|`TBD`| +|file_system_block_size|block_size|INTEGER|Block size of filesystem|`TBD`| +|date_last_access|atime|BIGINT|Last access time|`TBD`| +|date_last_modification|mtime|BIGINT|Last modification time|`TBD`| +|date_last_status_change|ctime|BIGINT|Last status change time|`TBD`| +|date_creation_time|btime|BIGINT|(B)irth or (cr)eate time|`TBD`| +|file_hard_links|hard_links|INTEGER|Number of hard links|`TBD`| +|file_symlink|symlink|INTEGER|1 if the path is a symlink, otherwise 0|`TBD`| +|file_type|type|TEXT|File status|`TBD`| ## References -* [osquery GitHub](https://github.com/facebook/osquery/blob/master/specs/utility/file.table) +* [OSQuery table documentation](https://osquery.io/schema/current#file) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/file_events.md b/data_dictionaries/linux/osquery/events/file_events.md new file mode 100644 index 000000000..6bc656b82 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/file_events.md @@ -0,0 +1,31 @@ +# File_events Table + +## Description +Track time/action changes to files specified in configuration data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|target_path|TEXT|The path associated with the event|`TBD`| +|TBD|category|TEXT|The category of the file defined in the config|`TBD`| +|TBD|action|TEXT|Change action (UPDATE, REMOVE, etc)|`TBD`| +|TBD|transaction_id|BIGINT|ID used during bulk update|`TBD`| +|TBD|inode|BIGINT|Filesystem inode number|`TBD`| +|TBD|uid|BIGINT|Owning user ID|`TBD`| +|TBD|gid|BIGINT|Owning group ID|`TBD`| +|TBD|mode|TEXT|Permission bits|`TBD`| +|TBD|size|BIGINT|Size of file in bytes|`TBD`| +|TBD|atime|BIGINT|Last access time|`TBD`| +|TBD|mtime|BIGINT|Last modification time|`TBD`| +|TBD|ctime|BIGINT|Last status change time|`TBD`| +|TBD|md5|TEXT|The MD5 of the file after change|`TBD`| +|TBD|sha1|TEXT|The SHA1 of the file after change|`TBD`| +|TBD|sha256|TEXT|The SHA256 of the file after change|`TBD`| +|TBD|time|BIGINT|Time of file event|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#file_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/firefox_addons.md b/data_dictionaries/linux/osquery/events/firefox_addons.md new file mode 100644 index 000000000..e84713206 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/firefox_addons.md @@ -0,0 +1,26 @@ +# Firefox_addons Table + +## Description +Firefox browser extensions, webapps, and addons. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the addon|`TBD`| +|TBD|name|TEXT|Addon display name|`TBD`| +|TBD|identifier|TEXT|Addon identifier|`TBD`| +|TBD|creator|TEXT|Addon-supported creator string|`TBD`| +|TBD|type|TEXT|Extension, addon, webapp|`TBD`| +|TBD|version|TEXT|Addon-supplied version string|`TBD`| +|TBD|description|TEXT|Addon-supplied description string|`TBD`| +|TBD|source_url|TEXT|URL that installed the addon|`TBD`| +|TBD|visible|INTEGER|1 If the addon is shown in browser else 0|`TBD`| +|TBD|active|INTEGER|1 If the addon is active else 0|`TBD`| +|TBD|location|TEXT|Global, profile location|`TBD`| +|TBD|path|TEXT|Path to plugin bundle|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#firefox_addons) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/groups.md b/data_dictionaries/linux/osquery/events/groups.md new file mode 100644 index 000000000..7f3d58f79 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/groups.md @@ -0,0 +1,20 @@ +# Groups Table + +## Description +Local system groups. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|gid|BIGINT|Unsigned int64 group ID|`TBD`| +|TBD|gid_signed|BIGINT|A signed int64 version of gid|`TBD`| +|TBD|groupname|TEXT|Canonical local group name|`TBD`| +|TBD|group_sid|TEXT|Unique group ID [WINDOWS]|`TBD`| +|TBD|comment|TEXT|Remarks or comments associated with the group [WINDOWS]|`TBD`| +|TBD|is_hidden|INTEGER|IsHidden attribute set in OpenDirectory [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#groups) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/hardware_events.md b/data_dictionaries/linux/osquery/events/hardware_events.md new file mode 100644 index 000000000..9f435b8ed --- /dev/null +++ b/data_dictionaries/linux/osquery/events/hardware_events.md @@ -0,0 +1,26 @@ +# Hardware_events Table + +## Description +Hardware (PCI/USB/HID) events from UDEV or IOKit. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|action|TEXT|Remove, insert, change properties, etc|`TBD`| +|TBD|path|TEXT|Local device path assigned (optional)|`TBD`| +|TBD|type|TEXT|Type of hardware and hardware event|`TBD`| +|TBD|driver|TEXT|Driver claiming the device|`TBD`| +|TBD|vendor|TEXT|Hardware device vendor|`TBD`| +|TBD|vendor_id|TEXT|Hex encoded Hardware vendor identifier|`TBD`| +|TBD|model|TEXT|Hardware device model|`TBD`| +|TBD|model_id|TEXT|Hex encoded Hardware model identifier|`TBD`| +|TBD|serial|TEXT|Device serial (optional)|`TBD`| +|TBD|revision|TEXT|Device revision (optional)|`TBD`| +|TBD|time|BIGINT|Time of hardware event|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#hardware_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/hash.md b/data_dictionaries/linux/osquery/events/hash.md new file mode 100644 index 000000000..75df7954d --- /dev/null +++ b/data_dictionaries/linux/osquery/events/hash.md @@ -0,0 +1,20 @@ +# Hash Table + +## Description +Filesystem hash data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Must provide a path or directory|`TBD`| +|TBD|directory|TEXT|Must provide a path or directory|`TBD`| +|TBD|md5|TEXT|MD5 hash of provided filesystem data|`TBD`| +|TBD|sha1|TEXT|SHA1 hash of provided filesystem data|`TBD`| +|TBD|sha256|TEXT|SHA256 hash of provided filesystem data|`TBD`| +|TBD|ssdeep|TEXT|ssdeep hash of provided filesystem data [POSIX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#hash) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/hvci_status.md b/data_dictionaries/linux/osquery/events/hvci_status.md new file mode 100644 index 000000000..37f762ef8 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/hvci_status.md @@ -0,0 +1,19 @@ +# Hvci_status Table + +## Description +Retrieve HVCI info of the machine. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version|TEXT|The version number of the Device Guard build.|`TBD`| +|TBD|instance_identifier|TEXT|The instance ID of Device Guard.|`TBD`| +|TBD|vbs_status|TEXT|The status of the virtualization based security settings. Returns UNKNOWN if an error is encountered.|`TBD`| +|TBD|code_integrity_policy_enforcement_status|TEXT|The status of the code integrity policy enforcement settings. Returns UNKNOWN if an error is encountered.|`TBD`| +|TBD|umci_policy_status|TEXT|The status of the User Mode Code Integrity security settings. Returns UNKNOWN if an error is encountered.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#hvci_status) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/intel_me_info.md b/data_dictionaries/linux/osquery/events/intel_me_info.md new file mode 100644 index 000000000..210297ff3 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/intel_me_info.md @@ -0,0 +1,15 @@ +# Intel_me_info Table + +## Description +Intel ME/CSE Info. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version| TEXT|Intel ME version|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#intel_me_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/interface_addresses.md b/data_dictionaries/linux/osquery/events/interface_addresses.md new file mode 100644 index 000000000..195a93f94 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/interface_addresses.md @@ -0,0 +1,21 @@ +# Interface_addresses Table + +## Description +Network interfaces and relevant metadata. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|address|TEXT|Specific address for interface|`TBD`| +|TBD|mask|TEXT|Interface netmask|`TBD`| +|TBD|broadcast|TEXT|Broadcast address for the interface|`TBD`| +|TBD|point_to_point|TEXT|PtP address for the interface|`TBD`| +|TBD|type|TEXT|Type of address. One of dhcp, manual, auto, other, unknown|`TBD`| +|TBD|friendly_name|TEXT|The friendly display name of the interface. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_addresses) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/interface_details.md b/data_dictionaries/linux/osquery/events/interface_details.md new file mode 100644 index 000000000..48f42856b --- /dev/null +++ b/data_dictionaries/linux/osquery/events/interface_details.md @@ -0,0 +1,49 @@ +# Interface_details Table + +## Description +Detailed information and stats of network interfaces. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|mac|TEXT|MAC of interface (optional)|`TBD`| +|TBD|type|INTEGER|Interface type (includes virtual)|`TBD`| +|TBD|mtu|INTEGER|Network MTU|`TBD`| +|TBD|metric|INTEGER|Metric based on the speed of the interface|`TBD`| +|TBD|flags|INTEGER|Flags (netdevice) for the device|`TBD`| +|TBD|ipackets|BIGINT|Input packets|`TBD`| +|TBD|opackets|BIGINT|Output packets|`TBD`| +|TBD|ibytes|BIGINT|Input bytes|`TBD`| +|TBD|obytes|BIGINT|Output bytes|`TBD`| +|TBD|ierrors|BIGINT|Input errors|`TBD`| +|TBD|oerrors|BIGINT|Output errors|`TBD`| +|TBD|idrops|BIGINT|Input drops|`TBD`| +|TBD|odrops|BIGINT|Output drops|`TBD`| +|TBD|collisions|BIGINT|Packet Collisions detected|`TBD`| +|TBD|last_change|BIGINT|Time of last device modification (optional)|`TBD`| +|TBD|link_speed|BIGINT|Interface speed in Mb/s [POSIX]|`TBD`| +|TBD|pci_slot|TEXT|PCI slot number [LINUX]|`TBD`| +|TBD|friendly_name|TEXT|The friendly display name of the interface. [WINDOWS]|`TBD`| +|TBD|description|TEXT|Short description of the object a one-line string. [WINDOWS]|`TBD`| +|TBD|manufacturer|TEXT|Name of the network adapter's manufacturer. [WINDOWS]|`TBD`| +|TBD|connection_id|TEXT|Name of the network connection as it appears in the Network Connections Control Panel program. [WINDOWS]|`TBD`| +|TBD|connection_status|TEXT|State of the network adapter connection to the network. [WINDOWS]|`TBD`| +|TBD|enabled|INTEGER|Indicates whether the adapter is enabled or not. [WINDOWS]|`TBD`| +|TBD|physical_adapter|INTEGER|Indicates whether the adapter is a physical or a logical adapter. [WINDOWS]|`TBD`| +|TBD|speed|INTEGER|Estimate of the current bandwidth in bits per second. [WINDOWS]|`TBD`| +|TBD|service|TEXT|The name of the service the network adapter uses. [WINDOWS]|`TBD`| +|TBD|dhcp_enabled|INTEGER|If TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection. [WINDOWS]|`TBD`| +|TBD|dhcp_lease_expires|TEXT|Expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dhcp_lease_obtained|TEXT|Date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dhcp_server|TEXT|IP address of the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dns_domain|TEXT|Organization name followed by a period and an extension that indicates the type of organization, such as 'microsoft.com'. [WINDOWS]|`TBD`| +|TBD|dns_domain_suffix_search_order|TEXT|Array of DNS domain suffixes to be appended to the end of host names during name resolution. [WINDOWS]|`TBD`| +|TBD|dns_host_name|TEXT|Host name used to identify the local computer for authentication by some utilities. [WINDOWS]|`TBD`| +|TBD|dns_server_search_order|TEXT|Array of server IP addresses to be used in querying for DNS servers. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_details) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/interface_ipv6.md b/data_dictionaries/linux/osquery/events/interface_ipv6.md new file mode 100644 index 000000000..17e5dc4a0 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/interface_ipv6.md @@ -0,0 +1,19 @@ +# Interface_ipv6 Table + +## Description +IPv6 configuration and stats of network interfaces. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|hop_limit|INTEGER|Current Hop Limit|`TBD`| +|TBD|forwarding_enabled|INTEGER|Enable IP forwarding|`TBD`| +|TBD|redirect_accept|INTEGER|Accept ICMP redirect messages|`TBD`| +|TBD|rtadv_accept|INTEGER|Accept ICMP Router Advertisement|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_ipv6) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/iptables.md b/data_dictionaries/linux/osquery/events/iptables.md new file mode 100644 index 000000000..93e36aeb2 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/iptables.md @@ -0,0 +1,32 @@ +# Iptables Table + +## Description +Linux IP packet filtering and NAT tool. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|filter_name|TEXT|Packet matching filter table name.|`TBD`| +|TBD|chain|TEXT|Size of module content.|`TBD`| +|TBD|policy|TEXT|Policy that applies for this rule.|`TBD`| +|TBD|target|TEXT|Target that applies for this rule.|`TBD`| +|TBD|protocol|INTEGER|Protocol number identification.|`TBD`| +|TBD|src_port|TEXT|Protocol source port(s).|`TBD`| +|TBD|dst_port|TEXT|Protocol destination port(s).|`TBD`| +|TBD|src_ip|TEXT|Source IP address.|`TBD`| +|TBD|src_mask|TEXT|Source IP address mask.|`TBD`| +|TBD|iniface|TEXT|Input interface for the rule.|`TBD`| +|TBD|iniface_mask|TEXT|Input interface mask for the rule.|`TBD`| +|TBD|dst_ip|TEXT|Destination IP address.|`TBD`| +|TBD|dst_mask|TEXT|Destination IP address mask.|`TBD`| +|TBD|outiface|TEXT|Output interface for the rule.|`TBD`| +|TBD|outiface_mask|TEXT|Output interface mask for the rule.|`TBD`| +|TBD|match|TEXT|Matching rule that applies.|`TBD`| +|TBD|packets|INTEGER|Number of matching packets for this rule.|`TBD`| +|TBD|bytes|INTEGER|Number of matching bytes for this rule.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#iptables) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/kernel_info.md b/data_dictionaries/linux/osquery/events/kernel_info.md new file mode 100644 index 000000000..a7801b5c2 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/kernel_info.md @@ -0,0 +1,18 @@ +# Kernel_info Table + +## Description +Basic active kernel information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version|TEXT|Kernel version|`TBD`| +|TBD|arguments|TEXT|Kernel arguments|`TBD`| +|TBD|path|TEXT|Kernel path|`TBD`| +|TBD|device|TEXT|Kernel device identifier|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#kernel_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/kernel_modules.md b/data_dictionaries/linux/osquery/events/kernel_modules.md new file mode 100644 index 000000000..6a41585f8 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/kernel_modules.md @@ -0,0 +1,19 @@ +# Kernel_modules Table + +## Description +Linux kernel modules both loaded and within the load search path. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Module name|`TBD`| +|TBD|size|TEXT|Size of module content|`TBD`| +|TBD|used_by|TEXT|Module reverse dependencies|`TBD`| +|TBD|status|TEXT|Kernel module status|`TBD`| +|TBD|address|TEXT|Kernel module address|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#kernel_modules) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/known_hosts.md b/data_dictionaries/linux/osquery/events/known_hosts.md new file mode 100644 index 000000000..3500f22c0 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/known_hosts.md @@ -0,0 +1,17 @@ +# Known_hosts Table + +## Description +A line-delimited known_hosts table. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the known_hosts file|`TBD`| +|TBD|key|TEXT|parsed authorized keys line|`TBD`| +|TBD|key_file|TEXT|Path to known_hosts file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#known_hosts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/last.md b/data_dictionaries/linux/osquery/events/last.md new file mode 100644 index 000000000..ab8d94bcf --- /dev/null +++ b/data_dictionaries/linux/osquery/events/last.md @@ -0,0 +1,20 @@ +# Last Table + +## Description +System logins and logouts. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|username|TEXT|Entry username|`TBD`| +|TBD|tty|TEXT|Entry terminal|`TBD`| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|type|INTEGER|Entry type, according to ut_type types (utmp.h)|`TBD`| +|TBD|time|INTEGER|Entry timestamp|`TBD`| +|TBD|host|TEXT|Entry hostname|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#last) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/listening_ports.md b/data_dictionaries/linux/osquery/events/listening_ports.md new file mode 100644 index 000000000..2d8444045 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/listening_ports.md @@ -0,0 +1,23 @@ +# Listening_ports Table + +## Description +Processes with listening (bound) network sockets/ports. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|port|INTEGER|Transport layer port|`TBD`| +|TBD|protocol|INTEGER|Transport protocol (TCP/UDP)|`TBD`| +|TBD|family|INTEGER|Network protocol (IPv4, IPv6)|`TBD`| +|TBD|address|TEXT|Specific address for bind|`TBD`| +|TBD|fd|BIGINT|Socket file descriptor number|`TBD`| +|TBD|socket|BIGINT|Socket handle or inode number|`TBD`| +|TBD|path|TEXT|Path for UNIX domain sockets|`TBD`| +|TBD|net_namespace|TEXT|The inode number of the network namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#listening_ports) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/lldp_neighbors.md b/data_dictionaries/linux/osquery/events/lldp_neighbors.md new file mode 100644 index 000000000..a0e8405bb --- /dev/null +++ b/data_dictionaries/linux/osquery/events/lldp_neighbors.md @@ -0,0 +1,83 @@ +# Lldp_neighbors Table + +## Description +LLDP neighbors of interfaces. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|rid|INTEGER|Neighbor chassis index|`TBD`| +|TBD|chassis_id_type|TEXT|Neighbor chassis ID type|`TBD`| +|TBD|chassis_id|TEXT|Neighbor chassis ID value|`TBD`| +|TBD|chassis_sysname|TEXT|CPU brand string, contains vendor and model|`TBD`| +|TBD|chassis_sys_description|INTEGER|Max number of CPU physical cores|`TBD`| +|TBD|chassis_bridge_capability_available|INTEGER|Chassis bridge capability availability|`TBD`| +|TBD|chassis_bridge_capability_enabled|INTEGER|Is chassis bridge capability enabled.|`TBD`| +|TBD|chassis_router_capability_available|INTEGER|Chassis router capability availability|`TBD`| +|TBD|chassis_router_capability_enabled|INTEGER|Chassis router capability enabled|`TBD`| +|TBD|chassis_repeater_capability_available|INTEGER|Chassis repeater capability availability|`TBD`| +|TBD|chassis_repeater_capability_enabled|INTEGER|Chassis repeater capability enabled|`TBD`| +|TBD|chassis_wlan_capability_available|INTEGER|Chassis wlan capability availability|`TBD`| +|TBD|chassis_wlan_capability_enabled|INTEGER|Chassis wlan capability enabled|`TBD`| +|TBD|chassis_tel_capability_available|INTEGER|Chassis telephone capability availability|`TBD`| +|TBD|chassis_tel_capability_enabled|INTEGER|Chassis telephone capability enabled|`TBD`| +|TBD|chassis_docsis_capability_available|INTEGER|Chassis DOCSIS capability availability|`TBD`| +|TBD|chassis_docsis_capability_enabled|INTEGER|Chassis DOCSIS capability enabled|`TBD`| +|TBD|chassis_station_capability_available|INTEGER|Chassis station capability availability|`TBD`| +|TBD|chassis_station_capability_enabled|INTEGER|Chassis station capability enabled|`TBD`| +|TBD|chassis_other_capability_available|INTEGER|Chassis other capability availability|`TBD`| +|TBD|chassis_other_capability_enabled|INTEGER|Chassis other capability enabled|`TBD`| +|TBD|chassis_mgmt_ips|TEXT|Comma delimited list of chassis management IPS|`TBD`| +|TBD|port_id_type|TEXT|Port ID type|`TBD`| +|TBD|port_id|TEXT|Port ID value|`TBD`| +|TBD|port_description|TEXT|Port description|`TBD`| +|TBD|port_ttl|BIGINT|Age of neighbor port|`TBD`| +|TBD|port_mfs|BIGINT|Port max frame size|`TBD`| +|TBD|port_aggregation_id|TEXT|Port aggregation ID|`TBD`| +|TBD|port_autoneg_supported|INTEGER|Auto negotiation supported|`TBD`| +|TBD|port_autoneg_enabled|INTEGER|Is auto negotiation enabled|`TBD`| +|TBD|port_mau_type|TEXT|MAU type|`TBD`| +|TBD|port_autoneg_10baset_hd_enabled|INTEGER|10Base-T HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_10baset_fd_enabled|INTEGER|10Base-T FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100basetx_hd_enabled|INTEGER|100Base-TX HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100basetx_fd_enabled|INTEGER|100Base-TX FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset2_hd_enabled|INTEGER|100Base-T2 HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset2_fd_enabled|INTEGER|100Base-T2 FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset4_hd_enabled|INTEGER|100Base-T4 HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset4_fd_enabled|INTEGER|100Base-T4 FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000basex_hd_enabled|INTEGER|1000Base-X HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000basex_fd_enabled|INTEGER|1000Base-X FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000baset_hd_enabled|INTEGER|1000Base-T HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000baset_fd_enabled|INTEGER|1000Base-T FD auto negotiation enabled|`TBD`| +|TBD|power_device_type|TEXT|Dot3 power device type|`TBD`| +|TBD|power_mdi_supported|INTEGER|MDI power supported|`TBD`| +|TBD|power_mdi_enabled|INTEGER|Is MDI power enabled|`TBD`| +|TBD|power_paircontrol_enabled|INTEGER|Is power pair control enabled|`TBD`| +|TBD|power_pairs|TEXT|Dot3 power pairs|`TBD`| +|TBD|power_class|TEXT|Power class|`TBD`| +|TBD|power_8023at_enabled|INTEGER|Is 802.3at enabled|`TBD`| +|TBD|power_8023at_power_type|TEXT|802.3at power type|`TBD`| +|TBD|power_8023at_power_source|TEXT|802.3at power source|`TBD`| +|TBD|power_8023at_power_priority|TEXT|802.3at power priority|`TBD`| +|TBD|power_8023at_power_allocated|TEXT|802.3at power allocated|`TBD`| +|TBD|power_8023at_power_requested|TEXT|802.3at power requested|`TBD`| +|TBD|med_device_type|TEXT|Chassis MED type|`TBD`| +|TBD|med_capability_capabilities|INTEGER|Is MED capabilities enabled|`TBD`| +|TBD|med_capability_policy|INTEGER|Is MED policy capability enabled|`TBD`| +|TBD|med_capability_location|INTEGER|Is MED location capability enabled|`TBD`| +|TBD|med_capability_mdi_pse|INTEGER|Is MED MDI PSE capability enabled|`TBD`| +|TBD|med_capability_mdi_pd|INTEGER|Is MED MDI PD capability enabled|`TBD`| +|TBD|med_capability_inventory|INTEGER|Is MED inventory capability enabled|`TBD`| +|TBD|med_policies|TEXT|Comma delimited list of MED policies|`TBD`| +|TBD|vlans|TEXT|Comma delimited list of vlan ids|`TBD`| +|TBD|pvid|TEXT|Primary VLAN id|`TBD`| +|TBD|ppvids_supported|TEXT|Comma delimited list of supported PPVIDs|`TBD`| +|TBD|ppvids_enabled|TEXT|Comma delimited list of enabled PPVIDs|`TBD`| +|TBD|pids|TEXT|Comma delimited list of PIDs|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#lldp_neighbors) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/load_average.md b/data_dictionaries/linux/osquery/events/load_average.md new file mode 100644 index 000000000..f5aaa4ad1 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/load_average.md @@ -0,0 +1,16 @@ +# Load_average Table + +## Description +Displays information about the system wide load averages. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|period|TEXT|Period over which the average is calculated.|`TBD`| +|TBD|average|TEXT|Load average over the specified period.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#load_average) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/logged_in_users.md b/data_dictionaries/linux/osquery/events/logged_in_users.md new file mode 100644 index 000000000..4a6a32b34 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/logged_in_users.md @@ -0,0 +1,22 @@ +# Logged_in_users Table + +## Description +Users with an active shell on the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|Login type|`TBD`| +|TBD|user|TEXT|User login name|`TBD`| +|TBD|tty|TEXT|Device name|`TBD`| +|TBD|host|TEXT|Remote hostname|`TBD`| +|TBD|time|INTEGER|Time entry was made|`TBD`| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|sid|TEXT|The user's unique security identifier [WINDOWS]|`TBD`| +|TBD|registry_hive|TEXT|HKEY_USERS registry hive [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#logged_in_users) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/magic.md b/data_dictionaries/linux/osquery/events/magic.md new file mode 100644 index 000000000..5c0be36a8 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/magic.md @@ -0,0 +1,19 @@ +# Magic Table + +## Description +Magic number recognition library table. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Absolute path to target file|`TBD`| +|TBD|magic_db_files|TEXT|Colon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgc|`TBD`| +|TBD|data|TEXT|Magic number data from libmagic|`TBD`| +|TBD|mime_type|TEXT|MIME type data from libmagic|`TBD`| +|TBD|mime_encoding|TEXT|MIME encoding data from libmagic|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#magic) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/md_devices.md b/data_dictionaries/linux/osquery/events/md_devices.md new file mode 100644 index 000000000..5672504b2 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/md_devices.md @@ -0,0 +1,42 @@ +# Md_devices Table + +## Description +Software RAID array settings. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device_name|TEXT|md device name|`TBD`| +|TBD|status|TEXT|Current state of the array|`TBD`| +|TBD|raid_level|INTEGER|Current raid level of the array|`TBD`| +|TBD|size|BIGINT|size of the array in blocks|`TBD`| +|TBD|chunk_size|BIGINT|chunk size in bytes|`TBD`| +|TBD|raid_disks|INTEGER|Number of configured RAID disks in array|`TBD`| +|TBD|working_disks|INTEGER|Number of working disks in array|`TBD`| +|TBD|active_disks|INTEGER|Number of active disks in array|`TBD`| +|TBD|failed_disks|INTEGER|Number of active disks in array|`TBD`| +|TBD|spare_disks|INTEGER|Number of active disks in array|`TBD`| +|TBD|superblock_state|TEXT|State of the superblock|`TBD`| +|TBD|superblock_version|TEXT|Version of the superblock|`TBD`| +|TBD|superblock_update_time|BIGINT|Unix timestamp of last update|`TBD`| +|TBD|bitmap_chunk_size|TEXT|Bitmap chunk size|`TBD`| +|TBD|bitmap_external_file|TEXT|External referenced bitmap file|`TBD`| +|TBD|recovery_progress|TEXT|Progress of the recovery activity|`TBD`| +|TBD|recovery_finish|TEXT|Estimated duration of recovery activity|`TBD`| +|TBD|recovery_speed|TEXT|Speed of recovery activity|`TBD`| +|TBD|resync_progress|TEXT|Progress of the resync activity|`TBD`| +|TBD|resync_finish|TEXT|Estimated duration of resync activity|`TBD`| +|TBD|resync_speed|TEXT|Speed of resync activity|`TBD`| +|TBD|reshape_progress|TEXT|Progress of the reshape activity|`TBD`| +|TBD|reshape_finish|TEXT|Estimated duration of reshape activity|`TBD`| +|TBD|reshape_speed|TEXT|Speed of reshape activity|`TBD`| +|TBD|check_array_progress|TEXT|Progress of the resync activity|`TBD`| +|TBD|check_array_finish|TEXT|Estimated duration of resync activity|`TBD`| +|TBD|check_array_speed|TEXT|Speed of resync activity|`TBD`| +|TBD|unused_devices|TEXT|Unused devices|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#md_devices) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/md_drives.md b/data_dictionaries/linux/osquery/events/md_drives.md new file mode 100644 index 000000000..311e8157b --- /dev/null +++ b/data_dictionaries/linux/osquery/events/md_drives.md @@ -0,0 +1,18 @@ +# Md_drives Table + +## Description +Drive devices used for Software RAID. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|md_device_name|TEXT|md device name|`TBD`| +|TBD|drive_name|TEXT|Drive device name|`TBD`| +|TBD|slot|INTEGER|Slot position of disk|`TBD`| +|TBD|state|TEXT|State of the drive|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#md_drives) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/md_personalities.md b/data_dictionaries/linux/osquery/events/md_personalities.md new file mode 100644 index 000000000..6af613449 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/md_personalities.md @@ -0,0 +1,15 @@ +# Md_personalities Table + +## Description +Software RAID setting supported by the kernel. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Name of personality supported by kernel|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#md_personalities) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/memory_array_mapped_addresses.md b/data_dictionaries/linux/osquery/events/memory_array_mapped_addresses.md new file mode 100644 index 000000000..a41952e41 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/memory_array_mapped_addresses.md @@ -0,0 +1,15 @@ +# Memory_array_mapped_addresses Table + +## Description +Data associated for address mapping of physical memory arrays. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle| TEXT|Handle, or instance number, associated with the structure|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_array_mapped_addresses) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/memory_arrays.md b/data_dictionaries/linux/osquery/events/memory_arrays.md new file mode 100644 index 000000000..653cdfadb --- /dev/null +++ b/data_dictionaries/linux/osquery/events/memory_arrays.md @@ -0,0 +1,19 @@ +# Memory_arrays Table + +## Description +Data associated with collection of memory devices that operate to form a memory address. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle| TEXT|Handle, or instance number, associated with the array|`TBD`| +|TBD|location| TEXT|Physical location of the memory array|`TBD`| +|TBD|use|TEXT|Function for which the array is used|`TBD`| +|TBD|max_capacity|INTEGER|Maximum capacity of array in gigabytes|`TBD`| +|TBD|number_memory_devices|INTEGER|Number of memory devices on array|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_arrays) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/memory_device_mapped_addresses.md b/data_dictionaries/linux/osquery/events/memory_device_mapped_addresses.md new file mode 100644 index 000000000..713ba546f --- /dev/null +++ b/data_dictionaries/linux/osquery/events/memory_device_mapped_addresses.md @@ -0,0 +1,15 @@ +# Memory_device_mapped_addresses Table + +## Description +Data associated for address mapping of physical memory devices. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle| TEXT|Handle, or instance number, associated with the structure|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_device_mapped_addresses) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/memory_devices.md b/data_dictionaries/linux/osquery/events/memory_devices.md new file mode 100644 index 000000000..c2b1fc3ef --- /dev/null +++ b/data_dictionaries/linux/osquery/events/memory_devices.md @@ -0,0 +1,34 @@ +# Memory_devices Table + +## Description +Physical memory device (type 17) information retrieved from SMBIOS. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle| TEXT|Handle, or instance number, associated with the structure in SMBIOS|`TBD`| +|TBD|array_handle| TEXT|The memory array that the device is attached to|`TBD`| +|TBD|form_factor|TEXT|Implementation form factor for this memory device|`TBD`| +|TBD|total_width|INTEGER|Total width, in bits, of this memory device, including any check or error-correction bits|`TBD`| +|TBD|data_width|INTEGER|Data width, in bits, of this memory device|`TBD`| +|TBD|size|INTEGER|Size of memory device in Megabyte|`TBD`| +|TBD|set|INTEGER|Identifies if memory device is one of a set of devices. A value of 0 indicates no set affiliation.|`TBD`| +|TBD|device_locator|TEXT|String number of the string that identifies the physically-labeled socket or board position where the memory device is located|`TBD`| +|TBD|bank_locator|TEXT|String number of the string that identifies the physically-labeled bank where the memory device is located|`TBD`| +|TBD|memory_type|TEXT|Type of memory used|`TBD`| +|TBD|memory_type_details|TEXT|Additional details for memory device|`TBD`| +|TBD|max_speed|INTEGER|Max speed of memory device in megatransfers per second (MT/s)|`TBD`| +|TBD|configured_clock_speed|INTEGER|Configured speed of memory device in megatransfers per second (MT/s)|`TBD`| +|TBD|manufacturer|TEXT|Manufacturer ID string|`TBD`| +|TBD|serial_number|TEXT|Serial number of memory device|`TBD`| +|TBD|asset_tag|TEXT|Manufacturer specific asset tag of memory device|`TBD`| +|TBD|part_number|TEXT|Manufacturer specific serial number of memory device|`TBD`| +|TBD|min_voltage|INTEGER|Minimum operating voltage of device in millivolts|`TBD`| +|TBD|max_voltage|INTEGER|Maximum operating voltage of device in millivolts|`TBD`| +|TBD|configured_voltage|INTEGER|Configured operating voltage of device in millivolts|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_devices) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/memory_error_info.md b/data_dictionaries/linux/osquery/events/memory_error_info.md new file mode 100644 index 000000000..a15da7527 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/memory_error_info.md @@ -0,0 +1,15 @@ +# Memory_error_info Table + +## Description +Data associated with errors of a physical memory array. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle| TEXT|Handle, or instance number, associated with the structure|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_error_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/memory_info.md b/data_dictionaries/linux/osquery/events/memory_info.md new file mode 100644 index 000000000..ad5c7e1af --- /dev/null +++ b/data_dictionaries/linux/osquery/events/memory_info.md @@ -0,0 +1,23 @@ +# Memory_info Table + +## Description +Main memory information in bytes. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|memory_total| BIGINT|Total amount of physical RAM, in bytes|`TBD`| +|TBD|memory_free|BIGINT|The amount of physical RAM, in bytes, left unused by the system|`TBD`| +|TBD|buffers|BIGINT|The amount of physical RAM, in bytes, used for file buffers|`TBD`| +|TBD|cached|BIGINT|The amount of physical RAM, in bytes, used as cache memory|`TBD`| +|TBD|swap_cached|BIGINT|The amount of swap, in bytes, used as cache memory|`TBD`| +|TBD|active|BIGINT|The total amount of buffer or page cache memory, in bytes, that is in active use|`TBD`| +|TBD|inactive|BIGINT|The total amount of buffer or page cache memory, in bytes, that are free and available|`TBD`| +|TBD|swap_total|BIGINT|The total amount of swap available, in bytes|`TBD`| +|TBD|swap_free|BIGINT|The total amount of swap free, in bytes|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/memory_map.md b/data_dictionaries/linux/osquery/events/memory_map.md new file mode 100644 index 000000000..598bad70a --- /dev/null +++ b/data_dictionaries/linux/osquery/events/memory_map.md @@ -0,0 +1,17 @@ +# Memory_map Table + +## Description +OS memory region map. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Region name|`TBD`| +|TBD|start|TEXT|Start address of memory region|`TBD`| +|TBD|end|TEXT|End address of memory region|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_map) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/mounts.md b/data_dictionaries/linux/osquery/events/mounts.md new file mode 100644 index 000000000..6d0f2a622 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/mounts.md @@ -0,0 +1,25 @@ +# Mounts Table + +## Description +System mounted devices and filesystems (not process specific). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Mounted device|`TBD`| +|TBD|device_alias|TEXT|Mounted device alias|`TBD`| +|TBD|path|TEXT|Mounted device path|`TBD`| +|TBD|type|TEXT|Mounted device type|`TBD`| +|TBD|blocks_size|BIGINT|Block size in bytes|`TBD`| +|TBD|blocks|BIGINT|Mounted device used blocks|`TBD`| +|TBD|blocks_free|BIGINT|Mounted device free blocks|`TBD`| +|TBD|blocks_available|BIGINT|Mounted device available blocks|`TBD`| +|TBD|inodes|BIGINT|Mounted device used inodes|`TBD`| +|TBD|inodes_free|BIGINT|Mounted device free inodes|`TBD`| +|TBD|flags|TEXT|Mounted device flags|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#mounts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/msr.md b/data_dictionaries/linux/osquery/events/msr.md new file mode 100644 index 000000000..9c1253139 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/msr.md @@ -0,0 +1,20 @@ +# Msr Table + +## Description +Various pieces of data stored in the model specific register per + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|turbo_disabled|BIGINT|Whether the turbo feature is disabled.|`TBD`| +|TBD|turbo_ratio_limit|BIGINT|The turbo feature ratio limit.|`TBD`| +|TBD|platform_info|BIGINT|Platform information.|`TBD`| +|TBD|perf_ctl|BIGINT|Performance setting for the processor.|`TBD`| +|TBD|perf_status|BIGINT|Performance status for the processor.|`TBD`| +|TBD|feature_control|BIGINT|Bitfield controlling enabled features.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#msr) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/npm_packages.md b/data_dictionaries/linux/osquery/events/npm_packages.md new file mode 100644 index 000000000..4be5d8690 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/npm_packages.md @@ -0,0 +1,21 @@ +# Npm_packages Table + +## Description +Lists all npm packages in a directory or globally installed in a system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package display name|`TBD`| +|TBD|version|TEXT|Package supplied version|`TBD`| +|TBD|description|TEXT|Package supplied description|`TBD`| +|TBD|author|TEXT|Package author name|`TBD`| +|TBD|license|TEXT|License for package|`TBD`| +|TBD|path|TEXT|Module's package.json path|`TBD`| +|TBD|directory|TEXT|Node module's directory where this package is located|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#npm_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/oem_strings.md b/data_dictionaries/linux/osquery/events/oem_strings.md new file mode 100644 index 000000000..611547524 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/oem_strings.md @@ -0,0 +1,17 @@ +# Oem_strings Table + +## Description +OEM defined strings retrieved from SMBIOS. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle|TEXT|Handle, or instance number, associated with the Type 11 structure|`TBD`| +|TBD|number|INTEGER|The string index of the structure|`TBD`| +|TBD|value|TEXT|The value of the OEM string|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#oem_strings) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/opera_extensions.md b/data_dictionaries/linux/osquery/events/opera_extensions.md new file mode 100644 index 000000000..7a3888d19 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/opera_extensions.md @@ -0,0 +1,23 @@ +# Opera_extensions Table + +## Description +Opera browser extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the extension|`TBD`| +|TBD|name|TEXT|Extension display name|`TBD`| +|TBD|identifier|TEXT|Extension identifier|`TBD`| +|TBD|version|TEXT|Extension-supplied version|`TBD`| +|TBD|description|TEXT|Extension-optional description|`TBD`| +|TBD|locale|TEXT|Default locale supported by extension|`TBD`| +|TBD|update_url|TEXT|Extension-supplied update URI|`TBD`| +|TBD|author|TEXT|Optional extension author|`TBD`| +|TBD|path|TEXT|Path to extension folder|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#opera_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/os_version.md b/data_dictionaries/linux/osquery/events/os_version.md new file mode 100644 index 000000000..0f7d5cd88 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/os_version.md @@ -0,0 +1,24 @@ +# Os_version Table + +## Description +A single row containing the operating system name and version. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Distribution or product name|`TBD`| +|TBD|version|TEXT|Pretty, suitable for presentation, OS version|`TBD`| +|TBD|major|INTEGER|Major release version|`TBD`| +|TBD|minor|INTEGER|Minor release version|`TBD`| +|TBD|patch|INTEGER|Optional patch release|`TBD`| +|TBD|build|TEXT|Optional build-specific or variant string|`TBD`| +|TBD|platform|TEXT|OS Platform or ID|`TBD`| +|TBD|platform_like|TEXT|Closely related platforms|`TBD`| +|TBD|codename|TEXT|OS version codename|`TBD`| +|TBD|install_date|TEXT|The install date of the OS. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#os_version) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/osquery_events.md b/data_dictionaries/linux/osquery/events/osquery_events.md new file mode 100644 index 000000000..8f658b32f --- /dev/null +++ b/data_dictionaries/linux/osquery/events/osquery_events.md @@ -0,0 +1,18 @@ +# Osquery_events Table + +## Description +Information about the event publishers and subscribers. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Event publisher or subscriber name|`TBD`| +|TBD|publisher|TEXT|Name of the associated publisher|`TBD`| +|TBD|type|TEXT|Either publisher or subscriber|`TBD`| +|TBD|refreshes|INTEGER|Publisher only: number of runloop restarts|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/osquery_extensions.md b/data_dictionaries/linux/osquery/events/osquery_extensions.md new file mode 100644 index 000000000..2052c8dec --- /dev/null +++ b/data_dictionaries/linux/osquery/events/osquery_extensions.md @@ -0,0 +1,20 @@ +# Osquery_extensions Table + +## Description +List of active osquery extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uuid|BIGINT|The transient ID assigned for communication|`TBD`| +|TBD|name|TEXT|Extension's name|`TBD`| +|TBD|version|TEXT|Extension's version|`TBD`| +|TBD|sdk_version|TEXT|osquery SDK version used to build the extension|`TBD`| +|TBD|path|TEXT|Path of the extenion's domain socket or library path|`TBD`| +|TBD|type|TEXT|SDK extension type: extension or module|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/osquery_flags.md b/data_dictionaries/linux/osquery/events/osquery_flags.md new file mode 100644 index 000000000..ac0ec4a46 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/osquery_flags.md @@ -0,0 +1,20 @@ +# Osquery_flags Table + +## Description +Configurable flags that modify osquery's behavior. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Flag name|`TBD`| +|TBD|type|TEXT|Flag type|`TBD`| +|TBD|description|TEXT|Flag description|`TBD`| +|TBD|default_value|TEXT|Flag default value|`TBD`| +|TBD|value|TEXT|Flag value|`TBD`| +|TBD|shell_only|INTEGER|Is the flag shell only?|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_flags) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/osquery_info.md b/data_dictionaries/linux/osquery/events/osquery_info.md new file mode 100644 index 000000000..823c21bfc --- /dev/null +++ b/data_dictionaries/linux/osquery/events/osquery_info.md @@ -0,0 +1,26 @@ +# Osquery_info Table + +## Description +Top level information about the running version of osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread/handle) ID|`TBD`| +|TBD|uuid|TEXT|Unique ID provided by the system|`TBD`| +|TBD|instance_id|TEXT|Unique, long-lived ID per instance of osquery|`TBD`| +|TBD|version|TEXT|osquery toolkit version|`TBD`| +|TBD|config_hash|TEXT|Hash of the working configuration state|`TBD`| +|TBD|config_valid|INTEGER|1 if the config was loaded and considered valid, else 0|`TBD`| +|TBD|extensions|TEXT|osquery extensions status|`TBD`| +|TBD|build_platform|TEXT|osquery toolkit build platform|`TBD`| +|TBD|build_distro|TEXT|osquery toolkit platform distribution name (os version)|`TBD`| +|TBD|start_time|INTEGER|UNIX time in seconds when the process started|`TBD`| +|TBD|watcher|INTEGER|Process (or thread/handle) ID of optional watcher process|`TBD`| +|TBD|platform_mask|INTEGER|The osquery platform bitmask|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/osquery_packs.md b/data_dictionaries/linux/osquery/events/osquery_packs.md new file mode 100644 index 000000000..ac1c811f3 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/osquery_packs.md @@ -0,0 +1,21 @@ +# Osquery_packs Table + +## Description +Information about the current query packs that are loaded in osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The given name for this query pack|`TBD`| +|TBD|platform|TEXT|Platforms this query is supported on|`TBD`| +|TBD|version|TEXT|Minimum osquery version that this query will run on|`TBD`| +|TBD|shard|INTEGER|Shard restriction limit, 1-100, 0 meaning no restriction|`TBD`| +|TBD|discovery_cache_hits|INTEGER|The number of times that the discovery query used cached values since the last time the config was reloaded|`TBD`| +|TBD|discovery_executions|INTEGER|The number of times that the discovery queries have been executed since the last time the config was reloaded|`TBD`| +|TBD|active|INTEGER|Whether this pack is active (the version, platform and discovery queries match) yes=1, no=0.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_packs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/osquery_registry.md b/data_dictionaries/linux/osquery/events/osquery_registry.md new file mode 100644 index 000000000..7d1432b37 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/osquery_registry.md @@ -0,0 +1,19 @@ +# Osquery_registry Table + +## Description +List the osquery registry plugins. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|registry|TEXT|Name of the osquery registry|`TBD`| +|TBD|name|TEXT|Name of the plugin item|`TBD`| +|TBD|owner_uuid|INTEGER|Extension route UUID (0 for core)|`TBD`| +|TBD|internal|INTEGER|1 If the plugin is internal else 0|`TBD`| +|TBD|active|INTEGER|1 If this plugin is active else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_registry) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/osquery_schedule.md b/data_dictionaries/linux/osquery/events/osquery_schedule.md new file mode 100644 index 000000000..f63371227 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/osquery_schedule.md @@ -0,0 +1,21 @@ +# Osquery_schedule Table + +## Description +Information about the current queries that are scheduled in osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The given name for this query|`TBD`| +|TBD|query|TEXT|The exact query to run|`TBD`| +|TBD|executions|BIGINT|Number of times the query was executed|`TBD`| +|TBD|blacklisted|INTEGER|1 if the query is blacklisted else 0|`TBD`| +|TBD|wall_time|BIGINT|Total wall time spent executing|`TBD`| +|TBD|user_time|BIGINT|Total user time spent executing|`TBD`| +|TBD|system_time|BIGINT|Total system time spent executing|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_schedule) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/pci_devices.md b/data_dictionaries/linux/osquery/events/pci_devices.md new file mode 100644 index 000000000..cb99a304a --- /dev/null +++ b/data_dictionaries/linux/osquery/events/pci_devices.md @@ -0,0 +1,32 @@ +# Pci_devices Table + +## Description +PCI devices active on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pci_slot|TEXT|PCI Device used slot|`TBD`| +|TBD|pci_class|TEXT|PCI Device class|`TBD`| +|TBD|driver|TEXT|PCI Device used driver|`TBD`| +|TBD|vendor|TEXT|PCI Device vendor|`TBD`| +|TBD|vendor_id|TEXT|Hex encoded PCI Device vendor identifier|`TBD`| +|TBD|model|TEXT|PCI Device model|`TBD`| +|TBD|model_id|TEXT|Hex encoded PCI Device model identifier|`TBD`| +|TBD|subsystem|TEXT|PCI Device subsystem|`TBD`| +|TBD|express|INTEGER|1 If PCI device is express else 0|`TBD`| +|TBD|thunderbolt|INTEGER|1 If PCI device is thunderbolt else 0|`TBD`| +|TBD|removable|INTEGER|1 If PCI device is removable else 0|`TBD`| +|TBD|pci_class_id|TEXT|PCI Device class ID in hex format [LINUX]|`TBD`| +|TBD|pci_subclass_id|TEXT|PCI Device subclass in hex format [LINUX]|`TBD`| +|TBD|pci_subclass|TEXT|PCI Device subclass [LINUX]|`TBD`| +|TBD|subsystem_vendor_id|TEXT|Vendor ID of PCI device subsystem [LINUX]|`TBD`| +|TBD|subsystem_vendor|TEXT|Vendor of PCI device subsystem [LINUX]|`TBD`| +|TBD|subsystem_model_id|TEXT|Model ID of PCI device subsystem [LINUX]|`TBD`| +|TBD|subsystem_model|TEXT|Device description of PCI device subsystem [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#pci_devices) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/platform_info.md b/data_dictionaries/linux/osquery/events/platform_info.md new file mode 100644 index 000000000..ee430f192 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/platform_info.md @@ -0,0 +1,22 @@ +# Platform_info Table + +## Description +Information about EFI/UEFI/ROM and platform/boot. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|vendor|TEXT|Platform code vendor|`TBD`| +|TBD|version|TEXT|Platform code version|`TBD`| +|TBD|date|TEXT|Self-reported platform code update date|`TBD`| +|TBD|revision|TEXT|BIOS major and minor revision|`TBD`| +|TBD|address|TEXT|Relative address of firmware mapping|`TBD`| +|TBD|size|TEXT|Size in bytes of firmware|`TBD`| +|TBD|volume_size|INTEGER|(Optional) size of firmware volume|`TBD`| +|TBD|extra|TEXT|Platform-specific additional information|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#platform_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/portage_keywords.md b/data_dictionaries/linux/osquery/events/portage_keywords.md new file mode 100644 index 000000000..6f488b19d --- /dev/null +++ b/data_dictionaries/linux/osquery/events/portage_keywords.md @@ -0,0 +1,19 @@ +# Portage_keywords Table + +## Description +A summary about portage configurations like keywords, mask and unmask. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|package|TEXT|Package name|`TBD`| +|TBD|version|TEXT|The version which are affected by the use flags, empty means all|`TBD`| +|TBD|keyword|TEXT|The keyword applied to the package|`TBD`| +|TBD|mask|INTEGER|If the package is masked|`TBD`| +|TBD|unmask|INTEGER|If the package is unmasked|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#portage_keywords) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/portage_packages.md b/data_dictionaries/linux/osquery/events/portage_packages.md new file mode 100644 index 000000000..5843f4177 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/portage_packages.md @@ -0,0 +1,22 @@ +# Portage_packages Table + +## Description +List of currently installed packages. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|package|TEXT|Package name|`TBD`| +|TBD|version|TEXT|The version which are affected by the use flags, empty means all|`TBD`| +|TBD|slot|TEXT|The slot used by package|`TBD`| +|TBD|build_time|BIGINT|Unix time when package was built|`TBD`| +|TBD|repository|TEXT|From which repository the ebuild was used|`TBD`| +|TBD|eapi|BIGINT|The eapi for the ebuild|`TBD`| +|TBD|size|BIGINT|The size of the package|`TBD`| +|TBD|world|INTEGER|If package is in the world file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#portage_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/portage_use.md b/data_dictionaries/linux/osquery/events/portage_use.md new file mode 100644 index 000000000..8d6a381e7 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/portage_use.md @@ -0,0 +1,17 @@ +# Portage_use Table + +## Description +List of enabled portage USE values for specific package. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|package|TEXT|Package name|`TBD`| +|TBD|version|TEXT|The version of the installed package|`TBD`| +|TBD|use|TEXT|USE flag which has been enabled for package|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#portage_use) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/process_envs.md b/data_dictionaries/linux/osquery/events/process_envs.md new file mode 100644 index 000000000..2cdc24e28 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/process_envs.md @@ -0,0 +1,17 @@ +# Process_envs Table + +## Description +A key/value table of environment variables for each process. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|key|TEXT|Environment variable name|`TBD`| +|TBD|value|TEXT|Environment variable value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_envs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/process_events.md b/data_dictionaries/linux/osquery/events/process_events.md new file mode 100644 index 000000000..95a38e6aa --- /dev/null +++ b/data_dictionaries/linux/osquery/events/process_events.md @@ -0,0 +1,41 @@ +# Process_events Table + +## Description +Track time/action process executions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|path|TEXT|Path of executed file|`TBD`| +|TBD|mode|TEXT|File mode permissions|`TBD`| +|TBD|cmdline|TEXT|Command line arguments (argv)|`TBD`| +|TBD|cmdline_size|BIGINT|Actual size (bytes) of command line arguments|`TBD`| +|TBD|env|TEXT|Environment variables delimited by spaces|`TBD`| +|TBD|env_count|BIGINT|Number of environment variables|`TBD`| +|TBD|env_size|BIGINT|Actual size (bytes) of environment list|`TBD`| +|TBD|cwd|TEXT|The process current working directory|`TBD`| +|TBD|auid|BIGINT|Audit User ID at process start|`TBD`| +|TBD|uid|BIGINT|User ID at process start|`TBD`| +|TBD|euid|BIGINT|Effective user ID at process start|`TBD`| +|TBD|gid|BIGINT|Group ID at process start|`TBD`| +|TBD|egid|BIGINT|Effective group ID at process start|`TBD`| +|TBD|owner_uid|BIGINT|File owner user ID|`TBD`| +|TBD|owner_gid|BIGINT|File owner group ID|`TBD`| +|TBD|atime|BIGINT|File last access in UNIX time|`TBD`| +|TBD|mtime|BIGINT|File modification in UNIX time|`TBD`| +|TBD|ctime|BIGINT|File last metadata change in UNIX time|`TBD`| +|TBD|btime|BIGINT|File creation in UNIX time|`TBD`| +|TBD|overflows|TEXT|List of structures that overflowed|`TBD`| +|TBD|parent|BIGINT|Process parent's PID, or -1 if cannot be determined.|`TBD`| +|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`| +|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| +|TBD|status|BIGINT|OpenBSM Attribute: Status of the process [DARWIN]|`TBD`| +|TBD|syscall|TEXT|Syscall name: fork, vfork, clone, execve, execveat [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/process_file_events.md b/data_dictionaries/linux/osquery/events/process_file_events.md new file mode 100644 index 000000000..70edb2490 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/process_file_events.md @@ -0,0 +1,29 @@ +# Process_file_events Table + +## Description +A File Integrity Monitor implementation using the audit service. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|operation|TEXT|Operation type|`TBD`| +|TBD|pid|BIGINT|Process ID|`TBD`| +|TBD|ppid|BIGINT|Parent process ID|`TBD`| +|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`| +|TBD|executable|TEXT|The executable path|`TBD`| +|TBD|partial|TEXT|True if this is a partial event (i.e.: this process existed before we started osquery)|`TBD`| +|TBD|cwd|TEXT|The current working directory of the process|`TBD`| +|TBD|path|TEXT|The path associated with the event|`TBD`| +|TBD|dest_path|TEXT|The canonical path associated with the event|`TBD`| +|TBD|uid|TEXT|The uid of the process performing the action|`TBD`| +|TBD|gid|TEXT|The gid of the process performing the action|`TBD`| +|TBD|euid|TEXT|Effective user ID of the process using the file|`TBD`| +|TBD|egid|TEXT|Effective group ID of the process using the file|`TBD`| +|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_file_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/process_memory_map.md b/data_dictionaries/linux/osquery/events/process_memory_map.md new file mode 100644 index 000000000..16fabc750 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/process_memory_map.md @@ -0,0 +1,23 @@ +# Process_memory_map Table + +## Description +Process memory mapped files and pseudo device/regions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|start|TEXT|Virtual start address (hex)|`TBD`| +|TBD|end|TEXT|Virtual end address (hex)|`TBD`| +|TBD|permissions|TEXT|r=read, w=write, x=execute, p=private (cow)|`TBD`| +|TBD|offset|BIGINT|Offset into mapped path|`TBD`| +|TBD|device|TEXT|MA:MI Major/minor device ID|`TBD`| +|TBD|inode|INTEGER|Mapped path inode, 0 means uninitialized (BSS)|`TBD`| +|TBD|path|TEXT|Path to mapped file or mapped type|`TBD`| +|TBD|pseudo|INTEGER|1 If path is a pseudo path, else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_memory_map) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/process_namespaces.md b/data_dictionaries/linux/osquery/events/process_namespaces.md new file mode 100644 index 000000000..e0b7d1dfb --- /dev/null +++ b/data_dictionaries/linux/osquery/events/process_namespaces.md @@ -0,0 +1,22 @@ +# Process_namespaces Table + +## Description +Linux namespaces for processes running on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|cgroup_namespace|TEXT|cgroup namespace inode|`TBD`| +|TBD|ipc_namespace|TEXT|ipc namespace inode|`TBD`| +|TBD|mnt_namespace|TEXT|mnt namespace inode|`TBD`| +|TBD|net_namespace|TEXT|net namespace inode|`TBD`| +|TBD|pid_namespace|TEXT|pid namespace inode|`TBD`| +|TBD|user_namespace|TEXT|user namespace inode|`TBD`| +|TBD|uts_namespace|TEXT|uts namespace inode|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_namespaces) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/process_open_files.md b/data_dictionaries/linux/osquery/events/process_open_files.md new file mode 100644 index 000000000..7ccd4e03e --- /dev/null +++ b/data_dictionaries/linux/osquery/events/process_open_files.md @@ -0,0 +1,17 @@ +# Process_open_files Table + +## Description +File descriptors for each process. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|fd|BIGINT|Process-specific file descriptor number|`TBD`| +|TBD|path|TEXT|Filesystem path of descriptor|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_open_files) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/process_open_pipes.md b/data_dictionaries/linux/osquery/events/process_open_pipes.md new file mode 100644 index 000000000..3b3994e07 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/process_open_pipes.md @@ -0,0 +1,22 @@ +# Process_open_pipes Table + +## Description +Pipes and partner processes for each process. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process ID|`TBD`| +|TBD|fd|BIGINT|File descriptor|`TBD`| +|TBD|mode|TEXT|Pipe open mode (r/w)|`TBD`| +|TBD|inode|BIGINT|Pipe inode number|`TBD`| +|TBD|type|TEXT|Pipe Type: named vs unnamed/anonymous|`TBD`| +|TBD|partner_pid|BIGINT|Process ID of partner process sharing a particular pipe|`TBD`| +|TBD|partner_fd|BIGINT|File descriptor of shared pipe at partner's end|`TBD`| +|TBD|partner_mode|TEXT|Mode of shared pipe at partner's end|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_open_pipes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/process_open_sockets.md b/data_dictionaries/linux/osquery/events/process_open_sockets.md new file mode 100644 index 000000000..25cedbac6 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/process_open_sockets.md @@ -0,0 +1,26 @@ +# Process_open_sockets Table + +## Description +Processes which have open network sockets on the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|fd|BIGINT|Socket file descriptor number|`TBD`| +|TBD|socket|BIGINT|Socket handle or inode number|`TBD`| +|TBD|family|INTEGER|Network protocol (IPv4, IPv6)|`TBD`| +|TBD|protocol|INTEGER|Transport protocol (TCP/UDP)|`TBD`| +|TBD|local_address|TEXT|Socket local address|`TBD`| +|TBD|remote_address|TEXT|Socket remote address|`TBD`| +|TBD|local_port|INTEGER|Socket local port|`TBD`| +|TBD|remote_port|INTEGER|Socket remote port|`TBD`| +|TBD|path|TEXT|For UNIX sockets (family=AF_UNIX), the domain path|`TBD`| +|TBD|state|TEXT|TCP socket state [lambda: LINUX() or DARWIN() or WINDOWS()]|`TBD`| +|TBD|net_namespace|TEXT|The inode number of the network namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_open_sockets) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/processes.md b/data_dictionaries/linux/osquery/events/processes.md new file mode 100644 index 000000000..b2f1687d7 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/processes.md @@ -0,0 +1,47 @@ +# Processes Table + +## Description +All running processes on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|name|TEXT|The process path or shorthand argv[0]|`TBD`| +|TBD|path|TEXT|Path to executed binary|`TBD`| +|TBD|cmdline|TEXT|Complete argv|`TBD`| +|TBD|state|TEXT|Process state|`TBD`| +|TBD|cwd|TEXT|Process current working directory|`TBD`| +|TBD|root|TEXT|Process virtual root directory|`TBD`| +|TBD|uid|BIGINT|Unsigned user ID|`TBD`| +|TBD|gid|BIGINT|Unsigned group ID|`TBD`| +|TBD|euid|BIGINT|Unsigned effective user ID|`TBD`| +|TBD|egid|BIGINT|Unsigned effective group ID|`TBD`| +|TBD|suid|BIGINT|Unsigned saved user ID|`TBD`| +|TBD|sgid|BIGINT|Unsigned saved group ID|`TBD`| +|TBD|wired_size|BIGINT|Bytes of unpagable memory used by process|`TBD`| +|TBD|resident_size|BIGINT|Bytes of private memory used by process|`TBD`| +|TBD|total_size|BIGINT|Total virtual memory size|`TBD`| +|TBD|user_time|BIGINT|CPU time in milliseconds spent in user space|`TBD`| +|TBD|system_time|BIGINT|CPU time in milliseconds spent in kernel space|`TBD`| +|TBD|disk_bytes_read|BIGINT|Bytes read from disk|`TBD`| +|TBD|disk_bytes_written|BIGINT|Bytes written to disk|`TBD`| +|TBD|start_time|BIGINT|Process start time in seconds since Epoch, in case of error -1|`TBD`| +|TBD|parent|BIGINT|Process parent's PID|`TBD`| +|TBD|pgroup|BIGINT|Process group|`TBD`| +|TBD|threads|INTEGER|Number of threads used by process|`TBD`| +|TBD|nice|INTEGER|Process nice level (-20 to 20, default 0)|`TBD`| +|TBD|is_elevated_token|INTEGER|Process uses elevated token yes=1, no=0 [WINDOWS]|`TBD`| +|TBD|elapsed_time|BIGINT|Elapsed time in seconds this process has been running. [WINDOWS]|`TBD`| +|TBD|handle_count|BIGINT|Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process. [WINDOWS]|`TBD`| +|TBD|percent_processor_time|BIGINT|Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks. [WINDOWS]|`TBD`| +|TBD|upid|BIGINT|A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|uppid|BIGINT|The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|cpu_type|INTEGER|A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|cpu_subtype|INTEGER|The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#processes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/prometheus_metrics.md b/data_dictionaries/linux/osquery/events/prometheus_metrics.md new file mode 100644 index 000000000..b709485b8 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/prometheus_metrics.md @@ -0,0 +1,18 @@ +# Prometheus_metrics Table + +## Description +Retrieve metrics from a Prometheus server. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|target_name|TEXT|Address of prometheus target|`TBD`| +|TBD|metric_name|TEXT|Name of collected Prometheus metric|`TBD`| +|TBD|metric_value|DOUBLE|Value of collected Prometheus metric|`TBD`| +|TBD|timestamp_ms|BIGINT|Unix timestamp of collected data in MS|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#prometheus_metrics) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/python_packages.md b/data_dictionaries/linux/osquery/events/python_packages.md new file mode 100644 index 000000000..af502ce5b --- /dev/null +++ b/data_dictionaries/linux/osquery/events/python_packages.md @@ -0,0 +1,21 @@ +# Python_packages Table + +## Description +Python packages installed in a system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package display name|`TBD`| +|TBD|version|TEXT|Package-supplied version|`TBD`| +|TBD|summary|TEXT|Package-supplied summary|`TBD`| +|TBD|author|TEXT|Optional package author|`TBD`| +|TBD|license|TEXT|License under which package is launched|`TBD`| +|TBD|path|TEXT|Path at which this module resides|`TBD`| +|TBD|directory|TEXT|Directory where Python modules are located|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#python_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/routes.md b/data_dictionaries/linux/osquery/events/routes.md new file mode 100644 index 000000000..5197fbf35 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/routes.md @@ -0,0 +1,24 @@ +# Routes Table + +## Description +The active route table for the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|destination|TEXT|Destination IP address|`TBD`| +|TBD|netmask|INTEGER|Netmask length|`TBD`| +|TBD|gateway|TEXT|Route gateway|`TBD`| +|TBD|source|TEXT|Route source|`TBD`| +|TBD|flags|INTEGER|Flags to describe route|`TBD`| +|TBD|interface|TEXT|Route local interface|`TBD`| +|TBD|mtu|INTEGER|Maximum Transmission Unit for the route|`TBD`| +|TBD|metric|INTEGER|Cost of route. Lowest is preferred|`TBD`| +|TBD|type|TEXT|Type of route|`TBD`| +|TBD|hopcount|INTEGER|Max hops expected [POSIX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#routes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/rpm_package_files.md b/data_dictionaries/linux/osquery/events/rpm_package_files.md new file mode 100644 index 000000000..2457b2f6b --- /dev/null +++ b/data_dictionaries/linux/osquery/events/rpm_package_files.md @@ -0,0 +1,21 @@ +# Rpm_package_files Table + +## Description +RPM packages that are currently installed on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|package|TEXT|RPM package name|`TBD`| +|TBD|path|TEXT|File path within the package|`TBD`| +|TBD|username|TEXT|File default username from info DB|`TBD`| +|TBD|groupname|TEXT|File default groupname from info DB|`TBD`| +|TBD|mode|TEXT|File permissions mode from info DB|`TBD`| +|TBD|size|BIGINT|Expected file size in bytes from RPM info DB|`TBD`| +|TBD|sha256|TEXT|SHA256 file digest from RPM info DB|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#rpm_package_files) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/rpm_packages.md b/data_dictionaries/linux/osquery/events/rpm_packages.md new file mode 100644 index 000000000..a7132f9b1 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/rpm_packages.md @@ -0,0 +1,23 @@ +# Rpm_packages Table + +## Description +RPM packages that are currently installed on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|RPM package name|`TBD`| +|TBD|version|TEXT|Package version|`TBD`| +|TBD|release|TEXT|Package release|`TBD`| +|TBD|source|TEXT|Source RPM package name (optional)|`TBD`| +|TBD|size|BIGINT|Package size in bytes|`TBD`| +|TBD|sha1|TEXT|SHA1 hash of the package contents|`TBD`| +|TBD|arch|TEXT|Architecture(s) supported|`TBD`| +|TBD|epoch|INTEGER|Package epoch value|`TBD`| +|TBD|install_time|INTEGER|When the package was installed|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#rpm_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/selinux_events.md b/data_dictionaries/linux/osquery/events/selinux_events.md new file mode 100644 index 000000000..f56bf51f7 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/selinux_events.md @@ -0,0 +1,19 @@ +# Selinux_events Table + +## Description +Track SELinux events. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|Event type|`TBD`| +|TBD|message|TEXT|Message|`TBD`| +|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`| +|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#selinux_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/selinux_settings.md b/data_dictionaries/linux/osquery/events/selinux_settings.md new file mode 100644 index 000000000..182de9356 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/selinux_settings.md @@ -0,0 +1,17 @@ +# Selinux_settings Table + +## Description +Track active SELinux settings. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|scope|TEXT|Where the key is located inside the SELinuxFS mount point.|`TBD`| +|TBD|key|TEXT|Key or class name.|`TBD`| +|TBD|value|TEXT|Active value.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#selinux_settings) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/shadow.md b/data_dictionaries/linux/osquery/events/shadow.md new file mode 100644 index 000000000..517c85738 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/shadow.md @@ -0,0 +1,24 @@ +# Shadow Table + +## Description +Local system users encrypted passwords and related information. Please note, that you usually need superuser rights to access `/etc/shadow`. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|password_status|TEXT|Password status|`TBD`| +|TBD|hash_alg|TEXT|Password hashing algorithm|`TBD`| +|TBD|last_change|BIGINT|Date of last password change (starting from UNIX epoch date)|`TBD`| +|TBD|min|BIGINT|Minimal number of days between password changes|`TBD`| +|TBD|max|BIGINT|Maximum number of days between password changes|`TBD`| +|TBD|warning|BIGINT|Number of days before password expires to warn user about it|`TBD`| +|TBD|inactive|BIGINT|Number of days after password expires until account is blocked|`TBD`| +|TBD|expire|BIGINT|Number of days since UNIX epoch date until account is disabled|`TBD`| +|TBD|flag|BIGINT|Reserved|`TBD`| +|TBD|username|TEXT|Username|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#shadow) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/shared_memory.md b/data_dictionaries/linux/osquery/events/shared_memory.md new file mode 100644 index 000000000..d6a38c31e --- /dev/null +++ b/data_dictionaries/linux/osquery/events/shared_memory.md @@ -0,0 +1,27 @@ +# Shared_memory Table + +## Description +OS shared memory regions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|shmid|INTEGER|Shared memory segment ID|`TBD`| +|TBD|owner_uid|BIGINT|User ID of owning process|`TBD`| +|TBD|creator_uid|BIGINT|User ID of creator process|`TBD`| +|TBD|pid|BIGINT|Process ID to last use the segment|`TBD`| +|TBD|creator_pid|BIGINT|Process ID that created the segment|`TBD`| +|TBD|atime|BIGINT|Attached time|`TBD`| +|TBD|dtime|BIGINT|Detached time|`TBD`| +|TBD|ctime|BIGINT|Changed time|`TBD`| +|TBD|permissions|TEXT|Memory segment permissions|`TBD`| +|TBD|size|BIGINT|Size in bytes|`TBD`| +|TBD|attached|INTEGER|Number of attached processes|`TBD`| +|TBD|status|TEXT|Destination/attach status|`TBD`| +|TBD|locked|INTEGER|1 if segment is locked else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#shared_memory) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/shell_history.md b/data_dictionaries/linux/osquery/events/shell_history.md new file mode 100644 index 000000000..6a16aabea --- /dev/null +++ b/data_dictionaries/linux/osquery/events/shell_history.md @@ -0,0 +1,18 @@ +# Shell_history Table + +## Description +A line-delimited (command) table of per-user .*_history data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|Shell history owner|`TBD`| +|TBD|time|INTEGER|Entry timestamp. It could be absent, default value is 0.|`TBD`| +|TBD|command|TEXT|Unparsed date/line/command history line|`TBD`| +|TBD|history_file|TEXT|Path to the .*_history for this user|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#shell_history) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/smart_drive_info.md b/data_dictionaries/linux/osquery/events/smart_drive_info.md new file mode 100644 index 000000000..7af5a1079 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/smart_drive_info.md @@ -0,0 +1,32 @@ +# Smart_drive_info Table + +## Description +Drive information read by SMART controller utilizing autodetect. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device_name|TEXT|Name of block device|`TBD`| +|TBD|model_family|TEXT|Drive model family|`TBD`| +|TBD|device_model|TEXT|Device Model|`TBD`| +|TBD|serial_number|TEXT|Device serial number|`TBD`| +|TBD|lu_wwn_device_id|TEXT|Device Identifier|`TBD`| +|TBD|firmware_version|TEXT|Drive firmware version|`TBD`| +|TBD|user_capacity|TEXT|Bytes of drive capacity|`TBD`| +|TBD|sector_sizes|TEXT|Bytes of drive sector sizes|`TBD`| +|TBD|rotation_rate|TEXT|Drive RPM|`TBD`| +|TBD|form_factor|TEXT|Form factor if reported|`TBD`| +|TBD|ata_version|TEXT|ATA version of drive|`TBD`| +|TBD|transport_type|TEXT|Drive transport type|`TBD`| +|TBD|sata_version|TEXT|SATA version, if any|`TBD`| +|TBD|smart_supported|TEXT|SMART support status|`TBD`| +|TBD|smart_enabled|TEXT|SMART enabled status|`TBD`| +|TBD|packet_device_type|TEXT|Packet device type|`TBD`| +|TBD|power_mode|TEXT|Device power mode|`TBD`| +|TBD|warnings|TEXT|Warning messages from SMART controller|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#smart_drive_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/smbios_tables.md b/data_dictionaries/linux/osquery/events/smbios_tables.md new file mode 100644 index 000000000..69b18ea4d --- /dev/null +++ b/data_dictionaries/linux/osquery/events/smbios_tables.md @@ -0,0 +1,21 @@ +# Smbios_tables Table + +## Description +BIOS (DMI) structure common details and content. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|number|INTEGER|Table entry number|`TBD`| +|TBD|type|INTEGER|Table entry type|`TBD`| +|TBD|description|TEXT|Table entry description|`TBD`| +|TBD|handle|INTEGER|Table entry handle|`TBD`| +|TBD|header_size|INTEGER|Header size in bytes|`TBD`| +|TBD|size|INTEGER|Table entry size in bytes|`TBD`| +|TBD|md5|TEXT|MD5 hash of table entry|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#smbios_tables) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/socket_events.md b/data_dictionaries/linux/osquery/events/socket_events.md new file mode 100644 index 000000000..34ed81a83 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/socket_events.md @@ -0,0 +1,30 @@ +# Socket_events Table + +## Description +Track network socket opens and closes. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|action|TEXT|The socket action (bind, listen, close)|`TBD`| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|path|TEXT|Path of executed file|`TBD`| +|TBD|fd|TEXT|The file description for the process socket|`TBD`| +|TBD|auid|BIGINT|Audit User ID|`TBD`| +|TBD|success|INTEGER|The socket open attempt status|`TBD`| +|TBD|family|INTEGER|The Internet protocol family ID|`TBD`| +|TBD|protocol|INTEGER|The network protocol ID|`TBD`| +|TBD|local_address|TEXT|Local address associated with socket|`TBD`| +|TBD|remote_address|TEXT|Remote address associated with socket|`TBD`| +|TBD|local_port|INTEGER|Local network protocol port number|`TBD`| +|TBD|remote_port|INTEGER|Remote network protocol port number|`TBD`| +|TBD|socket|TEXT|The local path (UNIX domain socket only)|`TBD`| +|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`| +|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#socket_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/ssh_configs.md b/data_dictionaries/linux/osquery/events/ssh_configs.md new file mode 100644 index 000000000..66ac48247 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/ssh_configs.md @@ -0,0 +1,17 @@ +# Ssh_configs Table + +## Description +A table of parsed ssh_configs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local owner of the ssh_config file|`TBD`| +|TBD|option|TEXT|The option and value|`TBD`| +|TBD|ssh_config_file|TEXT|Path to the ssh_config file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ssh_configs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/sudoers.md b/data_dictionaries/linux/osquery/events/sudoers.md new file mode 100644 index 000000000..29e671554 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/sudoers.md @@ -0,0 +1,17 @@ +# Sudoers Table + +## Description +Rules for running commands as other users via sudo. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|source|TEXT|Source file containing the given rule|`TBD`| +|TBD|header|TEXT|Symbol for given rule|`TBD`| +|TBD|rule_details|TEXT|Rule definition|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#sudoers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/suid_bin.md b/data_dictionaries/linux/osquery/events/suid_bin.md new file mode 100644 index 000000000..f3ea944a8 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/suid_bin.md @@ -0,0 +1,18 @@ +# Suid_bin Table + +## Description +suid binaries in common locations. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Binary path|`TBD`| +|TBD|username|TEXT|Binary owner username|`TBD`| +|TBD|groupname|TEXT|Binary owner group|`TBD`| +|TBD|permissions|TEXT|Binary permissions|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#suid_bin) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/syslog_events.md b/data_dictionaries/linux/osquery/events/syslog_events.md new file mode 100644 index 000000000..8eed97274 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/syslog_events.md @@ -0,0 +1,22 @@ +# Syslog_events Table + +## Description + + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|time|BIGINT|Current unix epoch time|`TBD`| +|TBD|datetime|TEXT|Time known to syslog|`TBD`| +|TBD|host|TEXT|Hostname configured for syslog|`TBD`| +|TBD|severity|INTEGER|Syslog severity|`TBD`| +|TBD|facility|TEXT|Syslog facility|`TBD`| +|TBD|tag|TEXT|The syslog tag|`TBD`| +|TBD|message|TEXT|The syslog message|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#syslog_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/system_controls.md b/data_dictionaries/linux/osquery/events/system_controls.md new file mode 100644 index 000000000..e180727c0 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/system_controls.md @@ -0,0 +1,21 @@ +# System_controls Table + +## Description +sysctl names, values, and settings information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Full sysctl MIB name|`TBD`| +|TBD|oid|TEXT|Control MIB|`TBD`| +|TBD|subsystem|TEXT|Subsystem ID, control type|`TBD`| +|TBD|current_value|TEXT|Value of setting|`TBD`| +|TBD|config_value|TEXT|The MIB value set in /etc/sysctl.conf|`TBD`| +|TBD|type|TEXT|Data type|`TBD`| +|TBD|field_name|TEXT|Specific attribute of opaque type [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#system_controls) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/system_info.md b/data_dictionaries/linux/osquery/events/system_info.md new file mode 100644 index 000000000..482c3c621 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/system_info.md @@ -0,0 +1,29 @@ +# System_info Table + +## Description +System information for identification. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|hostname|TEXT|Network hostname including domain|`TBD`| +|TBD|uuid|TEXT|Unique ID provided by the system|`TBD`| +|TBD|cpu_type|TEXT|CPU type|`TBD`| +|TBD|cpu_subtype|TEXT|CPU subtype|`TBD`| +|TBD|cpu_brand|TEXT|CPU brand string, contains vendor and model|`TBD`| +|TBD|cpu_physical_cores|INTEGER|Number of physical CPU cores in to the system|`TBD`| +|TBD|cpu_logical_cores|INTEGER|Number of logical CPU cores available to the system|`TBD`| +|TBD|cpu_microcode|TEXT|Microcode version|`TBD`| +|TBD|physical_memory|BIGINT|Total physical memory in bytes|`TBD`| +|TBD|hardware_vendor|TEXT|Hardware or board vendor|`TBD`| +|TBD|hardware_model|TEXT|Hardware or board model|`TBD`| +|TBD|hardware_version|TEXT|Hardware or board version|`TBD`| +|TBD|hardware_serial|TEXT|Device or board serial number|`TBD`| +|TBD|computer_name|TEXT|Friendly computer name (optional)|`TBD`| +|TBD|local_hostname|TEXT|Local hostname (optional)|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#system_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/time.md b/data_dictionaries/linux/osquery/events/time.md new file mode 100644 index 000000000..9f9b27746 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/time.md @@ -0,0 +1,28 @@ +# Time Table + +## Description +Track current date and time in the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|weekday|TEXT|Current weekday in the system|`TBD`| +|TBD|year|INTEGER|Current year in the system|`TBD`| +|TBD|month|INTEGER|Current month in the system|`TBD`| +|TBD|day|INTEGER|Current day in the system|`TBD`| +|TBD|hour|INTEGER|Current hour in the system|`TBD`| +|TBD|minutes|INTEGER|Current minutes in the system|`TBD`| +|TBD|seconds|INTEGER|Current seconds in the system|`TBD`| +|TBD|timezone|TEXT|Current timezone in the system|`TBD`| +|TBD|local_time|INTEGER|Current local UNIX time in the system|`TBD`| +|TBD|local_timezone|TEXT|Current local timezone in the system|`TBD`| +|TBD|timestamp|TEXT|Current timestamp (log format) in the system|`TBD`| +|TBD|datetime|TEXT|Current date and time (ISO format) in the system|`TBD`| +|TBD|iso_8601|TEXT|Current time (ISO format) in the system|`TBD`| +|TBD|win_timestamp|BIGINT|Timestamp value in 100 nanosecond units. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#time) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/ulimit_info.md b/data_dictionaries/linux/osquery/events/ulimit_info.md new file mode 100644 index 000000000..84b753a00 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/ulimit_info.md @@ -0,0 +1,17 @@ +# Ulimit_info Table + +## Description +System resource usage limits. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|System resource to be limited|`TBD`| +|TBD|soft_limit|TEXT|Current limit value|`TBD`| +|TBD|hard_limit|TEXT|Maximum limit value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ulimit_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/uptime.md b/data_dictionaries/linux/osquery/events/uptime.md new file mode 100644 index 000000000..932b0c6f9 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/uptime.md @@ -0,0 +1,19 @@ +# Uptime Table + +## Description +Track time passed since last boot. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|days|INTEGER|Days of uptime|`TBD`| +|TBD|hours|INTEGER|Hours of uptime|`TBD`| +|TBD|minutes|INTEGER|Minutes of uptime|`TBD`| +|TBD|seconds|INTEGER|Seconds of uptime|`TBD`| +|TBD|total_seconds|BIGINT|Total uptime seconds|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#uptime) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/usb_devices.md b/data_dictionaries/linux/osquery/events/usb_devices.md new file mode 100644 index 000000000..dd6e513ff --- /dev/null +++ b/data_dictionaries/linux/osquery/events/usb_devices.md @@ -0,0 +1,26 @@ +# Usb_devices Table + +## Description +USB devices that are actively plugged into the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|usb_address|INTEGER|USB Device used address|`TBD`| +|TBD|usb_port|INTEGER|USB Device used port|`TBD`| +|TBD|vendor|TEXT|USB Device vendor string|`TBD`| +|TBD|vendor_id|TEXT|Hex encoded USB Device vendor identifier|`TBD`| +|TBD|version|TEXT|USB Device version number|`TBD`| +|TBD|model|TEXT|USB Device model string|`TBD`| +|TBD|model_id|TEXT|Hex encoded USB Device model identifier|`TBD`| +|TBD|serial|TEXT|USB Device serial connection|`TBD`| +|TBD|class|TEXT|USB Device class|`TBD`| +|TBD|subclass|TEXT|USB Device subclass|`TBD`| +|TBD|protocol|TEXT|USB Device protocol|`TBD`| +|TBD|removable|INTEGER|1 If USB device is removable else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#usb_devices) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/user_events.md b/data_dictionaries/linux/osquery/events/user_events.md new file mode 100644 index 000000000..7df9bde68 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/user_events.md @@ -0,0 +1,25 @@ +# User_events Table + +## Description +Track user events from the audit framework. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|auid|BIGINT|Audit User ID|`TBD`| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|message|TEXT|Message from the event|`TBD`| +|TBD|type|INTEGER|The file description for the process socket|`TBD`| +|TBD|path|TEXT|Supplied path from event|`TBD`| +|TBD|address|TEXT|The Internet protocol address or family ID|`TBD`| +|TBD|terminal|TEXT|The network protocol ID|`TBD`| +|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`| +|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/user_groups.md b/data_dictionaries/linux/osquery/events/user_groups.md new file mode 100644 index 000000000..1a21adc67 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/user_groups.md @@ -0,0 +1,16 @@ +# User_groups Table + +## Description +Local system user group relationships. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|gid|BIGINT|Group ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_groups) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/user_ssh_keys.md b/data_dictionaries/linux/osquery/events/user_ssh_keys.md new file mode 100644 index 000000000..3629444fc --- /dev/null +++ b/data_dictionaries/linux/osquery/events/user_ssh_keys.md @@ -0,0 +1,17 @@ +# User_ssh_keys Table + +## Description +Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the key file|`TBD`| +|TBD|path|TEXT|Path to key file|`TBD`| +|TBD|encrypted|INTEGER|1 if key is encrypted, 0 otherwise|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_ssh_keys) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/users.md b/data_dictionaries/linux/osquery/events/users.md new file mode 100644 index 000000000..e67c033ca --- /dev/null +++ b/data_dictionaries/linux/osquery/events/users.md @@ -0,0 +1,25 @@ +# Users Table + +## Description +Local user accounts (including domain accounts that have logged on locally (Windows)). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|gid|BIGINT|Group ID (unsigned)|`TBD`| +|TBD|uid_signed|BIGINT|User ID as int64 signed (Apple)|`TBD`| +|TBD|gid_signed|BIGINT|Default group ID as int64 signed (Apple)|`TBD`| +|TBD|username|TEXT|Username|`TBD`| +|TBD|description|TEXT|Optional user description|`TBD`| +|TBD|directory|TEXT|User's home directory|`TBD`| +|TBD|shell|TEXT|User's configured default shell|`TBD`| +|TBD|uuid|TEXT|User's UUID (Apple) or SID (Windows)|`TBD`| +|TBD|type|TEXT|Whether the account is roaming (domain), local, or a system profile [WINDOWS]|`TBD`| +|TBD|is_hidden|INTEGER|IsHidden attribute set in OpenDirectory [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#users) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/yara.md b/data_dictionaries/linux/osquery/events/yara.md new file mode 100644 index 000000000..141f9ed96 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/yara.md @@ -0,0 +1,21 @@ +# Yara Table + +## Description +Track YARA matches for files or PIDs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|The path scanned|`TBD`| +|TBD|matches|TEXT|List of YARA matches|`TBD`| +|TBD|count|INTEGER|Number of YARA matches|`TBD`| +|TBD|sig_group|TEXT|Signature group used|`TBD`| +|TBD|sigfile|TEXT|Signature file used|`TBD`| +|TBD|strings|TEXT|Matching strings|`TBD`| +|TBD|tags|TEXT|Matching tags|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#yara) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/yara_events.md b/data_dictionaries/linux/osquery/events/yara_events.md new file mode 100644 index 000000000..67d243cbd --- /dev/null +++ b/data_dictionaries/linux/osquery/events/yara_events.md @@ -0,0 +1,24 @@ +# Yara_events Table + +## Description +Track YARA matches for files specified in configuration data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|target_path|TEXT|The path scanned|`TBD`| +|TBD|category|TEXT|The category of the file|`TBD`| +|TBD|action|TEXT|Change action (UPDATE, REMOVE, etc)|`TBD`| +|TBD|transaction_id|BIGINT|ID used during bulk update|`TBD`| +|TBD|matches|TEXT|List of YARA matches|`TBD`| +|TBD|count|INTEGER|Number of YARA matches|`TBD`| +|TBD|strings|TEXT|Matching strings|`TBD`| +|TBD|tags|TEXT|Matching tags|`TBD`| +|TBD|time|BIGINT|Time of the scan|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#yara_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/linux/osquery/events/yum_sources.md b/data_dictionaries/linux/osquery/events/yum_sources.md new file mode 100644 index 000000000..0c8265bf4 --- /dev/null +++ b/data_dictionaries/linux/osquery/events/yum_sources.md @@ -0,0 +1,19 @@ +# Yum_sources Table + +## Description +Current list of Yum repositories or software channels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Repository name|`TBD`| +|TBD|baseurl|TEXT|Repository base URL|`TBD`| +|TBD|enabled|TEXT|Whether the repository is used|`TBD`| +|TBD|gpgcheck|TEXT|Whether packages are GPG checked|`TBD`| +|TBD|gpgkey|TEXT|URL to GPG key|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#yum_sources) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/README.md b/data_dictionaries/macos/osquery/README.md index d74968aed..f6db0daf1 100644 --- a/data_dictionaries/macos/osquery/README.md +++ b/data_dictionaries/macos/osquery/README.md @@ -6,8 +6,177 @@ Osquery schema is defined in tables by osquery engineers. ## Sub Data Sets |events|Description|Tags| |---|---|---| -|[file](events/file.md)|Interactive filesystem attributes and metadata.|| +|[account_policy_data](events/account_policy_data.md)|Additional OS X user account data from the AccountPolicy section of OpenDirectory.|version_4.4.2| +|[acpi_tables](events/acpi_tables.md)|Firmware ACPI functional table common metadata and content.|version_4.4.2| +|[ad_config](events/ad_config.md)|OS X Active Directory configuration.|version_4.4.2| +|[alf](events/alf.md)|OS X application layer firewall (ALF) service details.|version_4.4.2| +|[alf_exceptions](events/alf_exceptions.md)|OS X application layer firewall (ALF) service exceptions.|version_4.4.2| +|[alf_explicit_auths](events/alf_explicit_auths.md)|ALF services explicitly allowed to perform networking.|version_4.4.2| +|[app_schemes](events/app_schemes.md)|OS X application schemes and handlers (e.g., http, file, mailto).|version_4.4.2| +|[apps](events/apps.md)|OS X applications installed in known search paths (e.g., /Applications).|version_4.4.2| +|[apt_sources](events/apt_sources.md)|Current list of APT repositories or software channels.|version_4.4.2| +|[arp_cache](events/arp_cache.md)|Address resolution cache, both static and dynamic (from ARP, NDP).|version_4.4.2| +|[asl](events/asl.md)|Queries the Apple System Log data structure for system events.|version_4.4.2| +|[atom_packages](events/atom_packages.md)|Lists all atom packages in a directory or globally installed in a system.|version_4.4.2| +|[augeas](events/augeas.md)|Configuration files parsed by augeas.|version_4.4.2| +|[authorization_mechanisms](events/authorization_mechanisms.md)|OS X Authorization mechanisms database.|version_4.4.2| +|[authorizations](events/authorizations.md)|OS X Authorization rights database.|version_4.4.2| +|[authorized_keys](events/authorized_keys.md)|A line-delimited authorized_keys table.|version_4.4.2| +|[azure_instance_metadata](events/azure_instance_metadata.md)|Azure instance metadata.|version_4.4.2| +|[azure_instance_tags](events/azure_instance_tags.md)|Azure instance tags.|version_4.4.2| +|[battery](events/battery.md)|Provides information about the internal battery of a Macbook.|version_4.4.2| +|[block_devices](events/block_devices.md)|Block (buffered access) device file nodes: disks, ramdisks, and DMG containers.|version_4.4.2| +|[browser_plugins](events/browser_plugins.md)|All C/NPAPI browser plugin details for all users.|version_4.4.2| +|[carbon_black_info](events/carbon_black_info.md)|Returns info about a Carbon Black sensor install.|version_4.4.2| +|[carves](events/carves.md)|Forensic Carves.|version_4.4.2| +|[certificates](events/certificates.md)|Certificate Authorities installed in Keychains/ca-bundles.|version_4.4.2| +|[chrome_extensions](events/chrome_extensions.md)|Chrome browser extensions.|version_4.4.2| +|[cpu_time](events/cpu_time.md)|Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.|version_4.4.2| +|[cpuid](events/cpuid.md)|Useful CPU features from the cpuid ASM call.|version_4.4.2| +|[crashes](events/crashes.md)|Application, System, and Mobile App crash logs.|version_4.4.2| +|[crontab](events/crontab.md)|Line parsed values from system and user cron/tab.|version_4.4.2| +|[cups_destinations](events/cups_destinations.md)|Returns all configured printers.|version_4.4.2| +|[cups_jobs](events/cups_jobs.md)|Returns all completed print jobs from cups.|version_4.4.2| +|[curl](events/curl.md)|Perform an http request and return stats about it.|version_4.4.2| +|[curl_certificate](events/curl_certificate.md)|Inspect TLS certificates by connecting to input hostnames.|version_4.4.2| +|[device_file](events/device_file.md)|Similar to the file table, but use TSK and allow block address access.|version_4.4.2| +|[device_firmware](events/device_firmware.md)|A best-effort list of discovered firmware versions.|version_4.4.2| +|[device_hash](events/device_hash.md)|Similar to the hash table, but use TSK and allow block address access.|version_4.4.2| +|[device_partitions](events/device_partitions.md)|Use TSK to enumerate details about partitions on a disk device.|version_4.4.2| +|[disk_encryption](events/disk_encryption.md)|Disk encryption status and information.|version_4.4.2| +|[disk_events](events/disk_events.md)|Track DMG disk image events (appearance/disappearance) when opened.|version_4.4.2| +|[dns_resolvers](events/dns_resolvers.md)|Resolvers used by this host.|version_4.4.2| +|[docker_container_labels](events/docker_container_labels.md)|Docker container labels.|version_4.4.2| +|[docker_container_mounts](events/docker_container_mounts.md)|Docker container mounts.|version_4.4.2| +|[docker_container_networks](events/docker_container_networks.md)|Docker container networks.|version_4.4.2| +|[docker_container_ports](events/docker_container_ports.md)|Docker container ports.|version_4.4.2| +|[docker_container_processes](events/docker_container_processes.md)|Docker container processes.|version_4.4.2| +|[docker_container_stats](events/docker_container_stats.md)|Docker container statistics. Queries on this table take at least one second.|version_4.4.2| +|[docker_containers](events/docker_containers.md)|Docker containers information.|version_4.4.2| +|[docker_image_labels](events/docker_image_labels.md)|Docker image labels.|version_4.4.2| +|[docker_image_layers](events/docker_image_layers.md)|Docker image layers information.|version_4.4.2| +|[docker_images](events/docker_images.md)|Docker images information.|version_4.4.2| +|[docker_info](events/docker_info.md)|Docker system information.|version_4.4.2| +|[docker_network_labels](events/docker_network_labels.md)|Docker network labels.|version_4.4.2| +|[docker_networks](events/docker_networks.md)|Docker networks information.|version_4.4.2| +|[docker_version](events/docker_version.md)|Docker version information.|version_4.4.2| +|[docker_volume_labels](events/docker_volume_labels.md)|Docker volume labels.|version_4.4.2| +|[docker_volumes](events/docker_volumes.md)|Docker volumes information.|version_4.4.2| +|[etc_hosts](events/etc_hosts.md)|Line-parsed /etc/hosts.|version_4.4.2| +|[etc_protocols](events/etc_protocols.md)|Line-parsed /etc/protocols.|version_4.4.2| +|[etc_services](events/etc_services.md)|Line-parsed /etc/services.|version_4.4.2| +|[event_taps](events/event_taps.md)|Returns information about installed event taps.|version_4.4.2| +|[example](events/example.md)|This is an example table spec.|version_4.4.2| +|[extended_attributes](events/extended_attributes.md)|Returns the extended attributes for files (similar to Windows ADS).|version_4.4.2| +|[fan_speed_sensors](events/fan_speed_sensors.md)|Fan speeds.|version_4.4.2| +|[file](events/file.md)|Interactive filesystem attributes and metadata.|version_4.4.2| +|[file_events](events/file_events.md)|Track time/action changes to files specified in configuration data.|version_4.4.2| +|[firefox_addons](events/firefox_addons.md)|Firefox browser extensions, webapps, and addons.|version_4.4.2| +|[gatekeeper](events/gatekeeper.md)|OS X Gatekeeper Details.|version_4.4.2| +|[gatekeeper_approved_apps](events/gatekeeper_approved_apps.md)|Gatekeeper apps a user has allowed to run.|version_4.4.2| +|[groups](events/groups.md)|Local system groups.|version_4.4.2| +|[hardware_events](events/hardware_events.md)|Hardware (PCI/USB/HID) events from UDEV or IOKit.|version_4.4.2| +|[hash](events/hash.md)|Filesystem hash data.|version_4.4.2| +|[homebrew_packages](events/homebrew_packages.md)|The installed homebrew package database.|version_4.4.2| +|[hvci_status](events/hvci_status.md)|Retrieve HVCI info of the machine.|version_4.4.2| +|[ibridge_info](events/ibridge_info.md)|Information about the Apple iBridge hardware controller.|version_4.4.2| +|[interface_addresses](events/interface_addresses.md)|Network interfaces and relevant metadata.|version_4.4.2| +|[interface_details](events/interface_details.md)|Detailed information and stats of network interfaces.|version_4.4.2| +|[interface_ipv6](events/interface_ipv6.md)|IPv6 configuration and stats of network interfaces.|version_4.4.2| +|[iokit_devicetree](events/iokit_devicetree.md)|The IOKit registry matching the DeviceTree plane.|version_4.4.2| +|[iokit_registry](events/iokit_registry.md)|The full IOKit registry without selecting a plane.|version_4.4.2| +|[kernel_extensions](events/kernel_extensions.md)|OS X's kernel extensions, both loaded and within the load search path.|version_4.4.2| +|[kernel_info](events/kernel_info.md)|Basic active kernel information.|version_4.4.2| +|[kernel_panics](events/kernel_panics.md)|System kernel panic logs.|version_4.4.2| +|[keychain_acls](events/keychain_acls.md)|Applications that have ACL entries in the keychain.|version_4.4.2| +|[keychain_items](events/keychain_items.md)|Generic details about keychain items.|version_4.4.2| +|[known_hosts](events/known_hosts.md)|A line-delimited known_hosts table.|version_4.4.2| +|[last](events/last.md)|System logins and logouts.|version_4.4.2| +|[launchd](events/launchd.md)|LaunchAgents and LaunchDaemons from default search paths.|version_4.4.2| +|[launchd_overrides](events/launchd_overrides.md)|Override keys, per user, for LaunchDaemons and Agents.|version_4.4.2| +|[listening_ports](events/listening_ports.md)|Processes with listening (bound) network sockets/ports.|version_4.4.2| +|[lldp_neighbors](events/lldp_neighbors.md)|LLDP neighbors of interfaces.|version_4.4.2| +|[load_average](events/load_average.md)|Displays information about the system wide load averages.|version_4.4.2| +|[logged_in_users](events/logged_in_users.md)|Users with an active shell on the system.|version_4.4.2| +|[magic](events/magic.md)|Magic number recognition library table.|version_4.4.2| +|[managed_policies](events/managed_policies.md)|The managed configuration policies from AD, MDM, MCX, etc.|version_4.4.2| +|[mdfind](events/mdfind.md)|Run searches against the spotlight database.|version_4.4.2| +|[memory_array_mapped_addresses](events/memory_array_mapped_addresses.md)|Data associated for address mapping of physical memory arrays.|version_4.4.2| +|[memory_arrays](events/memory_arrays.md)|Data associated with collection of memory devices that operate to form a memory address.|version_4.4.2| +|[memory_device_mapped_addresses](events/memory_device_mapped_addresses.md)|Data associated for address mapping of physical memory devices.|version_4.4.2| +|[memory_devices](events/memory_devices.md)|Physical memory device (type 17) information retrieved from SMBIOS.|version_4.4.2| +|[memory_error_info](events/memory_error_info.md)|Data associated with errors of a physical memory array.|version_4.4.2| +|[mounts](events/mounts.md)|System mounted devices and filesystems (not process specific).|version_4.4.2| +|[nfs_shares](events/nfs_shares.md)|NFS shares exported by the host.|version_4.4.2| +|[nvram](events/nvram.md)|Apple NVRAM variable listing.|version_4.4.2| +|[oem_strings](events/oem_strings.md)|OEM defined strings retrieved from SMBIOS.|version_4.4.2| +|[opera_extensions](events/opera_extensions.md)|Opera browser extensions.|version_4.4.2| +|[os_version](events/os_version.md)|A single row containing the operating system name and version.|version_4.4.2| +|[osquery_events](events/osquery_events.md)|Information about the event publishers and subscribers.|version_4.4.2| +|[osquery_extensions](events/osquery_extensions.md)|List of active osquery extensions.|version_4.4.2| +|[osquery_flags](events/osquery_flags.md)|Configurable flags that modify osquery's behavior.|version_4.4.2| +|[osquery_info](events/osquery_info.md)|Top level information about the running version of osquery.|version_4.4.2| +|[osquery_packs](events/osquery_packs.md)|Information about the current query packs that are loaded in osquery.|version_4.4.2| +|[osquery_registry](events/osquery_registry.md)|List the osquery registry plugins.|version_4.4.2| +|[osquery_schedule](events/osquery_schedule.md)|Information about the current queries that are scheduled in osquery.|version_4.4.2| +|[package_bom](events/package_bom.md)|OS X package bill of materials (BOM) file list.|version_4.4.2| +|[package_install_history](events/package_install_history.md)|OS X package install history.|version_4.4.2| +|[package_receipts](events/package_receipts.md)|OS X package receipt details.|version_4.4.2| +|[pci_devices](events/pci_devices.md)|PCI devices active on the host system.|version_4.4.2| +|[platform_info](events/platform_info.md)|Information about EFI/UEFI/ROM and platform/boot.|version_4.4.2| +|[plist](events/plist.md)|Read and parse a plist file.|version_4.4.2| +|[power_sensors](events/power_sensors.md)|Machine power (currents, voltages, wattages, etc) sensors.|version_4.4.2| +|[preferences](events/preferences.md)|OS X defaults and managed preferences.|version_4.4.2| +|[process_envs](events/process_envs.md)|A key/value table of environment variables for each process.|version_4.4.2| +|[process_events](events/process_events.md)|Track time/action process executions.|version_4.4.2| +|[process_memory_map](events/process_memory_map.md)|Process memory mapped files and pseudo device/regions.|version_4.4.2| +|[process_open_files](events/process_open_files.md)|File descriptors for each process.|version_4.4.2| +|[process_open_sockets](events/process_open_sockets.md)|Processes which have open network sockets on the system.|version_4.4.2| +|[processes](events/processes.md)|All running processes on the host system.|version_4.4.2| +|[prometheus_metrics](events/prometheus_metrics.md)|Retrieve metrics from a Prometheus server.|version_4.4.2| +|[python_packages](events/python_packages.md)|Python packages installed in a system.|version_4.4.2| +|[quicklook_cache](events/quicklook_cache.md)|Files and thumbnails within OS X's Quicklook Cache.|version_4.4.2| +|[routes](events/routes.md)|The active route table for the host system.|version_4.4.2| +|[running_apps](events/running_apps.md)|macOS applications currently running on the host system.|version_4.4.2| +|[safari_extensions](events/safari_extensions.md)|Safari browser extension details for all users.|version_4.4.2| +|[sandboxes](events/sandboxes.md)|OS X application sandboxes container details.|version_4.4.2| +|[shared_folders](events/shared_folders.md)|Folders available to others via SMB or AFP.|version_4.4.2| +|[sharing_preferences](events/sharing_preferences.md)|OS X Sharing preferences.|version_4.4.2| +|[shell_history](events/shell_history.md)|A line-delimited (command) table of per-user .*_history data.|version_4.4.2| +|[signature](events/signature.md)|File (executable, bundle, installer, disk) code signing status.|version_4.4.2| +|[sip_config](events/sip_config.md)|Apple's System Integrity Protection (rootless) status.|version_4.4.2| +|[smart_drive_info](events/smart_drive_info.md)|Drive information read by SMART controller utilizing autodetect.|version_4.4.2| +|[smbios_tables](events/smbios_tables.md)|BIOS (DMI) structure common details and content.|version_4.4.2| +|[smc_keys](events/smc_keys.md)|Apple's system management controller keys.|version_4.4.2| +|[ssh_configs](events/ssh_configs.md)|A table of parsed ssh_configs.|version_4.4.2| +|[startup_items](events/startup_items.md)|Applications and binaries set as user/login startup items.|version_4.4.2| +|[sudoers](events/sudoers.md)|Rules for running commands as other users via sudo.|version_4.4.2| +|[suid_bin](events/suid_bin.md)|suid binaries in common locations.|version_4.4.2| +|[system_controls](events/system_controls.md)|sysctl names, values, and settings information.|version_4.4.2| +|[system_info](events/system_info.md)|System information for identification.|version_4.4.2| +|[temperature_sensors](events/temperature_sensors.md)|Machine's temperature sensors.|version_4.4.2| +|[time](events/time.md)|Track current date and time in the system.|version_4.4.2| +|[time_machine_backups](events/time_machine_backups.md)|Backups to drives using TimeMachine.|version_4.4.2| +|[time_machine_destinations](events/time_machine_destinations.md)|Locations backed up to using Time Machine.|version_4.4.2| +|[ulimit_info](events/ulimit_info.md)|System resource usage limits.|version_4.4.2| +|[uptime](events/uptime.md)|Track time passed since last boot.|version_4.4.2| +|[usb_devices](events/usb_devices.md)|USB devices that are actively plugged into the host system.|version_4.4.2| +|[user_events](events/user_events.md)|Track user events from the audit framework.|version_4.4.2| +|[user_groups](events/user_groups.md)|Local system user group relationships.|version_4.4.2| +|[user_interaction_events](events/user_interaction_events.md)|Track user interaction events from macOS' event tapping framework.|version_4.4.2| +|[user_ssh_keys](events/user_ssh_keys.md)|Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.|version_4.4.2| +|[users](events/users.md)|Local user accounts (including domain accounts that have logged on locally (Windows)).|version_4.4.2| +|[virtual_memory_info](events/virtual_memory_info.md)|Darwin Virtual Memory statistics.|version_4.4.2| +|[wifi_networks](events/wifi_networks.md)|OS X known/remembered Wi-Fi networks list.|version_4.4.2| +|[wifi_scan](events/wifi_scan.md)|Scan for nearby WiFi networks.|version_4.4.2| +|[wifi_status](events/wifi_status.md)|OS X current WiFi status.|version_4.4.2| +|[xprotect_entries](events/xprotect_entries.md)|Database of the machine's XProtect signatures.|version_4.4.2| +|[xprotect_meta](events/xprotect_meta.md)|Database of the machine's XProtect browser-related signatures.|version_4.4.2| +|[xprotect_reports](events/xprotect_reports.md)|Database of XProtect matches (if user generated/sent an XProtect report).|version_4.4.2| +|[yara](events/yara.md)|Track YARA matches for files or PIDs.|version_4.4.2| +|[yara_events](events/yara_events.md)|Track YARA matches for files specified in configuration data.|version_4.4.2| +|[yum_sources](events/yum_sources.md)|Current list of Yum repositories or software channels.|version_4.4.2| ## References -* [osquery schema 3.2.4 (website)](https://osquery.io/schema/3.2.4) +* [osquery schema 4.1.2 (website)](https://osquery.io/schema/4.1.2) * [osquery schema linux specs (GitHub)](https://github.com/facebook/osquery/tree/master/specs/darwin) \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/account_policy_data.md b/data_dictionaries/macos/osquery/events/account_policy_data.md new file mode 100644 index 000000000..ac9c297e3 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/account_policy_data.md @@ -0,0 +1,19 @@ +# Account_policy_data Table + +## Description +Additional OS X user account data from the AccountPolicy section of OpenDirectory. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|creation_time|DOUBLE|When the account was first created|`TBD`| +|TBD|failed_login_count|BIGINT|The number of times the user failed to login with the correct password. Resets after a correct password is entered|`TBD`| +|TBD|failed_login_timestamp|DOUBLE|The time of the last failed login attempt. Resets after a correct password is entered|`TBD`| +|TBD|password_last_set_time|DOUBLE|The time the password was last changed|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#account_policy_data) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/acpi_tables.md b/data_dictionaries/macos/osquery/events/acpi_tables.md new file mode 100644 index 000000000..7c5b960f9 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/acpi_tables.md @@ -0,0 +1,17 @@ +# Acpi_tables Table + +## Description +Firmware ACPI functional table common metadata and content. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|ACPI table name|`TBD`| +|TBD|size|INTEGER|Size of compiled table data|`TBD`| +|TBD|md5|TEXT|MD5 hash of table content|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#acpi_tables) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/ad_config.md b/data_dictionaries/macos/osquery/events/ad_config.md new file mode 100644 index 000000000..ef036d733 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/ad_config.md @@ -0,0 +1,18 @@ +# Ad_config Table + +## Description +OS X Active Directory configuration. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The OS X-specific configuration name|`TBD`| +|TBD|domain|TEXT|Active Directory trust domain|`TBD`| +|TBD|option|TEXT|Canonical name of option|`TBD`| +|TBD|value|TEXT|Variable typed option value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ad_config) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/alf.md b/data_dictionaries/macos/osquery/events/alf.md new file mode 100644 index 000000000..b60d10896 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/alf.md @@ -0,0 +1,21 @@ +# Alf Table + +## Description +OS X application layer firewall (ALF) service details. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|allow_signed_enabled|INTEGER|1 If allow signed mode is enabled else 0|`TBD`| +|TBD|firewall_unload|INTEGER|1 If firewall unloading enabled else 0|`TBD`| +|TBD|global_state|INTEGER|1 If the firewall is enabled with exceptions, 2 if the firewall is configured to block all incoming connections, else 0|`TBD`| +|TBD|logging_enabled|INTEGER|1 If logging mode is enabled else 0|`TBD`| +|TBD|logging_option|INTEGER|Firewall logging option|`TBD`| +|TBD|stealth_enabled|INTEGER|1 If stealth mode is enabled else 0|`TBD`| +|TBD|version|TEXT|Application Layer Firewall version|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#alf) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/alf_exceptions.md b/data_dictionaries/macos/osquery/events/alf_exceptions.md new file mode 100644 index 000000000..5e39e0abb --- /dev/null +++ b/data_dictionaries/macos/osquery/events/alf_exceptions.md @@ -0,0 +1,16 @@ +# Alf_exceptions Table + +## Description +OS X application layer firewall (ALF) service exceptions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Path to the executable that is excepted|`TBD`| +|TBD|state|INTEGER|Firewall exception state|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#alf_exceptions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/alf_explicit_auths.md b/data_dictionaries/macos/osquery/events/alf_explicit_auths.md new file mode 100644 index 000000000..cb65bac10 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/alf_explicit_auths.md @@ -0,0 +1,15 @@ +# Alf_explicit_auths Table + +## Description +ALF services explicitly allowed to perform networking. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|process|TEXT|Process name explicitly allowed|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#alf_explicit_auths) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/app_schemes.md b/data_dictionaries/macos/osquery/events/app_schemes.md new file mode 100644 index 000000000..0bbf8a5ff --- /dev/null +++ b/data_dictionaries/macos/osquery/events/app_schemes.md @@ -0,0 +1,17 @@ +# App_schemes Table + +## Description +OS X application schemes and handlers (e.g., http, file, mailto). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|scheme|TEXT|Name of the scheme/protocol|`TBD`| +|TBD|handler|TEXT|Application label for the handler|`TBD`| +|TBD|enabled|INTEGER|1 if this handler is the OS default, else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#app_schemes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/apps.md b/data_dictionaries/macos/osquery/events/apps.md new file mode 100644 index 000000000..0844ba7fc --- /dev/null +++ b/data_dictionaries/macos/osquery/events/apps.md @@ -0,0 +1,25 @@ +# Apps Table + +## Description +OS X applications installed in known search paths (e.g., /Applications). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Name of the Name.app folder|`TBD`| +|TBD|path|TEXT|Absolute and full Name.app path|`TBD`| +|TBD|bundle_name|TEXT|Info properties CFBundleName label|`TBD`| +|TBD|bundle_version|TEXT|Info properties CFBundleVersion label|`TBD`| +|TBD|environment|TEXT|Application-set environment variables|`TBD`| +|TBD|element|TEXT|Does the app identify as a background agent|`TBD`| +|TBD|compiler|TEXT|Info properties DTCompiler label|`TBD`| +|TBD|display_name|TEXT|Info properties CFBundleDisplayName label|`TBD`| +|TBD|info_string|TEXT|Info properties CFBundleGetInfoString label|`TBD`| +|TBD|copyright|TEXT|Info properties NSHumanReadableCopyright label|`TBD`| +|TBD|last_opened_time|DOUBLE|The time that the app was last used|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#apps) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/apt_sources.md b/data_dictionaries/macos/osquery/events/apt_sources.md new file mode 100644 index 000000000..47e3b3086 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/apt_sources.md @@ -0,0 +1,22 @@ +# Apt_sources Table + +## Description +Current list of APT repositories or software channels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Repository name|`TBD`| +|TBD|source|TEXT|Source file|`TBD`| +|TBD|base_uri|TEXT|Repository base URI|`TBD`| +|TBD|release|TEXT|Release name|`TBD`| +|TBD|version|TEXT|Repository source version|`TBD`| +|TBD|maintainer|TEXT|Repository maintainer|`TBD`| +|TBD|components|TEXT|Repository components|`TBD`| +|TBD|architectures|TEXT|Repository architectures|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#apt_sources) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/arp_cache.md b/data_dictionaries/macos/osquery/events/arp_cache.md new file mode 100644 index 000000000..3d2ae205d --- /dev/null +++ b/data_dictionaries/macos/osquery/events/arp_cache.md @@ -0,0 +1,18 @@ +# Arp_cache Table + +## Description +Address resolution cache, both static and dynamic (from ARP, NDP). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|address|TEXT|IPv4 address target|`TBD`| +|TBD|mac|TEXT|MAC address of broadcasted address|`TBD`| +|TBD|interface|TEXT|Interface of the network for the MAC|`TBD`| +|TBD|permanent|TEXT|1 for true, 0 for false|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#arp_cache) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/asl.md b/data_dictionaries/macos/osquery/events/asl.md new file mode 100644 index 000000000..bf6ad65e6 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/asl.md @@ -0,0 +1,27 @@ +# Asl Table + +## Description +Queries the Apple System Log data structure for system events. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|time|INTEGER|Unix timestamp. Set automatically|`TBD`| +|TBD|time_nano_sec|INTEGER|Nanosecond time.|`TBD`| +|TBD|host|TEXT|Sender's address (set by the server).|`TBD`| +|TBD|sender|TEXT|Sender's identification string. Default is process name.|`TBD`| +|TBD|facility|TEXT|Sender's facility. Default is 'user'.|`TBD`| +|TBD|pid|INTEGER|Sending process ID encoded as a string. Set automatically.|`TBD`| +|TBD|gid|BIGINT|GID that sent the log message (set by the server).|`TBD`| +|TBD|uid|BIGINT|UID that sent the log message (set by the server).|`TBD`| +|TBD|level|INTEGER|Log level number. See levels in asl.h.|`TBD`| +|TBD|message|TEXT|Message text.|`TBD`| +|TBD|ref_pid|INTEGER|Reference PID for messages proxied by launchd|`TBD`| +|TBD|ref_proc|TEXT|Reference process for messages proxied by launchd|`TBD`| +|TBD|extra|TEXT|Extra columns, in JSON format. Queries against this column are performed entirely in SQLite, so do not benefit from efficient querying via asl.h.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#asl) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/atom_packages.md b/data_dictionaries/macos/osquery/events/atom_packages.md new file mode 100644 index 000000000..6b717bddf --- /dev/null +++ b/data_dictionaries/macos/osquery/events/atom_packages.md @@ -0,0 +1,21 @@ +# Atom_packages Table + +## Description +Lists all atom packages in a directory or globally installed in a system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package display name|`TBD`| +|TBD|version|TEXT|Package supplied version|`TBD`| +|TBD|description|TEXT|Package supplied description|`TBD`| +|TBD|path|TEXT|Package's package.json path|`TBD`| +|TBD|license|TEXT|License for package|`TBD`| +|TBD|homepage|TEXT|Package supplied homepage|`TBD`| +|TBD|uid|BIGINT|The local user that owns the plugin|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#atom_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/augeas.md b/data_dictionaries/macos/osquery/events/augeas.md new file mode 100644 index 000000000..9d20c63fa --- /dev/null +++ b/data_dictionaries/macos/osquery/events/augeas.md @@ -0,0 +1,18 @@ +# Augeas Table + +## Description +Configuration files parsed by augeas. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|node|TEXT|The node path of the configuration item|`TBD`| +|TBD|value|TEXT|The value of the configuration item|`TBD`| +|TBD|label|TEXT|The label of the configuration item|`TBD`| +|TBD|path|TEXT|The path to the configuration file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#augeas) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/authorization_mechanisms.md b/data_dictionaries/macos/osquery/events/authorization_mechanisms.md new file mode 100644 index 000000000..6441b4d72 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/authorization_mechanisms.md @@ -0,0 +1,19 @@ +# Authorization_mechanisms Table + +## Description +OS X Authorization mechanisms database. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|label|TEXT|Label of the authorization right|`TBD`| +|TBD|plugin|TEXT|Authorization plugin name|`TBD`| +|TBD|mechanism|TEXT|Name of the mechanism that will be called|`TBD`| +|TBD|privileged|TEXT|If privileged it will run as root, else as an anonymous user|`TBD`| +|TBD|entry|TEXT|The whole string entry|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#authorization_mechanisms) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/authorizations.md b/data_dictionaries/macos/osquery/events/authorizations.md new file mode 100644 index 000000000..48a3e201e --- /dev/null +++ b/data_dictionaries/macos/osquery/events/authorizations.md @@ -0,0 +1,26 @@ +# Authorizations Table + +## Description +OS X Authorization rights database. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|label|TEXT|Item name, usually in reverse domain format|`TBD`| +|TBD|modified|TEXT|Label top-level key|`TBD`| +|TBD|allow_root|TEXT|Label top-level key|`TBD`| +|TBD|timeout|TEXT|Label top-level key|`TBD`| +|TBD|version|TEXT|Label top-level key|`TBD`| +|TBD|tries|TEXT|Label top-level key|`TBD`| +|TBD|authenticate_user|TEXT|Label top-level key|`TBD`| +|TBD|shared|TEXT|Label top-level key|`TBD`| +|TBD|comment|TEXT|Label top-level key|`TBD`| +|TBD|created|TEXT|Label top-level key|`TBD`| +|TBD|class|TEXT|Label top-level key|`TBD`| +|TBD|session_owner|TEXT|Label top-level key|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#authorizations) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/authorized_keys.md b/data_dictionaries/macos/osquery/events/authorized_keys.md new file mode 100644 index 000000000..a63ce1764 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/authorized_keys.md @@ -0,0 +1,17 @@ +# Authorized_keys Table + +## Description +A line-delimited authorized_keys table. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local owner of authorized_keys file|`TBD`| +|TBD|key|TEXT|parsed authorized keys line|`TBD`| +|TBD|key_file|TEXT|Path to the authorized_keys file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#authorized_keys) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/azure_instance_metadata.md b/data_dictionaries/macos/osquery/events/azure_instance_metadata.md new file mode 100644 index 000000000..a5724217d --- /dev/null +++ b/data_dictionaries/macos/osquery/events/azure_instance_metadata.md @@ -0,0 +1,30 @@ +# Azure_instance_metadata Table + +## Description +Azure instance metadata. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|location|TEXT|Azure Region the VM is running in|`TBD`| +|TBD|name|TEXT|Name of the VM|`TBD`| +|TBD|offer|TEXT|Offer information for the VM image (Azure image gallery VMs only)|`TBD`| +|TBD|publisher|TEXT|Publisher of the VM image|`TBD`| +|TBD|sku|TEXT|SKU for the VM image|`TBD`| +|TBD|version|TEXT|Version of the VM image|`TBD`| +|TBD|os_type|TEXT|Linux or Windows|`TBD`| +|TBD|platform_update_domain|TEXT|Update domain the VM is running in|`TBD`| +|TBD|platform_fault_domain|TEXT|Fault domain the VM is running in|`TBD`| +|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`| +|TBD|vm_size|TEXT|VM size|`TBD`| +|TBD|subscription_id|TEXT|Azure subscription for the VM|`TBD`| +|TBD|resource_group_name|TEXT|Resource group for the VM|`TBD`| +|TBD|placement_group_id|TEXT|Placement group for the VM scale set|`TBD`| +|TBD|vm_scale_set_name|TEXT|VM scale set name|`TBD`| +|TBD|zone|TEXT|Availability zone of the VM|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_metadata) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/azure_instance_tags.md b/data_dictionaries/macos/osquery/events/azure_instance_tags.md new file mode 100644 index 000000000..1d237a229 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/azure_instance_tags.md @@ -0,0 +1,17 @@ +# Azure_instance_tags Table + +## Description +Azure instance tags. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`| +|TBD|key|TEXT|The tag key|`TBD`| +|TBD|value|TEXT|The tag value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_tags) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/battery.md b/data_dictionaries/macos/osquery/events/battery.md new file mode 100644 index 000000000..52f689073 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/battery.md @@ -0,0 +1,32 @@ +# Battery Table + +## Description +Provides information about the internal battery of a Macbook. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|manufacturer|TEXT|The battery manufacturer's name|`TBD`| +|TBD|manufacture_date|INTEGER|The date the battery was manufactured UNIX Epoch|`TBD`| +|TBD|model|TEXT|The battery's model number|`TBD`| +|TBD|serial_number|TEXT|The battery's unique serial number|`TBD`| +|TBD|cycle_count|INTEGER|The number of charge/discharge cycles|`TBD`| +|TBD|health|TEXT|One of the following: \|`TBD`| +|TBD|condition|TEXT|One of the following: \|`TBD`| +|TBD|state|TEXT|One of the following: \|`TBD`| +|TBD|charging|INTEGER|1 if the battery is currently being charged by a power source. 0 otherwise|`TBD`| +|TBD|charged|INTEGER|1 if the battery is currently completely charged. 0 otherwise|`TBD`| +|TBD|designed_capacity|INTEGER|The battery's designed capacity in mAh|`TBD`| +|TBD|max_capacity|INTEGER|The battery's actual capacity when it is fully charged in mAh|`TBD`| +|TBD|current_capacity|INTEGER|The battery's current charged capacity in mAh|`TBD`| +|TBD|percent_remaining|INTEGER|The percentage of battery remaining before it is drained|`TBD`| +|TBD|amperage|INTEGER|The battery's current amperage in mA|`TBD`| +|TBD|voltage|INTEGER|The battery's current voltage in mV|`TBD`| +|TBD|minutes_until_empty|INTEGER|The number of minutes until the battery is fully depleted. This value is -1 if this time is still being calculated|`TBD`| +|TBD|minutes_to_full_charge|INTEGER|The number of minutes until the battery is fully charged. This value is -1 if this time is still being calculated|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#battery) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/block_devices.md b/data_dictionaries/macos/osquery/events/block_devices.md new file mode 100644 index 000000000..e831c63fd --- /dev/null +++ b/data_dictionaries/macos/osquery/events/block_devices.md @@ -0,0 +1,23 @@ +# Block_devices Table + +## Description +Block (buffered access) device file nodes: disks, ramdisks, and DMG containers. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Block device name|`TBD`| +|TBD|parent|TEXT|Block device parent name|`TBD`| +|TBD|vendor|TEXT|Block device vendor string|`TBD`| +|TBD|model|TEXT|Block device model string identifier|`TBD`| +|TBD|size|BIGINT|Block device size in blocks|`TBD`| +|TBD|block_size|INTEGER|Block size in bytes|`TBD`| +|TBD|uuid|TEXT|Block device Universally Unique Identifier|`TBD`| +|TBD|type|TEXT|Block device type string|`TBD`| +|TBD|label|TEXT|Block device label string|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#block_devices) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/browser_plugins.md b/data_dictionaries/macos/osquery/events/browser_plugins.md new file mode 100644 index 000000000..4c20cdd10 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/browser_plugins.md @@ -0,0 +1,24 @@ +# Browser_plugins Table + +## Description +All C/NPAPI browser plugin details for all users. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the plugin|`TBD`| +|TBD|name|TEXT|Plugin display name|`TBD`| +|TBD|identifier|TEXT|Plugin identifier|`TBD`| +|TBD|version|TEXT|Plugin short version|`TBD`| +|TBD|sdk|TEXT|Build SDK used to compile plugin|`TBD`| +|TBD|description|TEXT|Plugin description text|`TBD`| +|TBD|development_region|TEXT|Plugin language-localization|`TBD`| +|TBD|native|INTEGER|Plugin requires native execution|`TBD`| +|TBD|path|TEXT|Path to plugin bundle|`TBD`| +|TBD|disabled|INTEGER|Is the plugin disabled. 1 = Disabled|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#browser_plugins) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/carbon_black_info.md b/data_dictionaries/macos/osquery/events/carbon_black_info.md new file mode 100644 index 000000000..42d8e8146 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/carbon_black_info.md @@ -0,0 +1,35 @@ +# Carbon_black_info Table + +## Description +Returns info about a Carbon Black sensor install. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|sensor_id|INTEGER|Sensor ID of the Carbon Black sensor|`TBD`| +|TBD|config_name|TEXT|Sensor group|`TBD`| +|TBD|collect_store_files|INTEGER|If the sensor is configured to send back binaries to the Carbon Black server|`TBD`| +|TBD|collect_module_loads|INTEGER|If the sensor is configured to capture module loads|`TBD`| +|TBD|collect_module_info|INTEGER|If the sensor is configured to collect metadata of binaries|`TBD`| +|TBD|collect_file_mods|INTEGER|If the sensor is configured to collect file modification events|`TBD`| +|TBD|collect_reg_mods|INTEGER|If the sensor is configured to collect registry modification events|`TBD`| +|TBD|collect_net_conns|INTEGER|If the sensor is configured to collect network connections|`TBD`| +|TBD|collect_processes|INTEGER|If the sensor is configured to process events|`TBD`| +|TBD|collect_cross_processes|INTEGER|If the sensor is configured to cross process events|`TBD`| +|TBD|collect_emet_events|INTEGER|If the sensor is configured to EMET events|`TBD`| +|TBD|collect_data_file_writes|INTEGER|If the sensor is configured to collect non binary file writes|`TBD`| +|TBD|collect_process_user_context|INTEGER|If the sensor is configured to collect the user running a process|`TBD`| +|TBD|collect_sensor_operations|INTEGER|Unknown|`TBD`| +|TBD|log_file_disk_quota_mb|INTEGER|Event file disk quota in MB|`TBD`| +|TBD|log_file_disk_quota_percentage|INTEGER|Event file disk quota in a percentage|`TBD`| +|TBD|protection_disabled|INTEGER|If the sensor is configured to report tamper events|`TBD`| +|TBD|sensor_ip_addr|TEXT|IP address of the sensor|`TBD`| +|TBD|sensor_backend_server|TEXT|Carbon Black server|`TBD`| +|TBD|event_queue|INTEGER|Size in bytes of Carbon Black event files on disk|`TBD`| +|TBD|binary_queue|INTEGER|Size in bytes of binaries waiting to be sent to Carbon Black server|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#carbon_black_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/carves.md b/data_dictionaries/macos/osquery/events/carves.md new file mode 100644 index 000000000..aaffca4bd --- /dev/null +++ b/data_dictionaries/macos/osquery/events/carves.md @@ -0,0 +1,21 @@ +# Carves Table + +## Description +Forensic Carves. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|time|BIGINT|Time at which the carve was kicked off|`TBD`| +|TBD|sha256|TEXT|A SHA256 sum of the carved archive|`TBD`| +|TBD|size|INTEGER|Size of the carved archive|`TBD`| +|TBD|path|TEXT|The path of the requested carve|`TBD`| +|TBD|status|TEXT|Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED|`TBD`| +|TBD|carve_guid|TEXT|Identifying value of the carve session|`TBD`| +|TBD|carve|INTEGER|Set this value to '1' to start a file carve|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#carves) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/certificates.md b/data_dictionaries/macos/osquery/events/certificates.md new file mode 100644 index 000000000..d6a4b6eea --- /dev/null +++ b/data_dictionaries/macos/osquery/events/certificates.md @@ -0,0 +1,35 @@ +# Certificates Table + +## Description +Certificate Authorities installed in Keychains/ca-bundles. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|common_name|TEXT|Certificate CommonName|`TBD`| +|TBD|subject|TEXT|Certificate distinguished name|`TBD`| +|TBD|issuer|TEXT|Certificate issuer distinguished name|`TBD`| +|TBD|ca|INTEGER|1 if CA: true (certificate is an authority) else 0|`TBD`| +|TBD|self_signed|INTEGER|1 if self-signed, else 0|`TBD`| +|TBD|not_valid_before|DATETIME|Lower bound of valid date|`TBD`| +|TBD|not_valid_after|DATETIME|Certificate expiration data|`TBD`| +|TBD|signing_algorithm|TEXT|Signing algorithm used|`TBD`| +|TBD|key_algorithm|TEXT|Key algorithm used|`TBD`| +|TBD|key_strength|TEXT|Key size used for RSA/DSA, or curve name|`TBD`| +|TBD|key_usage|TEXT|Certificate key usage and extended key usage|`TBD`| +|TBD|subject_key_id|TEXT|SKID an optionally included SHA1|`TBD`| +|TBD|authority_key_id|TEXT|AKID an optionally included SHA1|`TBD`| +|TBD|sha1|TEXT|SHA1 hash of the raw certificate contents|`TBD`| +|TBD|path|TEXT|Path to Keychain or PEM bundle|`TBD`| +|TBD|serial|TEXT|Certificate serial number|`TBD`| +|TBD|sid|TEXT|SID [WINDOWS]|`TBD`| +|TBD|store_location|TEXT|Certificate system store location [WINDOWS]|`TBD`| +|TBD|store|TEXT|Certificate system store [WINDOWS]|`TBD`| +|TBD|username|TEXT|Username [WINDOWS]|`TBD`| +|TBD|store_id|TEXT|Exists for service/user stores. Contains raw store id provided by WinAPI. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#certificates) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/chrome_extensions.md b/data_dictionaries/macos/osquery/events/chrome_extensions.md new file mode 100644 index 000000000..1446387d9 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/chrome_extensions.md @@ -0,0 +1,26 @@ +# Chrome_extensions Table + +## Description +Chrome browser extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the extension|`TBD`| +|TBD|name|TEXT|Extension display name|`TBD`| +|TBD|profile|TEXT|The Chrome profile that contains this extension|`TBD`| +|TBD|identifier|TEXT|Extension identifier|`TBD`| +|TBD|version|TEXT|Extension-supplied version|`TBD`| +|TBD|description|TEXT|Extension-optional description|`TBD`| +|TBD|locale|TEXT|Default locale supported by extension|`TBD`| +|TBD|update_url|TEXT|Extension-supplied update URI|`TBD`| +|TBD|author|TEXT|Optional extension author|`TBD`| +|TBD|path|TEXT|Path to extension folder|`TBD`| +|TBD|permissions|TEXT|The permissions required by the extension|`TBD`| +|TBD|optional_permissions|TEXT|The permissions optionally required by the extensions|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#chrome_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/cpu_time.md b/data_dictionaries/macos/osquery/events/cpu_time.md new file mode 100644 index 000000000..615e81216 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/cpu_time.md @@ -0,0 +1,25 @@ +# Cpu_time Table + +## Description +Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|core|INTEGER|Name of the cpu (core)|`TBD`| +|TBD|user|BIGINT|Time spent in user mode|`TBD`| +|TBD|nice|BIGINT|Time spent in user mode with low priority (nice)|`TBD`| +|TBD|system|BIGINT|Time spent in system mode|`TBD`| +|TBD|idle|BIGINT|Time spent in the idle task|`TBD`| +|TBD|iowait|BIGINT|Time spent waiting for I/O to complete|`TBD`| +|TBD|irq|BIGINT|Time spent servicing interrupts|`TBD`| +|TBD|softirq|BIGINT|Time spent servicing softirqs|`TBD`| +|TBD|steal|BIGINT|Time spent in other operating systems when running in a virtualized environment|`TBD`| +|TBD|guest|BIGINT|Time spent running a virtual CPU for a guest OS under the control of the Linux kernel|`TBD`| +|TBD|guest_nice|BIGINT|Time spent running a niced guest |`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#cpu_time) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/cpuid.md b/data_dictionaries/macos/osquery/events/cpuid.md new file mode 100644 index 000000000..b8e27a7f5 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/cpuid.md @@ -0,0 +1,19 @@ +# Cpuid Table + +## Description +Useful CPU features from the cpuid ASM call. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|feature|TEXT|Present feature flags|`TBD`| +|TBD|value|TEXT|Bit value or string|`TBD`| +|TBD|output_register|TEXT|Register used to for feature value|`TBD`| +|TBD|output_bit|INTEGER|Bit in register value for feature value|`TBD`| +|TBD|input_eax|TEXT|Value of EAX used|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#cpuid) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/crashes.md b/data_dictionaries/macos/osquery/events/crashes.md new file mode 100644 index 000000000..760cfebf7 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/crashes.md @@ -0,0 +1,30 @@ +# Crashes Table + +## Description +Application, System, and Mobile App crash logs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|Type of crash log|`TBD`| +|TBD|pid|BIGINT|Process (or thread) ID of the crashed process|`TBD`| +|TBD|path|TEXT|Path to the crashed process|`TBD`| +|TBD|crash_path|TEXT|Location of log file|`TBD`| +|TBD|identifier|TEXT|Identifier of the crashed process|`TBD`| +|TBD|version|TEXT|Version info of the crashed process|`TBD`| +|TBD|parent|BIGINT|Parent PID of the crashed process|`TBD`| +|TBD|responsible|TEXT|Process responsible for the crashed process|`TBD`| +|TBD|uid|INTEGER|User ID of the crashed process|`TBD`| +|TBD|datetime|TEXT|Date/Time at which the crash occurred|`TBD`| +|TBD|crashed_thread|BIGINT|Thread ID which crashed|`TBD`| +|TBD|stack_trace|TEXT|Most recent frame from the stack trace|`TBD`| +|TBD|exception_type|TEXT|Exception type of the crash|`TBD`| +|TBD|exception_codes|TEXT|Exception codes from the crash|`TBD`| +|TBD|exception_notes|TEXT|Exception notes from the crash|`TBD`| +|TBD|registers|TEXT|The value of the system registers|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#crashes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/crontab.md b/data_dictionaries/macos/osquery/events/crontab.md new file mode 100644 index 000000000..6739e030f --- /dev/null +++ b/data_dictionaries/macos/osquery/events/crontab.md @@ -0,0 +1,22 @@ +# Crontab Table + +## Description +Line parsed values from system and user cron/tab. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|event|TEXT|The job @event name (rare)|`TBD`| +|TBD|minute|TEXT|The exact minute for the job|`TBD`| +|TBD|hour|TEXT|The hour of the day for the job|`TBD`| +|TBD|day_of_month|TEXT|The day of the month for the job|`TBD`| +|TBD|month|TEXT|The month of the year for the job|`TBD`| +|TBD|day_of_week|TEXT|The day of the week for the job|`TBD`| +|TBD|command|TEXT|Raw command string|`TBD`| +|TBD|path|TEXT|File parsed|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#crontab) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/cups_destinations.md b/data_dictionaries/macos/osquery/events/cups_destinations.md new file mode 100644 index 000000000..91c832deb --- /dev/null +++ b/data_dictionaries/macos/osquery/events/cups_destinations.md @@ -0,0 +1,17 @@ +# Cups_destinations Table + +## Description +Returns all configured printers. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Name of the printer|`TBD`| +|TBD|option_name|TEXT|Option name|`TBD`| +|TBD|option_value|TEXT|Option value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#cups_destinations) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/cups_jobs.md b/data_dictionaries/macos/osquery/events/cups_jobs.md new file mode 100644 index 000000000..a24fdba9a --- /dev/null +++ b/data_dictionaries/macos/osquery/events/cups_jobs.md @@ -0,0 +1,22 @@ +# Cups_jobs Table + +## Description +Returns all completed print jobs from cups. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|title|TEXT|Title of the printed job|`TBD`| +|TBD|destination|TEXT|The printer the job was sent to|`TBD`| +|TBD|user|TEXT|The user who printed the job|`TBD`| +|TBD|format|TEXT|The format of the print job|`TBD`| +|TBD|size|INTEGER|The size of the print job|`TBD`| +|TBD|completed_time|INTEGER|When the job completed printing|`TBD`| +|TBD|processing_time|INTEGER|How long the job took to process|`TBD`| +|TBD|creation_time|INTEGER|When the print request was initiated|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#cups_jobs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/curl.md b/data_dictionaries/macos/osquery/events/curl.md new file mode 100644 index 000000000..22c52b63e --- /dev/null +++ b/data_dictionaries/macos/osquery/events/curl.md @@ -0,0 +1,21 @@ +# Curl Table + +## Description +Perform an http request and return stats about it. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|url|TEXT|The url for the request|`TBD`| +|TBD|method|TEXT|The HTTP method for the request|`TBD`| +|TBD|user_agent|TEXT|The user-agent string to use for the request|`TBD`| +|TBD|response_code|INTEGER|The HTTP status code for the response|`TBD`| +|TBD|round_trip_time|BIGINT|Time taken to complete the request|`TBD`| +|TBD|bytes|BIGINT|Number of bytes in the response|`TBD`| +|TBD|result|TEXT|The HTTP response body|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#curl) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/curl_certificate.md b/data_dictionaries/macos/osquery/events/curl_certificate.md new file mode 100644 index 000000000..19f77ef6d --- /dev/null +++ b/data_dictionaries/macos/osquery/events/curl_certificate.md @@ -0,0 +1,26 @@ +# Curl_certificate Table + +## Description +Inspect TLS certificates by connecting to input hostnames. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|hostname|TEXT|Hostname (domain[:port]) to CURL|`TBD`| +|TBD|common_name|TEXT|Common name of company issued to|`TBD`| +|TBD|organization|TEXT|Organization issued to|`TBD`| +|TBD|organization_unit|TEXT|Organization unit issued to|`TBD`| +|TBD|serial_number|TEXT|Certificate serial number|`TBD`| +|TBD|issuer_common_name|TEXT|Issuer common name|`TBD`| +|TBD|issuer_organization|TEXT|Issuer organization|`TBD`| +|TBD|issuer_organization_unit|TEXT|Issuer organization unit|`TBD`| +|TBD|valid_from|TEXT|Period of validity start date|`TBD`| +|TBD|valid_to|TEXT|Period of validity end date|`TBD`| +|TBD|sha256_fingerprint|TEXT|SHA-256 fingerprint|`TBD`| +|TBD|sha1_fingerprint|TEXT|SHA1 fingerprint|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#curl_certificate) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/device_file.md b/data_dictionaries/macos/osquery/events/device_file.md new file mode 100644 index 000000000..329e6d063 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/device_file.md @@ -0,0 +1,29 @@ +# Device_file Table + +## Description +Similar to the file table, but use TSK and allow block address access. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Absolute file path to device node|`TBD`| +|TBD|partition|TEXT|A partition number|`TBD`| +|TBD|path|TEXT|A logical path within the device node|`TBD`| +|TBD|filename|TEXT|Name portion of file path|`TBD`| +|TBD|inode|BIGINT|Filesystem inode number|`TBD`| +|TBD|uid|BIGINT|Owning user ID|`TBD`| +|TBD|gid|BIGINT|Owning group ID|`TBD`| +|TBD|mode|TEXT|Permission bits|`TBD`| +|TBD|size|BIGINT|Size of file in bytes|`TBD`| +|TBD|block_size|INTEGER|Block size of filesystem|`TBD`| +|TBD|atime|BIGINT|Last access time|`TBD`| +|TBD|mtime|BIGINT|Last modification time|`TBD`| +|TBD|ctime|BIGINT|Creation time|`TBD`| +|TBD|hard_links|INTEGER|Number of hard links|`TBD`| +|TBD|type|TEXT|File status|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#device_file) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/device_firmware.md b/data_dictionaries/macos/osquery/events/device_firmware.md new file mode 100644 index 000000000..f10934422 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/device_firmware.md @@ -0,0 +1,17 @@ +# Device_firmware Table + +## Description +A best-effort list of discovered firmware versions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|Type of device|`TBD`| +|TBD|device|TEXT|The device name|`TBD`| +|TBD|version|TEXT|Firmware version|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#device_firmware) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/device_hash.md b/data_dictionaries/macos/osquery/events/device_hash.md new file mode 100644 index 000000000..2eb036856 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/device_hash.md @@ -0,0 +1,20 @@ +# Device_hash Table + +## Description +Similar to the hash table, but use TSK and allow block address access. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Absolute file path to device node|`TBD`| +|TBD|partition|TEXT|A partition number|`TBD`| +|TBD|inode|BIGINT|Filesystem inode number|`TBD`| +|TBD|md5|TEXT|MD5 hash of provided inode data|`TBD`| +|TBD|sha1|TEXT|SHA1 hash of provided inode data|`TBD`| +|TBD|sha256|TEXT|SHA256 hash of provided inode data|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#device_hash) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/device_partitions.md b/data_dictionaries/macos/osquery/events/device_partitions.md new file mode 100644 index 000000000..b89faea11 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/device_partitions.md @@ -0,0 +1,23 @@ +# Device_partitions Table + +## Description +Use TSK to enumerate details about partitions on a disk device. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Absolute file path to device node|`TBD`| +|TBD|partition|INTEGER|A partition number or description|`TBD`| +|TBD|label|TEXT||`TBD`| +|TBD|type|TEXT||`TBD`| +|TBD|offset|BIGINT||`TBD`| +|TBD|blocks_size|BIGINT|Byte size of each block|`TBD`| +|TBD|blocks|BIGINT|Number of blocks|`TBD`| +|TBD|inodes|BIGINT|Number of meta nodes|`TBD`| +|TBD|flags|INTEGER||`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#device_partitions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/disk_encryption.md b/data_dictionaries/macos/osquery/events/disk_encryption.md new file mode 100644 index 000000000..f9cfdff6e --- /dev/null +++ b/data_dictionaries/macos/osquery/events/disk_encryption.md @@ -0,0 +1,21 @@ +# Disk_encryption Table + +## Description +Disk encryption status and information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Disk name|`TBD`| +|TBD|uuid|TEXT|Disk Universally Unique Identifier|`TBD`| +|TBD|encrypted|INTEGER|1 If encrypted: true (disk is encrypted), else 0|`TBD`| +|TBD|type|TEXT|Description of cipher type and mode if available|`TBD`| +|TBD|uid|TEXT|Currently authenticated user if available (Apple)|`TBD`| +|TBD|user_uuid|TEXT|UUID of authenticated user if available (Apple)|`TBD`| +|TBD|encryption_status|TEXT|Disk encryption status with one of following values: encrypted | not encrypted | undefined|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#disk_encryption) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/disk_events.md b/data_dictionaries/macos/osquery/events/disk_events.md new file mode 100644 index 000000000..60e8bf736 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/disk_events.md @@ -0,0 +1,30 @@ +# Disk_events Table + +## Description +Track DMG disk image events (appearance/disappearance) when opened. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|action|TEXT|Appear or disappear|`TBD`| +|TBD|path|TEXT|Path of the DMG file accessed|`TBD`| +|TBD|name|TEXT|Disk event name|`TBD`| +|TBD|device|TEXT|Disk event BSD name|`TBD`| +|TBD|uuid|TEXT|UUID of the volume inside DMG if available|`TBD`| +|TBD|size|BIGINT|Size of partition in bytes|`TBD`| +|TBD|ejectable|INTEGER|1 if ejectable, 0 if not|`TBD`| +|TBD|mountable|INTEGER|1 if mountable, 0 if not|`TBD`| +|TBD|writable|INTEGER|1 if writable, 0 if not|`TBD`| +|TBD|content|TEXT|Disk event content|`TBD`| +|TBD|media_name|TEXT|Disk event media name string|`TBD`| +|TBD|vendor|TEXT|Disk event vendor string|`TBD`| +|TBD|filesystem|TEXT|Filesystem if available|`TBD`| +|TBD|checksum|TEXT|UDIF Master checksum if available (CRC32)|`TBD`| +|TBD|time|BIGINT|Time of appearance/disappearance in UNIX time|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#disk_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/dns_resolvers.md b/data_dictionaries/macos/osquery/events/dns_resolvers.md new file mode 100644 index 000000000..df610ce0a --- /dev/null +++ b/data_dictionaries/macos/osquery/events/dns_resolvers.md @@ -0,0 +1,19 @@ +# Dns_resolvers Table + +## Description +Resolvers used by this host. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|INTEGER|Address type index or order|`TBD`| +|TBD|type|TEXT|Address type: sortlist, nameserver, search|`TBD`| +|TBD|address|TEXT|Resolver IP/IPv6 address|`TBD`| +|TBD|netmask|TEXT|Address (sortlist) netmask length|`TBD`| +|TBD|options|BIGINT|Resolver options|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#dns_resolvers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_container_labels.md b/data_dictionaries/macos/osquery/events/docker_container_labels.md new file mode 100644 index 000000000..1bf096ccb --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_container_labels.md @@ -0,0 +1,17 @@ +# Docker_container_labels Table + +## Description +Docker container labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_container_mounts.md b/data_dictionaries/macos/osquery/events/docker_container_mounts.md new file mode 100644 index 000000000..1e6f4fb30 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_container_mounts.md @@ -0,0 +1,23 @@ +# Docker_container_mounts Table + +## Description +Docker container mounts. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|type|TEXT|Type of mount (bind, volume)|`TBD`| +|TBD|name|TEXT|Optional mount name|`TBD`| +|TBD|source|TEXT|Source path on host|`TBD`| +|TBD|destination|TEXT|Destination path inside container|`TBD`| +|TBD|driver|TEXT|Driver providing the mount|`TBD`| +|TBD|mode|TEXT|Mount options (rw, ro)|`TBD`| +|TBD|rw|INTEGER|1 if read/write. 0 otherwise|`TBD`| +|TBD|propagation|TEXT|Mount propagation|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_mounts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_container_networks.md b/data_dictionaries/macos/osquery/events/docker_container_networks.md new file mode 100644 index 000000000..cb77b5a02 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_container_networks.md @@ -0,0 +1,25 @@ +# Docker_container_networks Table + +## Description +Docker container networks. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|name|TEXT|Network name|`TBD`| +|TBD|network_id|TEXT|Network ID|`TBD`| +|TBD|endpoint_id|TEXT|Endpoint ID|`TBD`| +|TBD|gateway|TEXT|Gateway|`TBD`| +|TBD|ip_address|TEXT|IP address|`TBD`| +|TBD|ip_prefix_len|INTEGER|IP subnet prefix length|`TBD`| +|TBD|ipv6_gateway|TEXT|IPv6 gateway|`TBD`| +|TBD|ipv6_address|TEXT|IPv6 address|`TBD`| +|TBD|ipv6_prefix_len|INTEGER|IPv6 subnet prefix length|`TBD`| +|TBD|mac_address|TEXT|MAC address|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_networks) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_container_ports.md b/data_dictionaries/macos/osquery/events/docker_container_ports.md new file mode 100644 index 000000000..90daa6939 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_container_ports.md @@ -0,0 +1,19 @@ +# Docker_container_ports Table + +## Description +Docker container ports. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|type|TEXT|Protocol (tcp, udp)|`TBD`| +|TBD|port|INTEGER|Port inside the container|`TBD`| +|TBD|host_ip|TEXT|Host IP address on which public port is listening|`TBD`| +|TBD|host_port|INTEGER|Host port|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_ports) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_container_processes.md b/data_dictionaries/macos/osquery/events/docker_container_processes.md new file mode 100644 index 000000000..b00165be2 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_container_processes.md @@ -0,0 +1,36 @@ +# Docker_container_processes Table + +## Description +Docker container processes. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|pid|BIGINT|Process ID|`TBD`| +|TBD|name|TEXT|The process path or shorthand argv[0]|`TBD`| +|TBD|cmdline|TEXT|Complete argv|`TBD`| +|TBD|state|TEXT|Process state|`TBD`| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|gid|BIGINT|Group ID|`TBD`| +|TBD|euid|BIGINT|Effective user ID|`TBD`| +|TBD|egid|BIGINT|Effective group ID|`TBD`| +|TBD|suid|BIGINT|Saved user ID|`TBD`| +|TBD|sgid|BIGINT|Saved group ID|`TBD`| +|TBD|wired_size|BIGINT|Bytes of unpagable memory used by process|`TBD`| +|TBD|resident_size|BIGINT|Bytes of private memory used by process|`TBD`| +|TBD|total_size|BIGINT|Total virtual memory size|`TBD`| +|TBD|parent|BIGINT|Process parent's PID|`TBD`| +|TBD|pgroup|BIGINT|Process group|`TBD`| +|TBD|threads|INTEGER|Number of threads used by process|`TBD`| +|TBD|nice|INTEGER|Process nice level (-20 to 20, default 0)|`TBD`| +|TBD|user|TEXT|User name|`TBD`| +|TBD|time|TEXT|Cumulative CPU time. [DD-]HH:MM:SS format|`TBD`| +|TBD|cpu|DOUBLE|CPU utilization as percentage|`TBD`| +|TBD|mem|DOUBLE|Memory utilization as percentage|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_processes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_container_stats.md b/data_dictionaries/macos/osquery/events/docker_container_stats.md new file mode 100644 index 000000000..d9b42967f --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_container_stats.md @@ -0,0 +1,38 @@ +# Docker_container_stats Table + +## Description +Docker container statistics. Queries on this table take at least one second. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|name|TEXT|Container name|`TBD`| +|TBD|pids|INTEGER|Number of processes|`TBD`| +|TBD|read|BIGINT|UNIX time when stats were read|`TBD`| +|TBD|preread|BIGINT|UNIX time when stats were last read|`TBD`| +|TBD|interval|BIGINT|Difference between read and preread in nano-seconds|`TBD`| +|TBD|disk_read|BIGINT|Total disk read bytes|`TBD`| +|TBD|disk_write|BIGINT|Total disk write bytes|`TBD`| +|TBD|num_procs|INTEGER|Number of processors|`TBD`| +|TBD|cpu_total_usage|BIGINT|Total CPU usage|`TBD`| +|TBD|cpu_kernelmode_usage|BIGINT|CPU kernel mode usage|`TBD`| +|TBD|cpu_usermode_usage|BIGINT|CPU user mode usage|`TBD`| +|TBD|system_cpu_usage|BIGINT|CPU system usage|`TBD`| +|TBD|online_cpus|INTEGER|Online CPUs|`TBD`| +|TBD|pre_cpu_total_usage|BIGINT|Last read total CPU usage|`TBD`| +|TBD|pre_cpu_kernelmode_usage|BIGINT|Last read CPU kernel mode usage|`TBD`| +|TBD|pre_cpu_usermode_usage|BIGINT|Last read CPU user mode usage|`TBD`| +|TBD|pre_system_cpu_usage|BIGINT|Last read CPU system usage|`TBD`| +|TBD|pre_online_cpus|INTEGER|Last read online CPUs|`TBD`| +|TBD|memory_usage|BIGINT|Memory usage|`TBD`| +|TBD|memory_max_usage|BIGINT|Memory maximum usage|`TBD`| +|TBD|memory_limit|BIGINT|Memory limit|`TBD`| +|TBD|network_rx_bytes|BIGINT|Total network bytes read|`TBD`| +|TBD|network_tx_bytes|BIGINT|Total network bytes transmitted|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_stats) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_containers.md b/data_dictionaries/macos/osquery/events/docker_containers.md new file mode 100644 index 000000000..dcd4e2fa4 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_containers.md @@ -0,0 +1,38 @@ +# Docker_containers Table + +## Description +Docker containers information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Container ID|`TBD`| +|TBD|name|TEXT|Container name|`TBD`| +|TBD|image|TEXT|Docker image (name) used to launch this container|`TBD`| +|TBD|image_id|TEXT|Docker image ID|`TBD`| +|TBD|command|TEXT|Command with arguments|`TBD`| +|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`| +|TBD|state|TEXT|Container state (created, restarting, running, removing, paused, exited, dead)|`TBD`| +|TBD|status|TEXT|Container status information|`TBD`| +|TBD|pid|BIGINT|Identifier of the initial process|`TBD`| +|TBD|path|TEXT|Container path|`TBD`| +|TBD|config_entrypoint|TEXT|Container entrypoint(s)|`TBD`| +|TBD|started_at|TEXT|Container start time as string|`TBD`| +|TBD|finished_at|TEXT|Container finish time as string|`TBD`| +|TBD|privileged|INTEGER|Is the container privileged|`TBD`| +|TBD|security_options|TEXT|List of container security options|`TBD`| +|TBD|env_variables|TEXT|Container environmental variables|`TBD`| +|TBD|readonly_rootfs|INTEGER|Is the root filesystem mounted as read only|`TBD`| +|TBD|cgroup_namespace|TEXT|cgroup namespace [LINUX]|`TBD`| +|TBD|ipc_namespace|TEXT|IPC namespace [LINUX]|`TBD`| +|TBD|mnt_namespace|TEXT|Mount namespace [LINUX]|`TBD`| +|TBD|net_namespace|TEXT|Network namespace [LINUX]|`TBD`| +|TBD|pid_namespace|TEXT|PID namespace [LINUX]|`TBD`| +|TBD|user_namespace|TEXT|User namespace [LINUX]|`TBD`| +|TBD|uts_namespace|TEXT|UTS namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_containers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_image_labels.md b/data_dictionaries/macos/osquery/events/docker_image_labels.md new file mode 100644 index 000000000..1d0cc7a94 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_image_labels.md @@ -0,0 +1,17 @@ +# Docker_image_labels Table + +## Description +Docker image labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Image ID|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_image_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_image_layers.md b/data_dictionaries/macos/osquery/events/docker_image_layers.md new file mode 100644 index 000000000..04a45fba7 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_image_layers.md @@ -0,0 +1,17 @@ +# Docker_image_layers Table + +## Description +Docker image layers information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Image ID|`TBD`| +|TBD|layer_id|TEXT|Layer ID|`TBD`| +|TBD|layer_order|INTEGER|Layer Order (1 = base layer)|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_image_layers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_images.md b/data_dictionaries/macos/osquery/events/docker_images.md new file mode 100644 index 000000000..dfd27158e --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_images.md @@ -0,0 +1,18 @@ +# Docker_images Table + +## Description +Docker images information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Image ID|`TBD`| +|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`| +|TBD|size_bytes|BIGINT|Size of image in bytes|`TBD`| +|TBD|tags|TEXT|Comma-separated list of repository tags|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_images) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_info.md b/data_dictionaries/macos/osquery/events/docker_info.md new file mode 100644 index 000000000..30896cd19 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_info.md @@ -0,0 +1,46 @@ +# Docker_info Table + +## Description +Docker system information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Docker system ID|`TBD`| +|TBD|containers|INTEGER|Total number of containers|`TBD`| +|TBD|containers_running|INTEGER|Number of containers currently running|`TBD`| +|TBD|containers_paused|INTEGER|Number of containers in paused state|`TBD`| +|TBD|containers_stopped|INTEGER|Number of containers in stopped state|`TBD`| +|TBD|images|INTEGER|Number of images|`TBD`| +|TBD|storage_driver|TEXT|Storage driver|`TBD`| +|TBD|memory_limit|INTEGER|1 if memory limit support is enabled. 0 otherwise|`TBD`| +|TBD|swap_limit|INTEGER|1 if swap limit support is enabled. 0 otherwise|`TBD`| +|TBD|kernel_memory|INTEGER|1 if kernel memory limit support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_cfs_period|INTEGER|1 if CPU Completely Fair Scheduler (CFS) period support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_cfs_quota|INTEGER|1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_shares|INTEGER|1 if CPU share weighting support is enabled. 0 otherwise|`TBD`| +|TBD|cpu_set|INTEGER|1 if CPU set selection support is enabled. 0 otherwise|`TBD`| +|TBD|ipv4_forwarding|INTEGER|1 if IPv4 forwarding is enabled. 0 otherwise|`TBD`| +|TBD|bridge_nf_iptables|INTEGER|1 if bridge netfilter iptables is enabled. 0 otherwise|`TBD`| +|TBD|bridge_nf_ip6tables|INTEGER|1 if bridge netfilter ip6tables is enabled. 0 otherwise|`TBD`| +|TBD|oom_kill_disable|INTEGER|1 if Out-of-memory kill is disabled. 0 otherwise|`TBD`| +|TBD|logging_driver|TEXT|Logging driver|`TBD`| +|TBD|cgroup_driver|TEXT|Control groups driver|`TBD`| +|TBD|kernel_version|TEXT|Kernel version|`TBD`| +|TBD|os|TEXT|Operating system|`TBD`| +|TBD|os_type|TEXT|Operating system type|`TBD`| +|TBD|architecture|TEXT|Hardware architecture|`TBD`| +|TBD|cpus|INTEGER|Number of CPUs|`TBD`| +|TBD|memory|BIGINT|Total memory|`TBD`| +|TBD|http_proxy|TEXT|HTTP proxy|`TBD`| +|TBD|https_proxy|TEXT|HTTPS proxy|`TBD`| +|TBD|no_proxy|TEXT|Comma-separated list of domain extensions proxy should not be used for|`TBD`| +|TBD|name|TEXT|Name of the docker host|`TBD`| +|TBD|server_version|TEXT|Server version|`TBD`| +|TBD|root_dir|TEXT|Docker root directory|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_network_labels.md b/data_dictionaries/macos/osquery/events/docker_network_labels.md new file mode 100644 index 000000000..eeb318589 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_network_labels.md @@ -0,0 +1,17 @@ +# Docker_network_labels Table + +## Description +Docker network labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Network ID|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_network_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_networks.md b/data_dictionaries/macos/osquery/events/docker_networks.md new file mode 100644 index 000000000..dcf3f8884 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_networks.md @@ -0,0 +1,21 @@ +# Docker_networks Table + +## Description +Docker networks information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|id|TEXT|Network ID|`TBD`| +|TBD|name|TEXT|Network name|`TBD`| +|TBD|driver|TEXT|Network driver|`TBD`| +|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`| +|TBD|enable_ipv6|INTEGER|1 if IPv6 is enabled on this network. 0 otherwise|`TBD`| +|TBD|subnet|TEXT|Network subnet|`TBD`| +|TBD|gateway|TEXT|Network gateway|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_networks) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_version.md b/data_dictionaries/macos/osquery/events/docker_version.md new file mode 100644 index 000000000..d07a81814 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_version.md @@ -0,0 +1,23 @@ +# Docker_version Table + +## Description +Docker version information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version|TEXT|Docker version|`TBD`| +|TBD|api_version|TEXT|API version|`TBD`| +|TBD|min_api_version|TEXT|Minimum API version supported|`TBD`| +|TBD|git_commit|TEXT|Docker build git commit|`TBD`| +|TBD|go_version|TEXT|Go version|`TBD`| +|TBD|os|TEXT|Operating system|`TBD`| +|TBD|arch|TEXT|Hardware architecture|`TBD`| +|TBD|kernel_version|TEXT|Kernel version|`TBD`| +|TBD|build_time|TEXT|Build time|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_version) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_volume_labels.md b/data_dictionaries/macos/osquery/events/docker_volume_labels.md new file mode 100644 index 000000000..b253b7040 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_volume_labels.md @@ -0,0 +1,17 @@ +# Docker_volume_labels Table + +## Description +Docker volume labels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Volume name|`TBD`| +|TBD|key|TEXT|Label key|`TBD`| +|TBD|value|TEXT|Optional label value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_volume_labels) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/docker_volumes.md b/data_dictionaries/macos/osquery/events/docker_volumes.md new file mode 100644 index 000000000..47222dd73 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/docker_volumes.md @@ -0,0 +1,18 @@ +# Docker_volumes Table + +## Description +Docker volumes information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Volume name|`TBD`| +|TBD|driver|TEXT|Volume driver|`TBD`| +|TBD|mount_point|TEXT|Mount point|`TBD`| +|TBD|type|TEXT|Volume type|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#docker_volumes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/etc_hosts.md b/data_dictionaries/macos/osquery/events/etc_hosts.md new file mode 100644 index 000000000..e9d7d7b46 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/etc_hosts.md @@ -0,0 +1,16 @@ +# Etc_hosts Table + +## Description +Line-parsed /etc/hosts. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|address|TEXT|IP address mapping|`TBD`| +|TBD|hostnames|TEXT|Raw hosts mapping|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_hosts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/etc_protocols.md b/data_dictionaries/macos/osquery/events/etc_protocols.md new file mode 100644 index 000000000..2f64147da --- /dev/null +++ b/data_dictionaries/macos/osquery/events/etc_protocols.md @@ -0,0 +1,18 @@ +# Etc_protocols Table + +## Description +Line-parsed /etc/protocols. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Protocol name|`TBD`| +|TBD|number|INTEGER|Protocol number|`TBD`| +|TBD|alias|TEXT|Protocol alias|`TBD`| +|TBD|comment|TEXT|Comment with protocol description|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_protocols) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/etc_services.md b/data_dictionaries/macos/osquery/events/etc_services.md new file mode 100644 index 000000000..07d2dc4d7 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/etc_services.md @@ -0,0 +1,19 @@ +# Etc_services Table + +## Description +Line-parsed /etc/services. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Service name|`TBD`| +|TBD|port|INTEGER|Service port number|`TBD`| +|TBD|protocol|TEXT|Transport protocol (TCP/UDP)|`TBD`| +|TBD|aliases|TEXT|Optional space separated list of other names for a service|`TBD`| +|TBD|comment|TEXT|Optional comment for a service.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_services) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/event_taps.md b/data_dictionaries/macos/osquery/events/event_taps.md new file mode 100644 index 000000000..2b840d4f0 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/event_taps.md @@ -0,0 +1,19 @@ +# Event_taps Table + +## Description +Returns information about installed event taps. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|enabled|INTEGER|Is the Event Tap enabled|`TBD`| +|TBD|event_tap_id|INTEGER|Unique ID for the Tap|`TBD`| +|TBD|event_tapped|TEXT|The mask that identifies the set of events to be observed.|`TBD`| +|TBD|process_being_tapped|INTEGER|The process ID of the target application|`TBD`| +|TBD|tapping_process|INTEGER|The process ID of the application that created the event tap.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#event_taps) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/example.md b/data_dictionaries/macos/osquery/events/example.md new file mode 100644 index 000000000..4c7554cd9 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/example.md @@ -0,0 +1,20 @@ +# Example Table + +## Description +This is an example table spec. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Description for name column|`TBD`| +|TBD|points|INTEGER|This is a signed SQLite int column|`TBD`| +|TBD|size|BIGINT|This is a signed SQLite bigint column|`TBD`| +|TBD|action|TEXT|Action performed in generation|`TBD`| +|TBD|id|INTEGER|An index of some sort|`TBD`| +|TBD|path|TEXT|Path of example|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#example) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/extended_attributes.md b/data_dictionaries/macos/osquery/events/extended_attributes.md new file mode 100644 index 000000000..b656a7493 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/extended_attributes.md @@ -0,0 +1,19 @@ +# Extended_attributes Table + +## Description +Returns the extended attributes for files (similar to Windows ADS). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Absolute file path|`TBD`| +|TBD|directory|TEXT|Directory of file(s)|`TBD`| +|TBD|key|TEXT|Name of the value generated from the extended attribute|`TBD`| +|TBD|value|TEXT|The parsed information from the attribute|`TBD`| +|TBD|base64|INTEGER|1 if the value is base64 encoded else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#extended_attributes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/fan_speed_sensors.md b/data_dictionaries/macos/osquery/events/fan_speed_sensors.md new file mode 100644 index 000000000..6fd62042a --- /dev/null +++ b/data_dictionaries/macos/osquery/events/fan_speed_sensors.md @@ -0,0 +1,20 @@ +# Fan_speed_sensors Table + +## Description +Fan speeds. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|fan|TEXT|Fan number|`TBD`| +|TBD|name|TEXT|Fan name|`TBD`| +|TBD|actual|INTEGER|Actual speed|`TBD`| +|TBD|min|INTEGER|Minimum speed|`TBD`| +|TBD|max|INTEGER|Maximum speed|`TBD`| +|TBD|target|INTEGER|Target speed|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#fan_speed_sensors) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/file.md b/data_dictionaries/macos/osquery/events/file.md index f0ffcefbf..ba6d09da8 100644 --- a/data_dictionaries/macos/osquery/events/file.md +++ b/data_dictionaries/macos/osquery/events/file.md @@ -6,23 +6,27 @@ Interactive filesystem attributes and metadata. ## Data Dictionary |Standard Name|Field Name|Type|Description|Sample Value| |---|---|---|---|---| -|file _path|path|TEXT|Absolute file path|``| -|file_directory|directory|TEXT|Directory of file(s)|``| -|file_name|filename|TEXT|Name portion of file path|``| -|file_inode|inode|BIGINT|Filesystem inode number|``| -|user_uid|uid|BIGINT|Owning user ID|``| -|user_gid|gid|BIGINT|Owning group ID|``| -|user_permissions|mode|TEXT|Permission bits|``| -|device_id|device|BIGINT|Device ID (optional)|``| -|file_size|size|BIGINT|Size of file in bytes|``| -|file_block_size|block_size|INTEGER|Block size of filesystem|``| -|date_last_access|atime|BIGINT|Last access time|``| -|date_last_modification|mtime|BIGINT|Last modification time|``| -|date_last_status_change|ctime|BIGINT|Last status change time|``| -|date_creation_time|btime|BIGINT|(B)irth or (cr)eate time|``| -|file_hard_links|hard_links|INTEGER|Number of hard links|``| -|file_symlink|symlink|INTEGER|1 if the path is a symlink, otherwise 0|``| -|file_type|type|TEXT|File status|``| +|file_path|path|TEXT|Absolute file path|`file_directory`| +|TBD|directory|TEXT|Directory of file(s)|`TBD`| +|file_name|filename|TEXT|Name portion of file path|`TBD`| +|file_inode|inode|BIGINT|Filesystem inode number|`TBD`| +|user_uid|uid|BIGINT|Owning user ID|`TBD`| +|user_gid|gid|BIGINT|Owning group ID|`TBD`| +|user_permissions|mode|TEXT|Permission bits|`TBD`| +|device_id|device|BIGINT|Device ID (optional)|`TBD`| +|file_size|size|BIGINT|Size of file in bytes|`TBD`| +|file_system_block_size|block_size|INTEGER|Block size of filesystem|`TBD`| +|date_last_access|atime|BIGINT|Last access time|`TBD`| +|date_last_modification|mtime|BIGINT|Last modification time|`TBD`| +|date_last_status_change|ctime|BIGINT|Last status change time|`TBD`| +|date_creation_time|btime|BIGINT|(B)irth or (cr)eate time|`TBD`| +|file_hard_links|hard_links|INTEGER|Number of hard links|`TBD`| +|file_symlink|symlink|INTEGER|1 if the path is a symlink, otherwise 0|`TBD`| +|file_type|type|TEXT|File status|`TBD`| +|TBD|bsd_flags|TEXT|The BSD file flags (chflags). Possible values: NODUMP, UF_IMMUTABLE, UF_APPEND, OPAQUE, HIDDEN, ARCHIVED, SF_IMMUTABLE, SF_APPEND [DARWIN]|`TBD`| ## References -* [osquery GitHub](https://github.com/facebook/osquery/blob/master/specs/utility/file.table) +* [OSQuery table documentation](https://osquery.io/schema/current#file) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/file_events.md b/data_dictionaries/macos/osquery/events/file_events.md new file mode 100644 index 000000000..6bc656b82 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/file_events.md @@ -0,0 +1,31 @@ +# File_events Table + +## Description +Track time/action changes to files specified in configuration data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|target_path|TEXT|The path associated with the event|`TBD`| +|TBD|category|TEXT|The category of the file defined in the config|`TBD`| +|TBD|action|TEXT|Change action (UPDATE, REMOVE, etc)|`TBD`| +|TBD|transaction_id|BIGINT|ID used during bulk update|`TBD`| +|TBD|inode|BIGINT|Filesystem inode number|`TBD`| +|TBD|uid|BIGINT|Owning user ID|`TBD`| +|TBD|gid|BIGINT|Owning group ID|`TBD`| +|TBD|mode|TEXT|Permission bits|`TBD`| +|TBD|size|BIGINT|Size of file in bytes|`TBD`| +|TBD|atime|BIGINT|Last access time|`TBD`| +|TBD|mtime|BIGINT|Last modification time|`TBD`| +|TBD|ctime|BIGINT|Last status change time|`TBD`| +|TBD|md5|TEXT|The MD5 of the file after change|`TBD`| +|TBD|sha1|TEXT|The SHA1 of the file after change|`TBD`| +|TBD|sha256|TEXT|The SHA256 of the file after change|`TBD`| +|TBD|time|BIGINT|Time of file event|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#file_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/firefox_addons.md b/data_dictionaries/macos/osquery/events/firefox_addons.md new file mode 100644 index 000000000..e84713206 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/firefox_addons.md @@ -0,0 +1,26 @@ +# Firefox_addons Table + +## Description +Firefox browser extensions, webapps, and addons. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the addon|`TBD`| +|TBD|name|TEXT|Addon display name|`TBD`| +|TBD|identifier|TEXT|Addon identifier|`TBD`| +|TBD|creator|TEXT|Addon-supported creator string|`TBD`| +|TBD|type|TEXT|Extension, addon, webapp|`TBD`| +|TBD|version|TEXT|Addon-supplied version string|`TBD`| +|TBD|description|TEXT|Addon-supplied description string|`TBD`| +|TBD|source_url|TEXT|URL that installed the addon|`TBD`| +|TBD|visible|INTEGER|1 If the addon is shown in browser else 0|`TBD`| +|TBD|active|INTEGER|1 If the addon is active else 0|`TBD`| +|TBD|location|TEXT|Global, profile location|`TBD`| +|TBD|path|TEXT|Path to plugin bundle|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#firefox_addons) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/gatekeeper.md b/data_dictionaries/macos/osquery/events/gatekeeper.md new file mode 100644 index 000000000..8ff359286 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/gatekeeper.md @@ -0,0 +1,18 @@ +# Gatekeeper Table + +## Description +OS X Gatekeeper Details. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|assessments_enabled|INTEGER|1 If a Gatekeeper is enabled else 0|`TBD`| +|TBD|dev_id_enabled|INTEGER|1 If a Gatekeeper allows execution from identified developers else 0|`TBD`| +|TBD|version|TEXT|Version of Gatekeeper's gke.bundle|`TBD`| +|TBD|opaque_version|TEXT|Version of Gatekeeper's gkopaque.bundle|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#gatekeeper) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/gatekeeper_approved_apps.md b/data_dictionaries/macos/osquery/events/gatekeeper_approved_apps.md new file mode 100644 index 000000000..4a3ec9c60 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/gatekeeper_approved_apps.md @@ -0,0 +1,18 @@ +# Gatekeeper_approved_apps Table + +## Description +Gatekeeper apps a user has allowed to run. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Path of executable allowed to run|`TBD`| +|TBD|requirement|TEXT|Code signing requirement language|`TBD`| +|TBD|ctime|DOUBLE|Last change time|`TBD`| +|TBD|mtime|DOUBLE|Last modification time|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#gatekeeper_approved_apps) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/groups.md b/data_dictionaries/macos/osquery/events/groups.md new file mode 100644 index 000000000..7f3d58f79 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/groups.md @@ -0,0 +1,20 @@ +# Groups Table + +## Description +Local system groups. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|gid|BIGINT|Unsigned int64 group ID|`TBD`| +|TBD|gid_signed|BIGINT|A signed int64 version of gid|`TBD`| +|TBD|groupname|TEXT|Canonical local group name|`TBD`| +|TBD|group_sid|TEXT|Unique group ID [WINDOWS]|`TBD`| +|TBD|comment|TEXT|Remarks or comments associated with the group [WINDOWS]|`TBD`| +|TBD|is_hidden|INTEGER|IsHidden attribute set in OpenDirectory [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#groups) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/hardware_events.md b/data_dictionaries/macos/osquery/events/hardware_events.md new file mode 100644 index 000000000..9f435b8ed --- /dev/null +++ b/data_dictionaries/macos/osquery/events/hardware_events.md @@ -0,0 +1,26 @@ +# Hardware_events Table + +## Description +Hardware (PCI/USB/HID) events from UDEV or IOKit. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|action|TEXT|Remove, insert, change properties, etc|`TBD`| +|TBD|path|TEXT|Local device path assigned (optional)|`TBD`| +|TBD|type|TEXT|Type of hardware and hardware event|`TBD`| +|TBD|driver|TEXT|Driver claiming the device|`TBD`| +|TBD|vendor|TEXT|Hardware device vendor|`TBD`| +|TBD|vendor_id|TEXT|Hex encoded Hardware vendor identifier|`TBD`| +|TBD|model|TEXT|Hardware device model|`TBD`| +|TBD|model_id|TEXT|Hex encoded Hardware model identifier|`TBD`| +|TBD|serial|TEXT|Device serial (optional)|`TBD`| +|TBD|revision|TEXT|Device revision (optional)|`TBD`| +|TBD|time|BIGINT|Time of hardware event|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#hardware_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/hash.md b/data_dictionaries/macos/osquery/events/hash.md new file mode 100644 index 000000000..75df7954d --- /dev/null +++ b/data_dictionaries/macos/osquery/events/hash.md @@ -0,0 +1,20 @@ +# Hash Table + +## Description +Filesystem hash data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Must provide a path or directory|`TBD`| +|TBD|directory|TEXT|Must provide a path or directory|`TBD`| +|TBD|md5|TEXT|MD5 hash of provided filesystem data|`TBD`| +|TBD|sha1|TEXT|SHA1 hash of provided filesystem data|`TBD`| +|TBD|sha256|TEXT|SHA256 hash of provided filesystem data|`TBD`| +|TBD|ssdeep|TEXT|ssdeep hash of provided filesystem data [POSIX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#hash) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/homebrew_packages.md b/data_dictionaries/macos/osquery/events/homebrew_packages.md new file mode 100644 index 000000000..a41f13ed0 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/homebrew_packages.md @@ -0,0 +1,17 @@ +# Homebrew_packages Table + +## Description +The installed homebrew package database. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package name|`TBD`| +|TBD|path|TEXT|Package install path|`TBD`| +|TBD|version|TEXT|Current 'linked' version|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#homebrew_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/hvci_status.md b/data_dictionaries/macos/osquery/events/hvci_status.md new file mode 100644 index 000000000..37f762ef8 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/hvci_status.md @@ -0,0 +1,19 @@ +# Hvci_status Table + +## Description +Retrieve HVCI info of the machine. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version|TEXT|The version number of the Device Guard build.|`TBD`| +|TBD|instance_identifier|TEXT|The instance ID of Device Guard.|`TBD`| +|TBD|vbs_status|TEXT|The status of the virtualization based security settings. Returns UNKNOWN if an error is encountered.|`TBD`| +|TBD|code_integrity_policy_enforcement_status|TEXT|The status of the code integrity policy enforcement settings. Returns UNKNOWN if an error is encountered.|`TBD`| +|TBD|umci_policy_status|TEXT|The status of the User Mode Code Integrity security settings. Returns UNKNOWN if an error is encountered.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#hvci_status) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/ibridge_info.md b/data_dictionaries/macos/osquery/events/ibridge_info.md new file mode 100644 index 000000000..0111ecf3c --- /dev/null +++ b/data_dictionaries/macos/osquery/events/ibridge_info.md @@ -0,0 +1,18 @@ +# Ibridge_info Table + +## Description +Information about the Apple iBridge hardware controller. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|boot_uuid|TEXT|Boot UUID of the iBridge controller|`TBD`| +|TBD|coprocessor_version|TEXT|The manufacturer and chip version|`TBD`| +|TBD|firmware_version|TEXT|The build version of the firmware|`TBD`| +|TBD|unique_chip_id|TEXT|Unique id of the iBridge controller|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ibridge_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/interface_addresses.md b/data_dictionaries/macos/osquery/events/interface_addresses.md new file mode 100644 index 000000000..195a93f94 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/interface_addresses.md @@ -0,0 +1,21 @@ +# Interface_addresses Table + +## Description +Network interfaces and relevant metadata. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|address|TEXT|Specific address for interface|`TBD`| +|TBD|mask|TEXT|Interface netmask|`TBD`| +|TBD|broadcast|TEXT|Broadcast address for the interface|`TBD`| +|TBD|point_to_point|TEXT|PtP address for the interface|`TBD`| +|TBD|type|TEXT|Type of address. One of dhcp, manual, auto, other, unknown|`TBD`| +|TBD|friendly_name|TEXT|The friendly display name of the interface. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_addresses) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/interface_details.md b/data_dictionaries/macos/osquery/events/interface_details.md new file mode 100644 index 000000000..48f42856b --- /dev/null +++ b/data_dictionaries/macos/osquery/events/interface_details.md @@ -0,0 +1,49 @@ +# Interface_details Table + +## Description +Detailed information and stats of network interfaces. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|mac|TEXT|MAC of interface (optional)|`TBD`| +|TBD|type|INTEGER|Interface type (includes virtual)|`TBD`| +|TBD|mtu|INTEGER|Network MTU|`TBD`| +|TBD|metric|INTEGER|Metric based on the speed of the interface|`TBD`| +|TBD|flags|INTEGER|Flags (netdevice) for the device|`TBD`| +|TBD|ipackets|BIGINT|Input packets|`TBD`| +|TBD|opackets|BIGINT|Output packets|`TBD`| +|TBD|ibytes|BIGINT|Input bytes|`TBD`| +|TBD|obytes|BIGINT|Output bytes|`TBD`| +|TBD|ierrors|BIGINT|Input errors|`TBD`| +|TBD|oerrors|BIGINT|Output errors|`TBD`| +|TBD|idrops|BIGINT|Input drops|`TBD`| +|TBD|odrops|BIGINT|Output drops|`TBD`| +|TBD|collisions|BIGINT|Packet Collisions detected|`TBD`| +|TBD|last_change|BIGINT|Time of last device modification (optional)|`TBD`| +|TBD|link_speed|BIGINT|Interface speed in Mb/s [POSIX]|`TBD`| +|TBD|pci_slot|TEXT|PCI slot number [LINUX]|`TBD`| +|TBD|friendly_name|TEXT|The friendly display name of the interface. [WINDOWS]|`TBD`| +|TBD|description|TEXT|Short description of the object a one-line string. [WINDOWS]|`TBD`| +|TBD|manufacturer|TEXT|Name of the network adapter's manufacturer. [WINDOWS]|`TBD`| +|TBD|connection_id|TEXT|Name of the network connection as it appears in the Network Connections Control Panel program. [WINDOWS]|`TBD`| +|TBD|connection_status|TEXT|State of the network adapter connection to the network. [WINDOWS]|`TBD`| +|TBD|enabled|INTEGER|Indicates whether the adapter is enabled or not. [WINDOWS]|`TBD`| +|TBD|physical_adapter|INTEGER|Indicates whether the adapter is a physical or a logical adapter. [WINDOWS]|`TBD`| +|TBD|speed|INTEGER|Estimate of the current bandwidth in bits per second. [WINDOWS]|`TBD`| +|TBD|service|TEXT|The name of the service the network adapter uses. [WINDOWS]|`TBD`| +|TBD|dhcp_enabled|INTEGER|If TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection. [WINDOWS]|`TBD`| +|TBD|dhcp_lease_expires|TEXT|Expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dhcp_lease_obtained|TEXT|Date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dhcp_server|TEXT|IP address of the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dns_domain|TEXT|Organization name followed by a period and an extension that indicates the type of organization, such as 'microsoft.com'. [WINDOWS]|`TBD`| +|TBD|dns_domain_suffix_search_order|TEXT|Array of DNS domain suffixes to be appended to the end of host names during name resolution. [WINDOWS]|`TBD`| +|TBD|dns_host_name|TEXT|Host name used to identify the local computer for authentication by some utilities. [WINDOWS]|`TBD`| +|TBD|dns_server_search_order|TEXT|Array of server IP addresses to be used in querying for DNS servers. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_details) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/interface_ipv6.md b/data_dictionaries/macos/osquery/events/interface_ipv6.md new file mode 100644 index 000000000..17e5dc4a0 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/interface_ipv6.md @@ -0,0 +1,19 @@ +# Interface_ipv6 Table + +## Description +IPv6 configuration and stats of network interfaces. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|hop_limit|INTEGER|Current Hop Limit|`TBD`| +|TBD|forwarding_enabled|INTEGER|Enable IP forwarding|`TBD`| +|TBD|redirect_accept|INTEGER|Accept ICMP redirect messages|`TBD`| +|TBD|rtadv_accept|INTEGER|Accept ICMP Router Advertisement|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_ipv6) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/iokit_devicetree.md b/data_dictionaries/macos/osquery/events/iokit_devicetree.md new file mode 100644 index 000000000..6622f4b61 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/iokit_devicetree.md @@ -0,0 +1,23 @@ +# Iokit_devicetree Table + +## Description +The IOKit registry matching the DeviceTree plane. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Device node name|`TBD`| +|TBD|class|TEXT|Best matching device class (most-specific category)|`TBD`| +|TBD|id|BIGINT|IOKit internal registry ID|`TBD`| +|TBD|parent|BIGINT|Parent device registry ID|`TBD`| +|TBD|device_path|TEXT|Device tree path|`TBD`| +|TBD|service|INTEGER|1 if the device conforms to IOService else 0|`TBD`| +|TBD|busy_state|INTEGER|1 if the device is in a busy state else 0|`TBD`| +|TBD|retain_count|INTEGER|The device reference count|`TBD`| +|TBD|depth|INTEGER|Device nested depth|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#iokit_devicetree) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/iokit_registry.md b/data_dictionaries/macos/osquery/events/iokit_registry.md new file mode 100644 index 000000000..90f9c4722 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/iokit_registry.md @@ -0,0 +1,21 @@ +# Iokit_registry Table + +## Description +The full IOKit registry without selecting a plane. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Default name of the node|`TBD`| +|TBD|class|TEXT|Best matching device class (most-specific category)|`TBD`| +|TBD|id|BIGINT|IOKit internal registry ID|`TBD`| +|TBD|parent|BIGINT|Parent registry ID|`TBD`| +|TBD|busy_state|INTEGER|1 if the node is in a busy state else 0|`TBD`| +|TBD|retain_count|INTEGER|The node reference count|`TBD`| +|TBD|depth|INTEGER|Node nested depth|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#iokit_registry) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/kernel_extensions.md b/data_dictionaries/macos/osquery/events/kernel_extensions.md new file mode 100644 index 000000000..3336af2c0 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/kernel_extensions.md @@ -0,0 +1,20 @@ +# Kernel_extensions Table + +## Description +OS X's kernel extensions, both loaded and within the load search path. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|idx|INTEGER|Extension load tag or index|`TBD`| +|TBD|refs|INTEGER|Reference count|`TBD`| +|TBD|size|BIGINT|Bytes of wired memory used by extension|`TBD`| +|TBD|name|TEXT|Extension label|`TBD`| +|TBD|version|TEXT|Extension version|`TBD`| +|TBD|path|TEXT|Optional path to extension bundle|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#kernel_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/kernel_info.md b/data_dictionaries/macos/osquery/events/kernel_info.md new file mode 100644 index 000000000..a7801b5c2 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/kernel_info.md @@ -0,0 +1,18 @@ +# Kernel_info Table + +## Description +Basic active kernel information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version|TEXT|Kernel version|`TBD`| +|TBD|arguments|TEXT|Kernel arguments|`TBD`| +|TBD|path|TEXT|Kernel path|`TBD`| +|TBD|device|TEXT|Kernel device identifier|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#kernel_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/kernel_panics.md b/data_dictionaries/macos/osquery/events/kernel_panics.md new file mode 100644 index 000000000..1ac758cf9 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/kernel_panics.md @@ -0,0 +1,27 @@ +# Kernel_panics Table + +## Description +System kernel panic logs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Location of log file|`TBD`| +|TBD|time|TEXT|Formatted time of the event|`TBD`| +|TBD|registers|TEXT|A space delimited line of register:value pairs|`TBD`| +|TBD|frame_backtrace|TEXT|Backtrace of the crashed module|`TBD`| +|TBD|module_backtrace|TEXT|Modules appearing in the crashed module's backtrace|`TBD`| +|TBD|dependencies|TEXT|Module dependencies existing in crashed module's backtrace|`TBD`| +|TBD|name|TEXT|Process name corresponding to crashed thread|`TBD`| +|TBD|os_version|TEXT|Version of the operating system|`TBD`| +|TBD|kernel_version|TEXT|Version of the system kernel|`TBD`| +|TBD|system_model|TEXT|Physical system model, for example 'MacBookPro12,1 (Mac-E43C1C25D4880AD6)'|`TBD`| +|TBD|uptime|BIGINT|System uptime at kernel panic in nanoseconds|`TBD`| +|TBD|last_loaded|TEXT|Last loaded module before panic|`TBD`| +|TBD|last_unloaded|TEXT|Last unloaded module before panic|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#kernel_panics) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/keychain_acls.md b/data_dictionaries/macos/osquery/events/keychain_acls.md new file mode 100644 index 000000000..2b8c528b0 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/keychain_acls.md @@ -0,0 +1,19 @@ +# Keychain_acls Table + +## Description +Applications that have ACL entries in the keychain. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|keychain_path|TEXT|The path of the keychain|`TBD`| +|TBD|authorizations|TEXT|A space delimited set of authorization attributes|`TBD`| +|TBD|path|TEXT|The path of the authorized application|`TBD`| +|TBD|description|TEXT|The description included with the ACL entry|`TBD`| +|TBD|label|TEXT|An optional label tag that may be included with the keychain entry|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#keychain_acls) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/keychain_items.md b/data_dictionaries/macos/osquery/events/keychain_items.md new file mode 100644 index 000000000..ead7e6a19 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/keychain_items.md @@ -0,0 +1,21 @@ +# Keychain_items Table + +## Description +Generic details about keychain items. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|label|TEXT|Generic item name|`TBD`| +|TBD|description|TEXT|Optional item description|`TBD`| +|TBD|comment|TEXT|Optional keychain comment|`TBD`| +|TBD|created|TEXT|Data item was created|`TBD`| +|TBD|modified|TEXT|Date of last modification|`TBD`| +|TBD|type|TEXT|Keychain item type (class)|`TBD`| +|TBD|path|TEXT|Path to keychain containing item|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#keychain_items) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/known_hosts.md b/data_dictionaries/macos/osquery/events/known_hosts.md new file mode 100644 index 000000000..3500f22c0 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/known_hosts.md @@ -0,0 +1,17 @@ +# Known_hosts Table + +## Description +A line-delimited known_hosts table. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the known_hosts file|`TBD`| +|TBD|key|TEXT|parsed authorized keys line|`TBD`| +|TBD|key_file|TEXT|Path to known_hosts file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#known_hosts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/last.md b/data_dictionaries/macos/osquery/events/last.md new file mode 100644 index 000000000..ab8d94bcf --- /dev/null +++ b/data_dictionaries/macos/osquery/events/last.md @@ -0,0 +1,20 @@ +# Last Table + +## Description +System logins and logouts. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|username|TEXT|Entry username|`TBD`| +|TBD|tty|TEXT|Entry terminal|`TBD`| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|type|INTEGER|Entry type, according to ut_type types (utmp.h)|`TBD`| +|TBD|time|INTEGER|Entry timestamp|`TBD`| +|TBD|host|TEXT|Entry hostname|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#last) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/launchd.md b/data_dictionaries/macos/osquery/events/launchd.md new file mode 100644 index 000000000..96c690cd1 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/launchd.md @@ -0,0 +1,27 @@ +# Launchd Table + +## Description +LaunchAgents and LaunchDaemons from default search paths. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Path to daemon or agent plist|`TBD`| +|TBD|name|TEXT|File name of plist (used by launchd)|`TBD`| +|TBD|label|TEXT|Daemon or agent service name|`TBD`| +|TBD|program|TEXT|Path to target program|`TBD`| +|TBD|run_at_load|TEXT|Should the program run on launch load|`TBD`| +|TBD|keep_alive|TEXT|Should the process be restarted if killed|`TBD`| +|TBD|on_demand|TEXT|Deprecated key, replaced by keep_alive|`TBD`| +|TBD|disabled|TEXT|Skip loading this daemon or agent on boot|`TBD`| +|TBD|username|TEXT|Run this daemon or agent as this username|`TBD`| +|TBD|groupname|TEXT|Run this daemon or agent as this group|`TBD`| +|TBD|stdout_path|TEXT|Pipe stdout to a target path|`TBD`| +|TBD|stderr_path|TEXT|Pipe stderr to a target path|`TBD`| +|TBD|start_interval|TEXT|Frequency to run in seconds|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#launchd) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/launchd_overrides.md b/data_dictionaries/macos/osquery/events/launchd_overrides.md new file mode 100644 index 000000000..a6892671a --- /dev/null +++ b/data_dictionaries/macos/osquery/events/launchd_overrides.md @@ -0,0 +1,19 @@ +# Launchd_overrides Table + +## Description +Override keys, per user, for LaunchDaemons and Agents. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|label|TEXT|Daemon or agent service name|`TBD`| +|TBD|key|TEXT|Name of the override key|`TBD`| +|TBD|value|TEXT|Overridden value|`TBD`| +|TBD|uid|BIGINT|User ID applied to the override, 0 applies to all|`TBD`| +|TBD|path|TEXT|Path to daemon or agent plist|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#launchd_overrides) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/listening_ports.md b/data_dictionaries/macos/osquery/events/listening_ports.md new file mode 100644 index 000000000..2d8444045 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/listening_ports.md @@ -0,0 +1,23 @@ +# Listening_ports Table + +## Description +Processes with listening (bound) network sockets/ports. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|port|INTEGER|Transport layer port|`TBD`| +|TBD|protocol|INTEGER|Transport protocol (TCP/UDP)|`TBD`| +|TBD|family|INTEGER|Network protocol (IPv4, IPv6)|`TBD`| +|TBD|address|TEXT|Specific address for bind|`TBD`| +|TBD|fd|BIGINT|Socket file descriptor number|`TBD`| +|TBD|socket|BIGINT|Socket handle or inode number|`TBD`| +|TBD|path|TEXT|Path for UNIX domain sockets|`TBD`| +|TBD|net_namespace|TEXT|The inode number of the network namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#listening_ports) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/lldp_neighbors.md b/data_dictionaries/macos/osquery/events/lldp_neighbors.md new file mode 100644 index 000000000..a0e8405bb --- /dev/null +++ b/data_dictionaries/macos/osquery/events/lldp_neighbors.md @@ -0,0 +1,83 @@ +# Lldp_neighbors Table + +## Description +LLDP neighbors of interfaces. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|rid|INTEGER|Neighbor chassis index|`TBD`| +|TBD|chassis_id_type|TEXT|Neighbor chassis ID type|`TBD`| +|TBD|chassis_id|TEXT|Neighbor chassis ID value|`TBD`| +|TBD|chassis_sysname|TEXT|CPU brand string, contains vendor and model|`TBD`| +|TBD|chassis_sys_description|INTEGER|Max number of CPU physical cores|`TBD`| +|TBD|chassis_bridge_capability_available|INTEGER|Chassis bridge capability availability|`TBD`| +|TBD|chassis_bridge_capability_enabled|INTEGER|Is chassis bridge capability enabled.|`TBD`| +|TBD|chassis_router_capability_available|INTEGER|Chassis router capability availability|`TBD`| +|TBD|chassis_router_capability_enabled|INTEGER|Chassis router capability enabled|`TBD`| +|TBD|chassis_repeater_capability_available|INTEGER|Chassis repeater capability availability|`TBD`| +|TBD|chassis_repeater_capability_enabled|INTEGER|Chassis repeater capability enabled|`TBD`| +|TBD|chassis_wlan_capability_available|INTEGER|Chassis wlan capability availability|`TBD`| +|TBD|chassis_wlan_capability_enabled|INTEGER|Chassis wlan capability enabled|`TBD`| +|TBD|chassis_tel_capability_available|INTEGER|Chassis telephone capability availability|`TBD`| +|TBD|chassis_tel_capability_enabled|INTEGER|Chassis telephone capability enabled|`TBD`| +|TBD|chassis_docsis_capability_available|INTEGER|Chassis DOCSIS capability availability|`TBD`| +|TBD|chassis_docsis_capability_enabled|INTEGER|Chassis DOCSIS capability enabled|`TBD`| +|TBD|chassis_station_capability_available|INTEGER|Chassis station capability availability|`TBD`| +|TBD|chassis_station_capability_enabled|INTEGER|Chassis station capability enabled|`TBD`| +|TBD|chassis_other_capability_available|INTEGER|Chassis other capability availability|`TBD`| +|TBD|chassis_other_capability_enabled|INTEGER|Chassis other capability enabled|`TBD`| +|TBD|chassis_mgmt_ips|TEXT|Comma delimited list of chassis management IPS|`TBD`| +|TBD|port_id_type|TEXT|Port ID type|`TBD`| +|TBD|port_id|TEXT|Port ID value|`TBD`| +|TBD|port_description|TEXT|Port description|`TBD`| +|TBD|port_ttl|BIGINT|Age of neighbor port|`TBD`| +|TBD|port_mfs|BIGINT|Port max frame size|`TBD`| +|TBD|port_aggregation_id|TEXT|Port aggregation ID|`TBD`| +|TBD|port_autoneg_supported|INTEGER|Auto negotiation supported|`TBD`| +|TBD|port_autoneg_enabled|INTEGER|Is auto negotiation enabled|`TBD`| +|TBD|port_mau_type|TEXT|MAU type|`TBD`| +|TBD|port_autoneg_10baset_hd_enabled|INTEGER|10Base-T HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_10baset_fd_enabled|INTEGER|10Base-T FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100basetx_hd_enabled|INTEGER|100Base-TX HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100basetx_fd_enabled|INTEGER|100Base-TX FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset2_hd_enabled|INTEGER|100Base-T2 HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset2_fd_enabled|INTEGER|100Base-T2 FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset4_hd_enabled|INTEGER|100Base-T4 HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_100baset4_fd_enabled|INTEGER|100Base-T4 FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000basex_hd_enabled|INTEGER|1000Base-X HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000basex_fd_enabled|INTEGER|1000Base-X FD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000baset_hd_enabled|INTEGER|1000Base-T HD auto negotiation enabled|`TBD`| +|TBD|port_autoneg_1000baset_fd_enabled|INTEGER|1000Base-T FD auto negotiation enabled|`TBD`| +|TBD|power_device_type|TEXT|Dot3 power device type|`TBD`| +|TBD|power_mdi_supported|INTEGER|MDI power supported|`TBD`| +|TBD|power_mdi_enabled|INTEGER|Is MDI power enabled|`TBD`| +|TBD|power_paircontrol_enabled|INTEGER|Is power pair control enabled|`TBD`| +|TBD|power_pairs|TEXT|Dot3 power pairs|`TBD`| +|TBD|power_class|TEXT|Power class|`TBD`| +|TBD|power_8023at_enabled|INTEGER|Is 802.3at enabled|`TBD`| +|TBD|power_8023at_power_type|TEXT|802.3at power type|`TBD`| +|TBD|power_8023at_power_source|TEXT|802.3at power source|`TBD`| +|TBD|power_8023at_power_priority|TEXT|802.3at power priority|`TBD`| +|TBD|power_8023at_power_allocated|TEXT|802.3at power allocated|`TBD`| +|TBD|power_8023at_power_requested|TEXT|802.3at power requested|`TBD`| +|TBD|med_device_type|TEXT|Chassis MED type|`TBD`| +|TBD|med_capability_capabilities|INTEGER|Is MED capabilities enabled|`TBD`| +|TBD|med_capability_policy|INTEGER|Is MED policy capability enabled|`TBD`| +|TBD|med_capability_location|INTEGER|Is MED location capability enabled|`TBD`| +|TBD|med_capability_mdi_pse|INTEGER|Is MED MDI PSE capability enabled|`TBD`| +|TBD|med_capability_mdi_pd|INTEGER|Is MED MDI PD capability enabled|`TBD`| +|TBD|med_capability_inventory|INTEGER|Is MED inventory capability enabled|`TBD`| +|TBD|med_policies|TEXT|Comma delimited list of MED policies|`TBD`| +|TBD|vlans|TEXT|Comma delimited list of vlan ids|`TBD`| +|TBD|pvid|TEXT|Primary VLAN id|`TBD`| +|TBD|ppvids_supported|TEXT|Comma delimited list of supported PPVIDs|`TBD`| +|TBD|ppvids_enabled|TEXT|Comma delimited list of enabled PPVIDs|`TBD`| +|TBD|pids|TEXT|Comma delimited list of PIDs|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#lldp_neighbors) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/load_average.md b/data_dictionaries/macos/osquery/events/load_average.md new file mode 100644 index 000000000..f5aaa4ad1 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/load_average.md @@ -0,0 +1,16 @@ +# Load_average Table + +## Description +Displays information about the system wide load averages. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|period|TEXT|Period over which the average is calculated.|`TBD`| +|TBD|average|TEXT|Load average over the specified period.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#load_average) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/logged_in_users.md b/data_dictionaries/macos/osquery/events/logged_in_users.md new file mode 100644 index 000000000..4a6a32b34 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/logged_in_users.md @@ -0,0 +1,22 @@ +# Logged_in_users Table + +## Description +Users with an active shell on the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|Login type|`TBD`| +|TBD|user|TEXT|User login name|`TBD`| +|TBD|tty|TEXT|Device name|`TBD`| +|TBD|host|TEXT|Remote hostname|`TBD`| +|TBD|time|INTEGER|Time entry was made|`TBD`| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|sid|TEXT|The user's unique security identifier [WINDOWS]|`TBD`| +|TBD|registry_hive|TEXT|HKEY_USERS registry hive [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#logged_in_users) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/magic.md b/data_dictionaries/macos/osquery/events/magic.md new file mode 100644 index 000000000..5c0be36a8 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/magic.md @@ -0,0 +1,19 @@ +# Magic Table + +## Description +Magic number recognition library table. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Absolute path to target file|`TBD`| +|TBD|magic_db_files|TEXT|Colon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgc|`TBD`| +|TBD|data|TEXT|Magic number data from libmagic|`TBD`| +|TBD|mime_type|TEXT|MIME type data from libmagic|`TBD`| +|TBD|mime_encoding|TEXT|MIME encoding data from libmagic|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#magic) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/managed_policies.md b/data_dictionaries/macos/osquery/events/managed_policies.md new file mode 100644 index 000000000..3df9f4fd5 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/managed_policies.md @@ -0,0 +1,20 @@ +# Managed_policies Table + +## Description +The managed configuration policies from AD, MDM, MCX, etc. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|domain|TEXT|System or manager-chosen domain key|`TBD`| +|TBD|uuid|TEXT|Optional UUID assigned to policy set|`TBD`| +|TBD|name|TEXT|Policy key name|`TBD`| +|TBD|value|TEXT|Policy value|`TBD`| +|TBD|username|TEXT|Policy applies only this user|`TBD`| +|TBD|manual|INTEGER|1 if policy was loaded manually, otherwise 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#managed_policies) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/mdfind.md b/data_dictionaries/macos/osquery/events/mdfind.md new file mode 100644 index 000000000..068546f96 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/mdfind.md @@ -0,0 +1,16 @@ +# Mdfind Table + +## Description +Run searches against the spotlight database. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Path of the file returned from spotlight|`TBD`| +|TBD|query|TEXT|The query that was run to find the file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#mdfind) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/memory_array_mapped_addresses.md b/data_dictionaries/macos/osquery/events/memory_array_mapped_addresses.md new file mode 100644 index 000000000..a41952e41 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/memory_array_mapped_addresses.md @@ -0,0 +1,15 @@ +# Memory_array_mapped_addresses Table + +## Description +Data associated for address mapping of physical memory arrays. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle| TEXT|Handle, or instance number, associated with the structure|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_array_mapped_addresses) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/memory_arrays.md b/data_dictionaries/macos/osquery/events/memory_arrays.md new file mode 100644 index 000000000..653cdfadb --- /dev/null +++ b/data_dictionaries/macos/osquery/events/memory_arrays.md @@ -0,0 +1,19 @@ +# Memory_arrays Table + +## Description +Data associated with collection of memory devices that operate to form a memory address. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle| TEXT|Handle, or instance number, associated with the array|`TBD`| +|TBD|location| TEXT|Physical location of the memory array|`TBD`| +|TBD|use|TEXT|Function for which the array is used|`TBD`| +|TBD|max_capacity|INTEGER|Maximum capacity of array in gigabytes|`TBD`| +|TBD|number_memory_devices|INTEGER|Number of memory devices on array|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_arrays) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/memory_device_mapped_addresses.md b/data_dictionaries/macos/osquery/events/memory_device_mapped_addresses.md new file mode 100644 index 000000000..713ba546f --- /dev/null +++ b/data_dictionaries/macos/osquery/events/memory_device_mapped_addresses.md @@ -0,0 +1,15 @@ +# Memory_device_mapped_addresses Table + +## Description +Data associated for address mapping of physical memory devices. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle| TEXT|Handle, or instance number, associated with the structure|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_device_mapped_addresses) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/memory_devices.md b/data_dictionaries/macos/osquery/events/memory_devices.md new file mode 100644 index 000000000..c2b1fc3ef --- /dev/null +++ b/data_dictionaries/macos/osquery/events/memory_devices.md @@ -0,0 +1,34 @@ +# Memory_devices Table + +## Description +Physical memory device (type 17) information retrieved from SMBIOS. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle| TEXT|Handle, or instance number, associated with the structure in SMBIOS|`TBD`| +|TBD|array_handle| TEXT|The memory array that the device is attached to|`TBD`| +|TBD|form_factor|TEXT|Implementation form factor for this memory device|`TBD`| +|TBD|total_width|INTEGER|Total width, in bits, of this memory device, including any check or error-correction bits|`TBD`| +|TBD|data_width|INTEGER|Data width, in bits, of this memory device|`TBD`| +|TBD|size|INTEGER|Size of memory device in Megabyte|`TBD`| +|TBD|set|INTEGER|Identifies if memory device is one of a set of devices. A value of 0 indicates no set affiliation.|`TBD`| +|TBD|device_locator|TEXT|String number of the string that identifies the physically-labeled socket or board position where the memory device is located|`TBD`| +|TBD|bank_locator|TEXT|String number of the string that identifies the physically-labeled bank where the memory device is located|`TBD`| +|TBD|memory_type|TEXT|Type of memory used|`TBD`| +|TBD|memory_type_details|TEXT|Additional details for memory device|`TBD`| +|TBD|max_speed|INTEGER|Max speed of memory device in megatransfers per second (MT/s)|`TBD`| +|TBD|configured_clock_speed|INTEGER|Configured speed of memory device in megatransfers per second (MT/s)|`TBD`| +|TBD|manufacturer|TEXT|Manufacturer ID string|`TBD`| +|TBD|serial_number|TEXT|Serial number of memory device|`TBD`| +|TBD|asset_tag|TEXT|Manufacturer specific asset tag of memory device|`TBD`| +|TBD|part_number|TEXT|Manufacturer specific serial number of memory device|`TBD`| +|TBD|min_voltage|INTEGER|Minimum operating voltage of device in millivolts|`TBD`| +|TBD|max_voltage|INTEGER|Maximum operating voltage of device in millivolts|`TBD`| +|TBD|configured_voltage|INTEGER|Configured operating voltage of device in millivolts|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_devices) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/memory_error_info.md b/data_dictionaries/macos/osquery/events/memory_error_info.md new file mode 100644 index 000000000..a15da7527 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/memory_error_info.md @@ -0,0 +1,15 @@ +# Memory_error_info Table + +## Description +Data associated with errors of a physical memory array. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle| TEXT|Handle, or instance number, associated with the structure|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#memory_error_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/mounts.md b/data_dictionaries/macos/osquery/events/mounts.md new file mode 100644 index 000000000..6d0f2a622 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/mounts.md @@ -0,0 +1,25 @@ +# Mounts Table + +## Description +System mounted devices and filesystems (not process specific). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device|TEXT|Mounted device|`TBD`| +|TBD|device_alias|TEXT|Mounted device alias|`TBD`| +|TBD|path|TEXT|Mounted device path|`TBD`| +|TBD|type|TEXT|Mounted device type|`TBD`| +|TBD|blocks_size|BIGINT|Block size in bytes|`TBD`| +|TBD|blocks|BIGINT|Mounted device used blocks|`TBD`| +|TBD|blocks_free|BIGINT|Mounted device free blocks|`TBD`| +|TBD|blocks_available|BIGINT|Mounted device available blocks|`TBD`| +|TBD|inodes|BIGINT|Mounted device used inodes|`TBD`| +|TBD|inodes_free|BIGINT|Mounted device free inodes|`TBD`| +|TBD|flags|TEXT|Mounted device flags|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#mounts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/nfs_shares.md b/data_dictionaries/macos/osquery/events/nfs_shares.md new file mode 100644 index 000000000..9acfc69d9 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/nfs_shares.md @@ -0,0 +1,17 @@ +# Nfs_shares Table + +## Description +NFS shares exported by the host. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|share|TEXT|Filesystem path to the share|`TBD`| +|TBD|options|TEXT|Options string set on the export share|`TBD`| +|TBD|readonly|INTEGER|1 if the share is exported readonly else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#nfs_shares) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/nvram.md b/data_dictionaries/macos/osquery/events/nvram.md new file mode 100644 index 000000000..812be7be6 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/nvram.md @@ -0,0 +1,17 @@ +# Nvram Table + +## Description +Apple NVRAM variable listing. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Variable name|`TBD`| +|TBD|type|TEXT|Data type (CFData, CFString, etc)|`TBD`| +|TBD|value|TEXT|Raw variable data|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#nvram) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/oem_strings.md b/data_dictionaries/macos/osquery/events/oem_strings.md new file mode 100644 index 000000000..611547524 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/oem_strings.md @@ -0,0 +1,17 @@ +# Oem_strings Table + +## Description +OEM defined strings retrieved from SMBIOS. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|handle|TEXT|Handle, or instance number, associated with the Type 11 structure|`TBD`| +|TBD|number|INTEGER|The string index of the structure|`TBD`| +|TBD|value|TEXT|The value of the OEM string|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#oem_strings) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/opera_extensions.md b/data_dictionaries/macos/osquery/events/opera_extensions.md new file mode 100644 index 000000000..7a3888d19 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/opera_extensions.md @@ -0,0 +1,23 @@ +# Opera_extensions Table + +## Description +Opera browser extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the extension|`TBD`| +|TBD|name|TEXT|Extension display name|`TBD`| +|TBD|identifier|TEXT|Extension identifier|`TBD`| +|TBD|version|TEXT|Extension-supplied version|`TBD`| +|TBD|description|TEXT|Extension-optional description|`TBD`| +|TBD|locale|TEXT|Default locale supported by extension|`TBD`| +|TBD|update_url|TEXT|Extension-supplied update URI|`TBD`| +|TBD|author|TEXT|Optional extension author|`TBD`| +|TBD|path|TEXT|Path to extension folder|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#opera_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/os_version.md b/data_dictionaries/macos/osquery/events/os_version.md new file mode 100644 index 000000000..0f7d5cd88 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/os_version.md @@ -0,0 +1,24 @@ +# Os_version Table + +## Description +A single row containing the operating system name and version. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Distribution or product name|`TBD`| +|TBD|version|TEXT|Pretty, suitable for presentation, OS version|`TBD`| +|TBD|major|INTEGER|Major release version|`TBD`| +|TBD|minor|INTEGER|Minor release version|`TBD`| +|TBD|patch|INTEGER|Optional patch release|`TBD`| +|TBD|build|TEXT|Optional build-specific or variant string|`TBD`| +|TBD|platform|TEXT|OS Platform or ID|`TBD`| +|TBD|platform_like|TEXT|Closely related platforms|`TBD`| +|TBD|codename|TEXT|OS version codename|`TBD`| +|TBD|install_date|TEXT|The install date of the OS. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#os_version) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/osquery_events.md b/data_dictionaries/macos/osquery/events/osquery_events.md new file mode 100644 index 000000000..8f658b32f --- /dev/null +++ b/data_dictionaries/macos/osquery/events/osquery_events.md @@ -0,0 +1,18 @@ +# Osquery_events Table + +## Description +Information about the event publishers and subscribers. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Event publisher or subscriber name|`TBD`| +|TBD|publisher|TEXT|Name of the associated publisher|`TBD`| +|TBD|type|TEXT|Either publisher or subscriber|`TBD`| +|TBD|refreshes|INTEGER|Publisher only: number of runloop restarts|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/osquery_extensions.md b/data_dictionaries/macos/osquery/events/osquery_extensions.md new file mode 100644 index 000000000..2052c8dec --- /dev/null +++ b/data_dictionaries/macos/osquery/events/osquery_extensions.md @@ -0,0 +1,20 @@ +# Osquery_extensions Table + +## Description +List of active osquery extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uuid|BIGINT|The transient ID assigned for communication|`TBD`| +|TBD|name|TEXT|Extension's name|`TBD`| +|TBD|version|TEXT|Extension's version|`TBD`| +|TBD|sdk_version|TEXT|osquery SDK version used to build the extension|`TBD`| +|TBD|path|TEXT|Path of the extenion's domain socket or library path|`TBD`| +|TBD|type|TEXT|SDK extension type: extension or module|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/osquery_flags.md b/data_dictionaries/macos/osquery/events/osquery_flags.md new file mode 100644 index 000000000..ac0ec4a46 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/osquery_flags.md @@ -0,0 +1,20 @@ +# Osquery_flags Table + +## Description +Configurable flags that modify osquery's behavior. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Flag name|`TBD`| +|TBD|type|TEXT|Flag type|`TBD`| +|TBD|description|TEXT|Flag description|`TBD`| +|TBD|default_value|TEXT|Flag default value|`TBD`| +|TBD|value|TEXT|Flag value|`TBD`| +|TBD|shell_only|INTEGER|Is the flag shell only?|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_flags) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/osquery_info.md b/data_dictionaries/macos/osquery/events/osquery_info.md new file mode 100644 index 000000000..823c21bfc --- /dev/null +++ b/data_dictionaries/macos/osquery/events/osquery_info.md @@ -0,0 +1,26 @@ +# Osquery_info Table + +## Description +Top level information about the running version of osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread/handle) ID|`TBD`| +|TBD|uuid|TEXT|Unique ID provided by the system|`TBD`| +|TBD|instance_id|TEXT|Unique, long-lived ID per instance of osquery|`TBD`| +|TBD|version|TEXT|osquery toolkit version|`TBD`| +|TBD|config_hash|TEXT|Hash of the working configuration state|`TBD`| +|TBD|config_valid|INTEGER|1 if the config was loaded and considered valid, else 0|`TBD`| +|TBD|extensions|TEXT|osquery extensions status|`TBD`| +|TBD|build_platform|TEXT|osquery toolkit build platform|`TBD`| +|TBD|build_distro|TEXT|osquery toolkit platform distribution name (os version)|`TBD`| +|TBD|start_time|INTEGER|UNIX time in seconds when the process started|`TBD`| +|TBD|watcher|INTEGER|Process (or thread/handle) ID of optional watcher process|`TBD`| +|TBD|platform_mask|INTEGER|The osquery platform bitmask|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/osquery_packs.md b/data_dictionaries/macos/osquery/events/osquery_packs.md new file mode 100644 index 000000000..ac1c811f3 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/osquery_packs.md @@ -0,0 +1,21 @@ +# Osquery_packs Table + +## Description +Information about the current query packs that are loaded in osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The given name for this query pack|`TBD`| +|TBD|platform|TEXT|Platforms this query is supported on|`TBD`| +|TBD|version|TEXT|Minimum osquery version that this query will run on|`TBD`| +|TBD|shard|INTEGER|Shard restriction limit, 1-100, 0 meaning no restriction|`TBD`| +|TBD|discovery_cache_hits|INTEGER|The number of times that the discovery query used cached values since the last time the config was reloaded|`TBD`| +|TBD|discovery_executions|INTEGER|The number of times that the discovery queries have been executed since the last time the config was reloaded|`TBD`| +|TBD|active|INTEGER|Whether this pack is active (the version, platform and discovery queries match) yes=1, no=0.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_packs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/osquery_registry.md b/data_dictionaries/macos/osquery/events/osquery_registry.md new file mode 100644 index 000000000..7d1432b37 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/osquery_registry.md @@ -0,0 +1,19 @@ +# Osquery_registry Table + +## Description +List the osquery registry plugins. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|registry|TEXT|Name of the osquery registry|`TBD`| +|TBD|name|TEXT|Name of the plugin item|`TBD`| +|TBD|owner_uuid|INTEGER|Extension route UUID (0 for core)|`TBD`| +|TBD|internal|INTEGER|1 If the plugin is internal else 0|`TBD`| +|TBD|active|INTEGER|1 If this plugin is active else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_registry) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/osquery_schedule.md b/data_dictionaries/macos/osquery/events/osquery_schedule.md new file mode 100644 index 000000000..f63371227 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/osquery_schedule.md @@ -0,0 +1,21 @@ +# Osquery_schedule Table + +## Description +Information about the current queries that are scheduled in osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The given name for this query|`TBD`| +|TBD|query|TEXT|The exact query to run|`TBD`| +|TBD|executions|BIGINT|Number of times the query was executed|`TBD`| +|TBD|blacklisted|INTEGER|1 if the query is blacklisted else 0|`TBD`| +|TBD|wall_time|BIGINT|Total wall time spent executing|`TBD`| +|TBD|user_time|BIGINT|Total user time spent executing|`TBD`| +|TBD|system_time|BIGINT|Total system time spent executing|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_schedule) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/package_bom.md b/data_dictionaries/macos/osquery/events/package_bom.md new file mode 100644 index 000000000..b4b8bf01f --- /dev/null +++ b/data_dictionaries/macos/osquery/events/package_bom.md @@ -0,0 +1,21 @@ +# Package_bom Table + +## Description +OS X package bill of materials (BOM) file list. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|filepath|TEXT|Package file or directory|`TBD`| +|TBD|uid|INTEGER|Expected user of file or directory|`TBD`| +|TBD|gid|INTEGER|Expected group of file or directory|`TBD`| +|TBD|mode|INTEGER|Expected permissions|`TBD`| +|TBD|size|BIGINT|Expected file size|`TBD`| +|TBD|modified_time|INTEGER|Timestamp the file was installed|`TBD`| +|TBD|path|TEXT|Path of package bom|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#package_bom) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/package_install_history.md b/data_dictionaries/macos/osquery/events/package_install_history.md new file mode 100644 index 000000000..a15cfcaed --- /dev/null +++ b/data_dictionaries/macos/osquery/events/package_install_history.md @@ -0,0 +1,20 @@ +# Package_install_history Table + +## Description +OS X package install history. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|package_id|TEXT|Label packageIdentifiers|`TBD`| +|TBD|time|INTEGER|Label date as UNIX timestamp|`TBD`| +|TBD|name|TEXT|Package display name|`TBD`| +|TBD|version|TEXT|Package display version|`TBD`| +|TBD|source|TEXT|Install source: usually the installer process name|`TBD`| +|TBD|content_type|TEXT|Package content_type (optional)|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#package_install_history) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/package_receipts.md b/data_dictionaries/macos/osquery/events/package_receipts.md new file mode 100644 index 000000000..0e1e18804 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/package_receipts.md @@ -0,0 +1,21 @@ +# Package_receipts Table + +## Description +OS X package receipt details. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|package_id|TEXT|Package domain identifier|`TBD`| +|TBD|package_filename|TEXT|Filename of original .pkg file|`TBD`| +|TBD|version|TEXT|Installed package version|`TBD`| +|TBD|location|TEXT|Optional relative install path on volume|`TBD`| +|TBD|install_time|DOUBLE|Timestamp of install time|`TBD`| +|TBD|installer_name|TEXT|Name of installer process|`TBD`| +|TBD|path|TEXT|Path of receipt plist|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#package_receipts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/pci_devices.md b/data_dictionaries/macos/osquery/events/pci_devices.md new file mode 100644 index 000000000..cb99a304a --- /dev/null +++ b/data_dictionaries/macos/osquery/events/pci_devices.md @@ -0,0 +1,32 @@ +# Pci_devices Table + +## Description +PCI devices active on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pci_slot|TEXT|PCI Device used slot|`TBD`| +|TBD|pci_class|TEXT|PCI Device class|`TBD`| +|TBD|driver|TEXT|PCI Device used driver|`TBD`| +|TBD|vendor|TEXT|PCI Device vendor|`TBD`| +|TBD|vendor_id|TEXT|Hex encoded PCI Device vendor identifier|`TBD`| +|TBD|model|TEXT|PCI Device model|`TBD`| +|TBD|model_id|TEXT|Hex encoded PCI Device model identifier|`TBD`| +|TBD|subsystem|TEXT|PCI Device subsystem|`TBD`| +|TBD|express|INTEGER|1 If PCI device is express else 0|`TBD`| +|TBD|thunderbolt|INTEGER|1 If PCI device is thunderbolt else 0|`TBD`| +|TBD|removable|INTEGER|1 If PCI device is removable else 0|`TBD`| +|TBD|pci_class_id|TEXT|PCI Device class ID in hex format [LINUX]|`TBD`| +|TBD|pci_subclass_id|TEXT|PCI Device subclass in hex format [LINUX]|`TBD`| +|TBD|pci_subclass|TEXT|PCI Device subclass [LINUX]|`TBD`| +|TBD|subsystem_vendor_id|TEXT|Vendor ID of PCI device subsystem [LINUX]|`TBD`| +|TBD|subsystem_vendor|TEXT|Vendor of PCI device subsystem [LINUX]|`TBD`| +|TBD|subsystem_model_id|TEXT|Model ID of PCI device subsystem [LINUX]|`TBD`| +|TBD|subsystem_model|TEXT|Device description of PCI device subsystem [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#pci_devices) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/platform_info.md b/data_dictionaries/macos/osquery/events/platform_info.md new file mode 100644 index 000000000..ee430f192 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/platform_info.md @@ -0,0 +1,22 @@ +# Platform_info Table + +## Description +Information about EFI/UEFI/ROM and platform/boot. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|vendor|TEXT|Platform code vendor|`TBD`| +|TBD|version|TEXT|Platform code version|`TBD`| +|TBD|date|TEXT|Self-reported platform code update date|`TBD`| +|TBD|revision|TEXT|BIOS major and minor revision|`TBD`| +|TBD|address|TEXT|Relative address of firmware mapping|`TBD`| +|TBD|size|TEXT|Size in bytes of firmware|`TBD`| +|TBD|volume_size|INTEGER|(Optional) size of firmware volume|`TBD`| +|TBD|extra|TEXT|Platform-specific additional information|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#platform_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/plist.md b/data_dictionaries/macos/osquery/events/plist.md new file mode 100644 index 000000000..6feb5f86b --- /dev/null +++ b/data_dictionaries/macos/osquery/events/plist.md @@ -0,0 +1,18 @@ +# Plist Table + +## Description +Read and parse a plist file. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|key|TEXT|Preference top-level key|`TBD`| +|TBD|subkey|TEXT|Intermediate key path, includes lists/dicts|`TBD`| +|TBD|value|TEXT|String value of most CF types|`TBD`| +|TBD|path|TEXT|(required) read preferences from a plist|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#plist) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/power_sensors.md b/data_dictionaries/macos/osquery/events/power_sensors.md new file mode 100644 index 000000000..865053981 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/power_sensors.md @@ -0,0 +1,18 @@ +# Power_sensors Table + +## Description +Machine power (currents, voltages, wattages, etc) sensors. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|key|TEXT|The SMC key on OS X|`TBD`| +|TBD|category|TEXT|The sensor category: currents, voltage, wattage|`TBD`| +|TBD|name|TEXT|Name of power source|`TBD`| +|TBD|value|TEXT|Power in Watts|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#power_sensors) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/preferences.md b/data_dictionaries/macos/osquery/events/preferences.md new file mode 100644 index 000000000..981bfc0c1 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/preferences.md @@ -0,0 +1,20 @@ +# Preferences Table + +## Description +OS X defaults and managed preferences. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|domain|TEXT|Application ID usually in com.name.product format|`TBD`| +|TBD|key|TEXT|Preference top-level key|`TBD`| +|TBD|subkey|TEXT|Intemediate key path, includes lists/dicts|`TBD`| +|TBD|value|TEXT|String value of most CF types|`TBD`| +|TBD|forced|INTEGER|1 if the value is forced/managed, else 0|`TBD`| +|TBD|username|TEXT|(optional) read preferences for a specific user|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#preferences) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/process_envs.md b/data_dictionaries/macos/osquery/events/process_envs.md new file mode 100644 index 000000000..2cdc24e28 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/process_envs.md @@ -0,0 +1,17 @@ +# Process_envs Table + +## Description +A key/value table of environment variables for each process. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|key|TEXT|Environment variable name|`TBD`| +|TBD|value|TEXT|Environment variable value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_envs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/process_events.md b/data_dictionaries/macos/osquery/events/process_events.md new file mode 100644 index 000000000..95a38e6aa --- /dev/null +++ b/data_dictionaries/macos/osquery/events/process_events.md @@ -0,0 +1,41 @@ +# Process_events Table + +## Description +Track time/action process executions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|path|TEXT|Path of executed file|`TBD`| +|TBD|mode|TEXT|File mode permissions|`TBD`| +|TBD|cmdline|TEXT|Command line arguments (argv)|`TBD`| +|TBD|cmdline_size|BIGINT|Actual size (bytes) of command line arguments|`TBD`| +|TBD|env|TEXT|Environment variables delimited by spaces|`TBD`| +|TBD|env_count|BIGINT|Number of environment variables|`TBD`| +|TBD|env_size|BIGINT|Actual size (bytes) of environment list|`TBD`| +|TBD|cwd|TEXT|The process current working directory|`TBD`| +|TBD|auid|BIGINT|Audit User ID at process start|`TBD`| +|TBD|uid|BIGINT|User ID at process start|`TBD`| +|TBD|euid|BIGINT|Effective user ID at process start|`TBD`| +|TBD|gid|BIGINT|Group ID at process start|`TBD`| +|TBD|egid|BIGINT|Effective group ID at process start|`TBD`| +|TBD|owner_uid|BIGINT|File owner user ID|`TBD`| +|TBD|owner_gid|BIGINT|File owner group ID|`TBD`| +|TBD|atime|BIGINT|File last access in UNIX time|`TBD`| +|TBD|mtime|BIGINT|File modification in UNIX time|`TBD`| +|TBD|ctime|BIGINT|File last metadata change in UNIX time|`TBD`| +|TBD|btime|BIGINT|File creation in UNIX time|`TBD`| +|TBD|overflows|TEXT|List of structures that overflowed|`TBD`| +|TBD|parent|BIGINT|Process parent's PID, or -1 if cannot be determined.|`TBD`| +|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`| +|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| +|TBD|status|BIGINT|OpenBSM Attribute: Status of the process [DARWIN]|`TBD`| +|TBD|syscall|TEXT|Syscall name: fork, vfork, clone, execve, execveat [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/process_memory_map.md b/data_dictionaries/macos/osquery/events/process_memory_map.md new file mode 100644 index 000000000..16fabc750 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/process_memory_map.md @@ -0,0 +1,23 @@ +# Process_memory_map Table + +## Description +Process memory mapped files and pseudo device/regions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|start|TEXT|Virtual start address (hex)|`TBD`| +|TBD|end|TEXT|Virtual end address (hex)|`TBD`| +|TBD|permissions|TEXT|r=read, w=write, x=execute, p=private (cow)|`TBD`| +|TBD|offset|BIGINT|Offset into mapped path|`TBD`| +|TBD|device|TEXT|MA:MI Major/minor device ID|`TBD`| +|TBD|inode|INTEGER|Mapped path inode, 0 means uninitialized (BSS)|`TBD`| +|TBD|path|TEXT|Path to mapped file or mapped type|`TBD`| +|TBD|pseudo|INTEGER|1 If path is a pseudo path, else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_memory_map) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/process_open_files.md b/data_dictionaries/macos/osquery/events/process_open_files.md new file mode 100644 index 000000000..7ccd4e03e --- /dev/null +++ b/data_dictionaries/macos/osquery/events/process_open_files.md @@ -0,0 +1,17 @@ +# Process_open_files Table + +## Description +File descriptors for each process. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|fd|BIGINT|Process-specific file descriptor number|`TBD`| +|TBD|path|TEXT|Filesystem path of descriptor|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_open_files) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/process_open_sockets.md b/data_dictionaries/macos/osquery/events/process_open_sockets.md new file mode 100644 index 000000000..25cedbac6 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/process_open_sockets.md @@ -0,0 +1,26 @@ +# Process_open_sockets Table + +## Description +Processes which have open network sockets on the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|fd|BIGINT|Socket file descriptor number|`TBD`| +|TBD|socket|BIGINT|Socket handle or inode number|`TBD`| +|TBD|family|INTEGER|Network protocol (IPv4, IPv6)|`TBD`| +|TBD|protocol|INTEGER|Transport protocol (TCP/UDP)|`TBD`| +|TBD|local_address|TEXT|Socket local address|`TBD`| +|TBD|remote_address|TEXT|Socket remote address|`TBD`| +|TBD|local_port|INTEGER|Socket local port|`TBD`| +|TBD|remote_port|INTEGER|Socket remote port|`TBD`| +|TBD|path|TEXT|For UNIX sockets (family=AF_UNIX), the domain path|`TBD`| +|TBD|state|TEXT|TCP socket state [lambda: LINUX() or DARWIN() or WINDOWS()]|`TBD`| +|TBD|net_namespace|TEXT|The inode number of the network namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_open_sockets) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/processes.md b/data_dictionaries/macos/osquery/events/processes.md new file mode 100644 index 000000000..b2f1687d7 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/processes.md @@ -0,0 +1,47 @@ +# Processes Table + +## Description +All running processes on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|name|TEXT|The process path or shorthand argv[0]|`TBD`| +|TBD|path|TEXT|Path to executed binary|`TBD`| +|TBD|cmdline|TEXT|Complete argv|`TBD`| +|TBD|state|TEXT|Process state|`TBD`| +|TBD|cwd|TEXT|Process current working directory|`TBD`| +|TBD|root|TEXT|Process virtual root directory|`TBD`| +|TBD|uid|BIGINT|Unsigned user ID|`TBD`| +|TBD|gid|BIGINT|Unsigned group ID|`TBD`| +|TBD|euid|BIGINT|Unsigned effective user ID|`TBD`| +|TBD|egid|BIGINT|Unsigned effective group ID|`TBD`| +|TBD|suid|BIGINT|Unsigned saved user ID|`TBD`| +|TBD|sgid|BIGINT|Unsigned saved group ID|`TBD`| +|TBD|wired_size|BIGINT|Bytes of unpagable memory used by process|`TBD`| +|TBD|resident_size|BIGINT|Bytes of private memory used by process|`TBD`| +|TBD|total_size|BIGINT|Total virtual memory size|`TBD`| +|TBD|user_time|BIGINT|CPU time in milliseconds spent in user space|`TBD`| +|TBD|system_time|BIGINT|CPU time in milliseconds spent in kernel space|`TBD`| +|TBD|disk_bytes_read|BIGINT|Bytes read from disk|`TBD`| +|TBD|disk_bytes_written|BIGINT|Bytes written to disk|`TBD`| +|TBD|start_time|BIGINT|Process start time in seconds since Epoch, in case of error -1|`TBD`| +|TBD|parent|BIGINT|Process parent's PID|`TBD`| +|TBD|pgroup|BIGINT|Process group|`TBD`| +|TBD|threads|INTEGER|Number of threads used by process|`TBD`| +|TBD|nice|INTEGER|Process nice level (-20 to 20, default 0)|`TBD`| +|TBD|is_elevated_token|INTEGER|Process uses elevated token yes=1, no=0 [WINDOWS]|`TBD`| +|TBD|elapsed_time|BIGINT|Elapsed time in seconds this process has been running. [WINDOWS]|`TBD`| +|TBD|handle_count|BIGINT|Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process. [WINDOWS]|`TBD`| +|TBD|percent_processor_time|BIGINT|Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks. [WINDOWS]|`TBD`| +|TBD|upid|BIGINT|A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|uppid|BIGINT|The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|cpu_type|INTEGER|A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|cpu_subtype|INTEGER|The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#processes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/prometheus_metrics.md b/data_dictionaries/macos/osquery/events/prometheus_metrics.md new file mode 100644 index 000000000..b709485b8 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/prometheus_metrics.md @@ -0,0 +1,18 @@ +# Prometheus_metrics Table + +## Description +Retrieve metrics from a Prometheus server. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|target_name|TEXT|Address of prometheus target|`TBD`| +|TBD|metric_name|TEXT|Name of collected Prometheus metric|`TBD`| +|TBD|metric_value|DOUBLE|Value of collected Prometheus metric|`TBD`| +|TBD|timestamp_ms|BIGINT|Unix timestamp of collected data in MS|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#prometheus_metrics) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/python_packages.md b/data_dictionaries/macos/osquery/events/python_packages.md new file mode 100644 index 000000000..af502ce5b --- /dev/null +++ b/data_dictionaries/macos/osquery/events/python_packages.md @@ -0,0 +1,21 @@ +# Python_packages Table + +## Description +Python packages installed in a system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package display name|`TBD`| +|TBD|version|TEXT|Package-supplied version|`TBD`| +|TBD|summary|TEXT|Package-supplied summary|`TBD`| +|TBD|author|TEXT|Optional package author|`TBD`| +|TBD|license|TEXT|License under which package is launched|`TBD`| +|TBD|path|TEXT|Path at which this module resides|`TBD`| +|TBD|directory|TEXT|Directory where Python modules are located|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#python_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/quicklook_cache.md b/data_dictionaries/macos/osquery/events/quicklook_cache.md new file mode 100644 index 000000000..c01959e50 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/quicklook_cache.md @@ -0,0 +1,25 @@ +# Quicklook_cache Table + +## Description +Files and thumbnails within OS X's Quicklook Cache. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Path of file|`TBD`| +|TBD|rowid|INTEGER|Quicklook file rowid key|`TBD`| +|TBD|fs_id|TEXT|Quicklook file fs_id key|`TBD`| +|TBD|volume_id|INTEGER|Parsed volume ID from fs_id|`TBD`| +|TBD|inode|INTEGER|Parsed file ID (inode) from fs_id|`TBD`| +|TBD|mtime|INTEGER|Parsed version date field|`TBD`| +|TBD|size|BIGINT|Parsed version size field|`TBD`| +|TBD|label|TEXT|Parsed version 'gen' field|`TBD`| +|TBD|hit_count|TEXT|Number of cache hits on thumbnail|`TBD`| +|TBD|icon_mode|BIGINT|Thumbnail icon mode|`TBD`| +|TBD|cache_path|TEXT|Path to cache data|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#quicklook_cache) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/routes.md b/data_dictionaries/macos/osquery/events/routes.md new file mode 100644 index 000000000..5197fbf35 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/routes.md @@ -0,0 +1,24 @@ +# Routes Table + +## Description +The active route table for the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|destination|TEXT|Destination IP address|`TBD`| +|TBD|netmask|INTEGER|Netmask length|`TBD`| +|TBD|gateway|TEXT|Route gateway|`TBD`| +|TBD|source|TEXT|Route source|`TBD`| +|TBD|flags|INTEGER|Flags to describe route|`TBD`| +|TBD|interface|TEXT|Route local interface|`TBD`| +|TBD|mtu|INTEGER|Maximum Transmission Unit for the route|`TBD`| +|TBD|metric|INTEGER|Cost of route. Lowest is preferred|`TBD`| +|TBD|type|TEXT|Type of route|`TBD`| +|TBD|hopcount|INTEGER|Max hops expected [POSIX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#routes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/running_apps.md b/data_dictionaries/macos/osquery/events/running_apps.md new file mode 100644 index 000000000..85edcd8f5 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/running_apps.md @@ -0,0 +1,17 @@ +# Running_apps Table + +## Description +macOS applications currently running on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|The pid of the application|`TBD`| +|TBD|bundle_identifier|TEXT|The bundle identifier of the application|`TBD`| +|TBD|is_active|INTEGER|1 if the application is in focus, 0 otherwise|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#running_apps) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/safari_extensions.md b/data_dictionaries/macos/osquery/events/safari_extensions.md new file mode 100644 index 000000000..80eba3e0c --- /dev/null +++ b/data_dictionaries/macos/osquery/events/safari_extensions.md @@ -0,0 +1,24 @@ +# Safari_extensions Table + +## Description +Safari browser extension details for all users. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the extension|`TBD`| +|TBD|name|TEXT|Extension display name|`TBD`| +|TBD|identifier|TEXT|Extension identifier|`TBD`| +|TBD|version|TEXT|Extension long version|`TBD`| +|TBD|sdk|TEXT|Bundle SDK used to compile extension|`TBD`| +|TBD|update_url|TEXT|Extension-supplied update URI|`TBD`| +|TBD|author|TEXT|Optional extension author|`TBD`| +|TBD|developer_id|TEXT|Optional developer identifier|`TBD`| +|TBD|description|TEXT|Optional extension description text|`TBD`| +|TBD|path|TEXT|Path to extension XAR bundle|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#safari_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/sandboxes.md b/data_dictionaries/macos/osquery/events/sandboxes.md new file mode 100644 index 000000000..d07097d85 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/sandboxes.md @@ -0,0 +1,20 @@ +# Sandboxes Table + +## Description +OS X application sandboxes container details. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|label|TEXT|UTI-format bundle or label ID|`TBD`| +|TBD|user|TEXT|Sandbox owner|`TBD`| +|TBD|enabled|INTEGER|Application sandboxings enabled on container|`TBD`| +|TBD|build_id|TEXT|Sandbox-specific identifier|`TBD`| +|TBD|bundle_path|TEXT|Application bundle used by the sandbox|`TBD`| +|TBD|path|TEXT|Path to sandbox container directory|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#sandboxes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/shared_folders.md b/data_dictionaries/macos/osquery/events/shared_folders.md new file mode 100644 index 000000000..c5d6bc55b --- /dev/null +++ b/data_dictionaries/macos/osquery/events/shared_folders.md @@ -0,0 +1,16 @@ +# Shared_folders Table + +## Description +Folders available to others via SMB or AFP. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The shared name of the folder as it appears to other users|`TBD`| +|TBD|path|TEXT|Absolute path of shared folder on the local system|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#shared_folders) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/sharing_preferences.md b/data_dictionaries/macos/osquery/events/sharing_preferences.md new file mode 100644 index 000000000..324395ab8 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/sharing_preferences.md @@ -0,0 +1,24 @@ +# Sharing_preferences Table + +## Description +OS X Sharing preferences. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|screen_sharing|INTEGER|1 If screen sharing is enabled else 0|`TBD`| +|TBD|file_sharing|INTEGER|1 If file sharing is enabled else 0|`TBD`| +|TBD|printer_sharing|INTEGER|1 If printer sharing is enabled else 0|`TBD`| +|TBD|remote_login|INTEGER|1 If remote login is enabled else 0|`TBD`| +|TBD|remote_management|INTEGER|1 If remote management is enabled else 0|`TBD`| +|TBD|remote_apple_events|INTEGER|1 If remote apple events are enabled else 0|`TBD`| +|TBD|internet_sharing|INTEGER|1 If internet sharing is enabled else 0|`TBD`| +|TBD|bluetooth_sharing|INTEGER|1 If bluetooth sharing is enabled for any user else 0|`TBD`| +|TBD|disc_sharing|INTEGER|1 If CD or DVD sharing is enabled else 0|`TBD`| +|TBD|content_caching|INTEGER|1 If content caching is enabled else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#sharing_preferences) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/shell_history.md b/data_dictionaries/macos/osquery/events/shell_history.md new file mode 100644 index 000000000..6a16aabea --- /dev/null +++ b/data_dictionaries/macos/osquery/events/shell_history.md @@ -0,0 +1,18 @@ +# Shell_history Table + +## Description +A line-delimited (command) table of per-user .*_history data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|Shell history owner|`TBD`| +|TBD|time|INTEGER|Entry timestamp. It could be absent, default value is 0.|`TBD`| +|TBD|command|TEXT|Unparsed date/line/command history line|`TBD`| +|TBD|history_file|TEXT|Path to the .*_history for this user|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#shell_history) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/signature.md b/data_dictionaries/macos/osquery/events/signature.md new file mode 100644 index 000000000..425f3493f --- /dev/null +++ b/data_dictionaries/macos/osquery/events/signature.md @@ -0,0 +1,21 @@ +# Signature Table + +## Description +File (executable, bundle, installer, disk) code signing status. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Must provide a path or directory|`TBD`| +|TBD|arch|TEXT|If applicable, the arch of the signed code|`TBD`| +|TBD|signed|INTEGER|1 If the file is signed else 0|`TBD`| +|TBD|identifier|TEXT|The signing identifier sealed into the signature|`TBD`| +|TBD|cdhash|TEXT|Hash of the application Code Directory|`TBD`| +|TBD|team_identifier|TEXT|The team signing identifier sealed into the signature|`TBD`| +|TBD|authority|TEXT|Certificate Common Name|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#signature) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/sip_config.md b/data_dictionaries/macos/osquery/events/sip_config.md new file mode 100644 index 000000000..0ae97653c --- /dev/null +++ b/data_dictionaries/macos/osquery/events/sip_config.md @@ -0,0 +1,17 @@ +# Sip_config Table + +## Description +Apple's System Integrity Protection (rootless) status. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|config_flag|TEXT|The System Integrity Protection config flag|`TBD`| +|TBD|enabled|INTEGER|1 if this configuration is enabled, otherwise 0|`TBD`| +|TBD|enabled_nvram|INTEGER|1 if this configuration is enabled, otherwise 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#sip_config) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/smart_drive_info.md b/data_dictionaries/macos/osquery/events/smart_drive_info.md new file mode 100644 index 000000000..7af5a1079 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/smart_drive_info.md @@ -0,0 +1,32 @@ +# Smart_drive_info Table + +## Description +Drive information read by SMART controller utilizing autodetect. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device_name|TEXT|Name of block device|`TBD`| +|TBD|model_family|TEXT|Drive model family|`TBD`| +|TBD|device_model|TEXT|Device Model|`TBD`| +|TBD|serial_number|TEXT|Device serial number|`TBD`| +|TBD|lu_wwn_device_id|TEXT|Device Identifier|`TBD`| +|TBD|firmware_version|TEXT|Drive firmware version|`TBD`| +|TBD|user_capacity|TEXT|Bytes of drive capacity|`TBD`| +|TBD|sector_sizes|TEXT|Bytes of drive sector sizes|`TBD`| +|TBD|rotation_rate|TEXT|Drive RPM|`TBD`| +|TBD|form_factor|TEXT|Form factor if reported|`TBD`| +|TBD|ata_version|TEXT|ATA version of drive|`TBD`| +|TBD|transport_type|TEXT|Drive transport type|`TBD`| +|TBD|sata_version|TEXT|SATA version, if any|`TBD`| +|TBD|smart_supported|TEXT|SMART support status|`TBD`| +|TBD|smart_enabled|TEXT|SMART enabled status|`TBD`| +|TBD|packet_device_type|TEXT|Packet device type|`TBD`| +|TBD|power_mode|TEXT|Device power mode|`TBD`| +|TBD|warnings|TEXT|Warning messages from SMART controller|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#smart_drive_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/smbios_tables.md b/data_dictionaries/macos/osquery/events/smbios_tables.md new file mode 100644 index 000000000..69b18ea4d --- /dev/null +++ b/data_dictionaries/macos/osquery/events/smbios_tables.md @@ -0,0 +1,21 @@ +# Smbios_tables Table + +## Description +BIOS (DMI) structure common details and content. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|number|INTEGER|Table entry number|`TBD`| +|TBD|type|INTEGER|Table entry type|`TBD`| +|TBD|description|TEXT|Table entry description|`TBD`| +|TBD|handle|INTEGER|Table entry handle|`TBD`| +|TBD|header_size|INTEGER|Header size in bytes|`TBD`| +|TBD|size|INTEGER|Table entry size in bytes|`TBD`| +|TBD|md5|TEXT|MD5 hash of table entry|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#smbios_tables) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/smc_keys.md b/data_dictionaries/macos/osquery/events/smc_keys.md new file mode 100644 index 000000000..d3d190788 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/smc_keys.md @@ -0,0 +1,19 @@ +# Smc_keys Table + +## Description +Apple's system management controller keys. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|key|TEXT|4-character key|`TBD`| +|TBD|type|TEXT|SMC-reported type literal type|`TBD`| +|TBD|size|INTEGER|Reported size of data in bytes|`TBD`| +|TBD|value|TEXT|A type-encoded representation of the key value|`TBD`| +|TBD|hidden|INTEGER|1 if this key is normally hidden, otherwise 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#smc_keys) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/ssh_configs.md b/data_dictionaries/macos/osquery/events/ssh_configs.md new file mode 100644 index 000000000..66ac48247 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/ssh_configs.md @@ -0,0 +1,17 @@ +# Ssh_configs Table + +## Description +A table of parsed ssh_configs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local owner of the ssh_config file|`TBD`| +|TBD|option|TEXT|The option and value|`TBD`| +|TBD|ssh_config_file|TEXT|Path to the ssh_config file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ssh_configs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/startup_items.md b/data_dictionaries/macos/osquery/events/startup_items.md new file mode 100644 index 000000000..e6d1ec5a4 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/startup_items.md @@ -0,0 +1,21 @@ +# Startup_items Table + +## Description +Applications and binaries set as user/login startup items. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Name of startup item|`TBD`| +|TBD|path|TEXT|Path of startup item|`TBD`| +|TBD|args|TEXT|Arguments provided to startup executable|`TBD`| +|TBD|type|TEXT|Startup Item or Login Item|`TBD`| +|TBD|source|TEXT|Directory or plist containing startup item|`TBD`| +|TBD|status|TEXT|Startup status; either enabled or disabled|`TBD`| +|TBD|username|TEXT|The user associated with the startup item|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#startup_items) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/sudoers.md b/data_dictionaries/macos/osquery/events/sudoers.md new file mode 100644 index 000000000..29e671554 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/sudoers.md @@ -0,0 +1,17 @@ +# Sudoers Table + +## Description +Rules for running commands as other users via sudo. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|source|TEXT|Source file containing the given rule|`TBD`| +|TBD|header|TEXT|Symbol for given rule|`TBD`| +|TBD|rule_details|TEXT|Rule definition|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#sudoers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/suid_bin.md b/data_dictionaries/macos/osquery/events/suid_bin.md new file mode 100644 index 000000000..f3ea944a8 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/suid_bin.md @@ -0,0 +1,18 @@ +# Suid_bin Table + +## Description +suid binaries in common locations. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Binary path|`TBD`| +|TBD|username|TEXT|Binary owner username|`TBD`| +|TBD|groupname|TEXT|Binary owner group|`TBD`| +|TBD|permissions|TEXT|Binary permissions|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#suid_bin) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/system_controls.md b/data_dictionaries/macos/osquery/events/system_controls.md new file mode 100644 index 000000000..e180727c0 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/system_controls.md @@ -0,0 +1,21 @@ +# System_controls Table + +## Description +sysctl names, values, and settings information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Full sysctl MIB name|`TBD`| +|TBD|oid|TEXT|Control MIB|`TBD`| +|TBD|subsystem|TEXT|Subsystem ID, control type|`TBD`| +|TBD|current_value|TEXT|Value of setting|`TBD`| +|TBD|config_value|TEXT|The MIB value set in /etc/sysctl.conf|`TBD`| +|TBD|type|TEXT|Data type|`TBD`| +|TBD|field_name|TEXT|Specific attribute of opaque type [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#system_controls) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/system_info.md b/data_dictionaries/macos/osquery/events/system_info.md new file mode 100644 index 000000000..482c3c621 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/system_info.md @@ -0,0 +1,29 @@ +# System_info Table + +## Description +System information for identification. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|hostname|TEXT|Network hostname including domain|`TBD`| +|TBD|uuid|TEXT|Unique ID provided by the system|`TBD`| +|TBD|cpu_type|TEXT|CPU type|`TBD`| +|TBD|cpu_subtype|TEXT|CPU subtype|`TBD`| +|TBD|cpu_brand|TEXT|CPU brand string, contains vendor and model|`TBD`| +|TBD|cpu_physical_cores|INTEGER|Number of physical CPU cores in to the system|`TBD`| +|TBD|cpu_logical_cores|INTEGER|Number of logical CPU cores available to the system|`TBD`| +|TBD|cpu_microcode|TEXT|Microcode version|`TBD`| +|TBD|physical_memory|BIGINT|Total physical memory in bytes|`TBD`| +|TBD|hardware_vendor|TEXT|Hardware or board vendor|`TBD`| +|TBD|hardware_model|TEXT|Hardware or board model|`TBD`| +|TBD|hardware_version|TEXT|Hardware or board version|`TBD`| +|TBD|hardware_serial|TEXT|Device or board serial number|`TBD`| +|TBD|computer_name|TEXT|Friendly computer name (optional)|`TBD`| +|TBD|local_hostname|TEXT|Local hostname (optional)|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#system_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/temperature_sensors.md b/data_dictionaries/macos/osquery/events/temperature_sensors.md new file mode 100644 index 000000000..ad5ea6174 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/temperature_sensors.md @@ -0,0 +1,18 @@ +# Temperature_sensors Table + +## Description +Machine's temperature sensors. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|key|TEXT|The SMC key on OS X|`TBD`| +|TBD|name|TEXT|Name of temperature source|`TBD`| +|TBD|celsius|DOUBLE|Temperature in Celsius|`TBD`| +|TBD|fahrenheit|DOUBLE|Temperature in Fahrenheit|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#temperature_sensors) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/time.md b/data_dictionaries/macos/osquery/events/time.md new file mode 100644 index 000000000..9f9b27746 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/time.md @@ -0,0 +1,28 @@ +# Time Table + +## Description +Track current date and time in the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|weekday|TEXT|Current weekday in the system|`TBD`| +|TBD|year|INTEGER|Current year in the system|`TBD`| +|TBD|month|INTEGER|Current month in the system|`TBD`| +|TBD|day|INTEGER|Current day in the system|`TBD`| +|TBD|hour|INTEGER|Current hour in the system|`TBD`| +|TBD|minutes|INTEGER|Current minutes in the system|`TBD`| +|TBD|seconds|INTEGER|Current seconds in the system|`TBD`| +|TBD|timezone|TEXT|Current timezone in the system|`TBD`| +|TBD|local_time|INTEGER|Current local UNIX time in the system|`TBD`| +|TBD|local_timezone|TEXT|Current local timezone in the system|`TBD`| +|TBD|timestamp|TEXT|Current timestamp (log format) in the system|`TBD`| +|TBD|datetime|TEXT|Current date and time (ISO format) in the system|`TBD`| +|TBD|iso_8601|TEXT|Current time (ISO format) in the system|`TBD`| +|TBD|win_timestamp|BIGINT|Timestamp value in 100 nanosecond units. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#time) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/time_machine_backups.md b/data_dictionaries/macos/osquery/events/time_machine_backups.md new file mode 100644 index 000000000..eeb6aa659 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/time_machine_backups.md @@ -0,0 +1,16 @@ +# Time_machine_backups Table + +## Description +Backups to drives using TimeMachine. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|destination_id|TEXT|Time Machine destination ID|`TBD`| +|TBD|backup_date|INTEGER|Backup Date|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#time_machine_backups) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/time_machine_destinations.md b/data_dictionaries/macos/osquery/events/time_machine_destinations.md new file mode 100644 index 000000000..b53f6dba0 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/time_machine_destinations.md @@ -0,0 +1,21 @@ +# Time_machine_destinations Table + +## Description +Locations backed up to using Time Machine. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|alias|TEXT|Human readable name of drive|`TBD`| +|TBD|destination_id|TEXT|Time Machine destination ID|`TBD`| +|TBD|consistency_scan_date|INTEGER|Consistency scan date|`TBD`| +|TBD|root_volume_uuid|TEXT|Root UUID of backup volume|`TBD`| +|TBD|bytes_available|INTEGER|Bytes available on volume|`TBD`| +|TBD|bytes_used|INTEGER|Bytes used on volume|`TBD`| +|TBD|encryption|TEXT|Last known encrypted state|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#time_machine_destinations) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/ulimit_info.md b/data_dictionaries/macos/osquery/events/ulimit_info.md new file mode 100644 index 000000000..84b753a00 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/ulimit_info.md @@ -0,0 +1,17 @@ +# Ulimit_info Table + +## Description +System resource usage limits. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|System resource to be limited|`TBD`| +|TBD|soft_limit|TEXT|Current limit value|`TBD`| +|TBD|hard_limit|TEXT|Maximum limit value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ulimit_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/uptime.md b/data_dictionaries/macos/osquery/events/uptime.md new file mode 100644 index 000000000..932b0c6f9 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/uptime.md @@ -0,0 +1,19 @@ +# Uptime Table + +## Description +Track time passed since last boot. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|days|INTEGER|Days of uptime|`TBD`| +|TBD|hours|INTEGER|Hours of uptime|`TBD`| +|TBD|minutes|INTEGER|Minutes of uptime|`TBD`| +|TBD|seconds|INTEGER|Seconds of uptime|`TBD`| +|TBD|total_seconds|BIGINT|Total uptime seconds|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#uptime) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/usb_devices.md b/data_dictionaries/macos/osquery/events/usb_devices.md new file mode 100644 index 000000000..dd6e513ff --- /dev/null +++ b/data_dictionaries/macos/osquery/events/usb_devices.md @@ -0,0 +1,26 @@ +# Usb_devices Table + +## Description +USB devices that are actively plugged into the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|usb_address|INTEGER|USB Device used address|`TBD`| +|TBD|usb_port|INTEGER|USB Device used port|`TBD`| +|TBD|vendor|TEXT|USB Device vendor string|`TBD`| +|TBD|vendor_id|TEXT|Hex encoded USB Device vendor identifier|`TBD`| +|TBD|version|TEXT|USB Device version number|`TBD`| +|TBD|model|TEXT|USB Device model string|`TBD`| +|TBD|model_id|TEXT|Hex encoded USB Device model identifier|`TBD`| +|TBD|serial|TEXT|USB Device serial connection|`TBD`| +|TBD|class|TEXT|USB Device class|`TBD`| +|TBD|subclass|TEXT|USB Device subclass|`TBD`| +|TBD|protocol|TEXT|USB Device protocol|`TBD`| +|TBD|removable|INTEGER|1 If USB device is removable else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#usb_devices) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/user_events.md b/data_dictionaries/macos/osquery/events/user_events.md new file mode 100644 index 000000000..7df9bde68 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/user_events.md @@ -0,0 +1,25 @@ +# User_events Table + +## Description +Track user events from the audit framework. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|auid|BIGINT|Audit User ID|`TBD`| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|message|TEXT|Message from the event|`TBD`| +|TBD|type|INTEGER|The file description for the process socket|`TBD`| +|TBD|path|TEXT|Supplied path from event|`TBD`| +|TBD|address|TEXT|The Internet protocol address or family ID|`TBD`| +|TBD|terminal|TEXT|The network protocol ID|`TBD`| +|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`| +|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/user_groups.md b/data_dictionaries/macos/osquery/events/user_groups.md new file mode 100644 index 000000000..1a21adc67 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/user_groups.md @@ -0,0 +1,16 @@ +# User_groups Table + +## Description +Local system user group relationships. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|gid|BIGINT|Group ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_groups) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/user_interaction_events.md b/data_dictionaries/macos/osquery/events/user_interaction_events.md new file mode 100644 index 000000000..4b7fd6910 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/user_interaction_events.md @@ -0,0 +1,15 @@ +# User_interaction_events Table + +## Description +Track user interaction events from macOS' event tapping framework. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|time|BIGINT|Time|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_interaction_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/user_ssh_keys.md b/data_dictionaries/macos/osquery/events/user_ssh_keys.md new file mode 100644 index 000000000..3629444fc --- /dev/null +++ b/data_dictionaries/macos/osquery/events/user_ssh_keys.md @@ -0,0 +1,17 @@ +# User_ssh_keys Table + +## Description +Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the key file|`TBD`| +|TBD|path|TEXT|Path to key file|`TBD`| +|TBD|encrypted|INTEGER|1 if key is encrypted, 0 otherwise|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_ssh_keys) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/users.md b/data_dictionaries/macos/osquery/events/users.md new file mode 100644 index 000000000..e67c033ca --- /dev/null +++ b/data_dictionaries/macos/osquery/events/users.md @@ -0,0 +1,25 @@ +# Users Table + +## Description +Local user accounts (including domain accounts that have logged on locally (Windows)). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|gid|BIGINT|Group ID (unsigned)|`TBD`| +|TBD|uid_signed|BIGINT|User ID as int64 signed (Apple)|`TBD`| +|TBD|gid_signed|BIGINT|Default group ID as int64 signed (Apple)|`TBD`| +|TBD|username|TEXT|Username|`TBD`| +|TBD|description|TEXT|Optional user description|`TBD`| +|TBD|directory|TEXT|User's home directory|`TBD`| +|TBD|shell|TEXT|User's configured default shell|`TBD`| +|TBD|uuid|TEXT|User's UUID (Apple) or SID (Windows)|`TBD`| +|TBD|type|TEXT|Whether the account is roaming (domain), local, or a system profile [WINDOWS]|`TBD`| +|TBD|is_hidden|INTEGER|IsHidden attribute set in OpenDirectory [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#users) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/virtual_memory_info.md b/data_dictionaries/macos/osquery/events/virtual_memory_info.md new file mode 100644 index 000000000..331ff9475 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/virtual_memory_info.md @@ -0,0 +1,36 @@ +# Virtual_memory_info Table + +## Description +Darwin Virtual Memory statistics. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|free|BIGINT|Total number of free pages.|`TBD`| +|TBD|active|BIGINT|Total number of active pages.|`TBD`| +|TBD|inactive|BIGINT|Total number of inactive pages.|`TBD`| +|TBD|speculative|BIGINT|Total number of speculative pages.|`TBD`| +|TBD|throttled|BIGINT|Total number of throttled pages.|`TBD`| +|TBD|wired|BIGINT|Total number of wired down pages.|`TBD`| +|TBD|purgeable|BIGINT|Total number of purgeable pages.|`TBD`| +|TBD|faults|BIGINT|Total number of calls to vm_faults.|`TBD`| +|TBD|copy|BIGINT|Total number of copy-on-write pages.|`TBD`| +|TBD|zero_fill|BIGINT|Total number of zero filled pages.|`TBD`| +|TBD|reactivated|BIGINT|Total number of reactivated pages.|`TBD`| +|TBD|purged|BIGINT|Total number of purged pages.|`TBD`| +|TBD|file_backed|BIGINT|Total number of file backed pages.|`TBD`| +|TBD|anonymous|BIGINT|Total number of anonymous pages.|`TBD`| +|TBD|uncompressed|BIGINT|Total number of uncompressed pages.|`TBD`| +|TBD|compressor|BIGINT|The number of pages used to store compressed VM pages.|`TBD`| +|TBD|decompressed|BIGINT|The total number of pages that have been decompressed by the VM compressor.|`TBD`| +|TBD|compressed|BIGINT|The total number of pages that have been compressed by the VM compressor.|`TBD`| +|TBD|page_ins|BIGINT|The total number of requests for pages from a pager.|`TBD`| +|TBD|page_outs|BIGINT|Total number of pages paged out.|`TBD`| +|TBD|swap_ins|BIGINT|The total number of compressed pages that have been swapped out to disk.|`TBD`| +|TBD|swap_outs|BIGINT|The total number of compressed pages that have been swapped back in from disk.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#virtual_memory_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/wifi_networks.md b/data_dictionaries/macos/osquery/events/wifi_networks.md new file mode 100644 index 000000000..30bfd6c29 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/wifi_networks.md @@ -0,0 +1,26 @@ +# Wifi_networks Table + +## Description +OS X known/remembered Wi-Fi networks list. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|ssid|TEXT|SSID octets of the network|`TBD`| +|TBD|network_name|TEXT|Name of the network|`TBD`| +|TBD|security_type|TEXT|Type of security on this network|`TBD`| +|TBD|last_connected|INTEGER|Last time this netword was connected to as a unix_time|`TBD`| +|TBD|passpoint|INTEGER|1 if Passpoint is supported, 0 otherwise|`TBD`| +|TBD|possibly_hidden|INTEGER|1 if network is possibly a hidden network, 0 otherwise|`TBD`| +|TBD|roaming|INTEGER|1 if roaming is supported, 0 otherwise|`TBD`| +|TBD|roaming_profile|TEXT|Describe the roaming profile, usually one of Single, Dual or Multi|`TBD`| +|TBD|captive_portal|INTEGER|1 if this network has a captive portal, 0 otherwise|`TBD`| +|TBD|auto_login|INTEGER|1 if auto login is enabled, 0 otherwise|`TBD`| +|TBD|temporarily_disabled|INTEGER|1 if this network is temporarily disabled, 0 otherwise|`TBD`| +|TBD|disabled|INTEGER|1 if this network is disabled, 0 otherwise|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#wifi_networks) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/wifi_scan.md b/data_dictionaries/macos/osquery/events/wifi_scan.md new file mode 100644 index 000000000..f606bc96d --- /dev/null +++ b/data_dictionaries/macos/osquery/events/wifi_scan.md @@ -0,0 +1,24 @@ +# Wifi_survey Table + +## Description +Scan for nearby WiFi networks. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Name of the interface|`TBD`| +|TBD|ssid|TEXT|SSID octets of the network|`TBD`| +|TBD|bssid|TEXT|The current basic service set identifier|`TBD`| +|TBD|network_name|TEXT|Name of the network|`TBD`| +|TBD|country_code|TEXT|The country code (ISO/IEC 3166-1:1997) for the network|`TBD`| +|TBD|rssi|INTEGER|The current received signal strength indication (dbm)|`TBD`| +|TBD|noise|INTEGER|The current noise measurement (dBm)|`TBD`| +|TBD|channel|INTEGER|Channel number|`TBD`| +|TBD|channel_width|INTEGER|Channel width|`TBD`| +|TBD|channel_band|INTEGER|Channel band|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#wifi_survey) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/wifi_status.md b/data_dictionaries/macos/osquery/events/wifi_status.md new file mode 100644 index 000000000..45652780a --- /dev/null +++ b/data_dictionaries/macos/osquery/events/wifi_status.md @@ -0,0 +1,27 @@ +# Wifi_status Table + +## Description +OS X current WiFi status. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Name of the interface|`TBD`| +|TBD|ssid|TEXT|SSID octets of the network|`TBD`| +|TBD|bssid|TEXT|The current basic service set identifier|`TBD`| +|TBD|network_name|TEXT|Name of the network|`TBD`| +|TBD|country_code|TEXT|The country code (ISO/IEC 3166-1:1997) for the network|`TBD`| +|TBD|security_type|TEXT|Type of security on this network|`TBD`| +|TBD|rssi|INTEGER|The current received signal strength indication (dbm)|`TBD`| +|TBD|noise|INTEGER|The current noise measurement (dBm)|`TBD`| +|TBD|channel|INTEGER|Channel number|`TBD`| +|TBD|channel_width|INTEGER|Channel width|`TBD`| +|TBD|channel_band|INTEGER|Channel band|`TBD`| +|TBD|transmit_rate|TEXT|The current transmit rate|`TBD`| +|TBD|mode|TEXT|The current operating mode for the Wi-Fi interface|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#wifi_status) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/xprotect_entries.md b/data_dictionaries/macos/osquery/events/xprotect_entries.md new file mode 100644 index 000000000..0e8ad2477 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/xprotect_entries.md @@ -0,0 +1,21 @@ +# Xprotect_entries Table + +## Description +Database of the machine's XProtect signatures. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Description of XProtected malware|`TBD`| +|TBD|launch_type|TEXT|Launch services content type|`TBD`| +|TBD|identity|TEXT|XProtect identity (SHA1) of content|`TBD`| +|TBD|filename|TEXT|Use this file name to match|`TBD`| +|TBD|filetype|TEXT|Use this file type to match|`TBD`| +|TBD|optional|INTEGER|Match any of the identities/patterns for this XProtect name|`TBD`| +|TBD|uses_pattern|INTEGER|Uses a match pattern instead of identity|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#xprotect_entries) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/xprotect_meta.md b/data_dictionaries/macos/osquery/events/xprotect_meta.md new file mode 100644 index 000000000..b91c258c5 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/xprotect_meta.md @@ -0,0 +1,18 @@ +# Xprotect_meta Table + +## Description +Database of the machine's XProtect browser-related signatures. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|identifier|TEXT|Browser plugin or extension identifier|`TBD`| +|TBD|type|TEXT|Either plugin or extension|`TBD`| +|TBD|developer_id|TEXT|Developer identity (SHA1) of extension|`TBD`| +|TBD|min_version|TEXT|The minimum allowed plugin version.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#xprotect_meta) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/xprotect_reports.md b/data_dictionaries/macos/osquery/events/xprotect_reports.md new file mode 100644 index 000000000..cc0506b68 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/xprotect_reports.md @@ -0,0 +1,17 @@ +# Xprotect_reports Table + +## Description +Database of XProtect matches (if user generated/sent an XProtect report). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Description of XProtected malware|`TBD`| +|TBD|user_action|TEXT|Action taken by user after prompted|`TBD`| +|TBD|time|TEXT|Quarantine alert time|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#xprotect_reports) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/yara.md b/data_dictionaries/macos/osquery/events/yara.md new file mode 100644 index 000000000..141f9ed96 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/yara.md @@ -0,0 +1,21 @@ +# Yara Table + +## Description +Track YARA matches for files or PIDs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|The path scanned|`TBD`| +|TBD|matches|TEXT|List of YARA matches|`TBD`| +|TBD|count|INTEGER|Number of YARA matches|`TBD`| +|TBD|sig_group|TEXT|Signature group used|`TBD`| +|TBD|sigfile|TEXT|Signature file used|`TBD`| +|TBD|strings|TEXT|Matching strings|`TBD`| +|TBD|tags|TEXT|Matching tags|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#yara) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/yara_events.md b/data_dictionaries/macos/osquery/events/yara_events.md new file mode 100644 index 000000000..67d243cbd --- /dev/null +++ b/data_dictionaries/macos/osquery/events/yara_events.md @@ -0,0 +1,24 @@ +# Yara_events Table + +## Description +Track YARA matches for files specified in configuration data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|target_path|TEXT|The path scanned|`TBD`| +|TBD|category|TEXT|The category of the file|`TBD`| +|TBD|action|TEXT|Change action (UPDATE, REMOVE, etc)|`TBD`| +|TBD|transaction_id|BIGINT|ID used during bulk update|`TBD`| +|TBD|matches|TEXT|List of YARA matches|`TBD`| +|TBD|count|INTEGER|Number of YARA matches|`TBD`| +|TBD|strings|TEXT|Matching strings|`TBD`| +|TBD|tags|TEXT|Matching tags|`TBD`| +|TBD|time|BIGINT|Time of the scan|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#yara_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/macos/osquery/events/yum_sources.md b/data_dictionaries/macos/osquery/events/yum_sources.md new file mode 100644 index 000000000..0c8265bf4 --- /dev/null +++ b/data_dictionaries/macos/osquery/events/yum_sources.md @@ -0,0 +1,19 @@ +# Yum_sources Table + +## Description +Current list of Yum repositories or software channels. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Repository name|`TBD`| +|TBD|baseurl|TEXT|Repository base URL|`TBD`| +|TBD|enabled|TEXT|Whether the repository is used|`TBD`| +|TBD|gpgcheck|TEXT|Whether packages are GPG checked|`TBD`| +|TBD|gpgkey|TEXT|URL to GPG key|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#yum_sources) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/README.md b/data_dictionaries/windows/osquery/README.md index 53cff8c28..2aa6b8497 100644 --- a/data_dictionaries/windows/osquery/README.md +++ b/data_dictionaries/windows/osquery/README.md @@ -6,12 +6,91 @@ Osquery schema is defined in tables by osquery engineers. ## Sub Data Sets |events|Description|Tags| |---|---|---| -|[file](events/file.md)|Interactive filesystem attributes and metadata.|| -|[hash](events/hash.md)|Filesystem hash data.|| -|[ie_extensions](events/ie_extensions.md)|Internet Explorer browser extensions.|| -|[pipes](events/pipes.md)|Named and Anonymous pipes.|| -|[services](events/services.md)|List all installed Windows services and their relevant data.|| +|[appcompat_shims](events/appcompat_shims.md)|Application Compatibility shims are a way to persist malware. This table presents the AppCompat Shim information from the registry in a nice format. See http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf for more details.|version_4.4.2| +|[arp_cache](events/arp_cache.md)|Address resolution cache, both static and dynamic (from ARP, NDP).|version_4.4.2| +|[authenticode](events/authenticode.md)|File (executable, bundle, installer, disk) code signing status.|version_4.4.2| +|[autoexec](events/autoexec.md)|Aggregate of executables that will automatically |version_4.4.2| +|[azure_instance_metadata](events/azure_instance_metadata.md)|Azure instance metadata.|version_4.4.2| +|[azure_instance_tags](events/azure_instance_tags.md)|Azure instance tags.|version_4.4.2| +|[bitlocker_info](events/bitlocker_info.md)|Retrieve bitlocker status of the machine.|version_4.4.2| +|[carbon_black_info](events/carbon_black_info.md)|Returns info about a Carbon Black sensor install.|version_4.4.2| +|[carves](events/carves.md)|Forensic Carves.|version_4.4.2| +|[certificates](events/certificates.md)|Certificate Authorities installed in Keychains/ca-bundles.|version_4.4.2| +|[chocolatey_packages](events/chocolatey_packages.md)|Chocolatey packages installed in a system.|version_4.4.2| +|[chrome_extensions](events/chrome_extensions.md)|Chrome browser extensions.|version_4.4.2| +|[connectivity](events/connectivity.md)|Provides the overall system's network state.|version_4.4.2| +|[cpu_info](events/cpu_info.md)|Retrieve cpu hardware info of the machine.|version_4.4.2| +|[cpuid](events/cpuid.md)|Useful CPU features from the cpuid ASM call.|version_4.4.2| +|[curl](events/curl.md)|Perform an http request and return stats about it.|version_4.4.2| +|[curl_certificate](events/curl_certificate.md)|Inspect TLS certificates by connecting to input hostnames.|version_4.4.2| +|[default_environment](events/default_environment.md)|Default environment variables and values.|version_4.4.2| +|[disk_info](events/disk_info.md)|Retrieve basic information about the physical disks of a system.|version_4.4.2| +|[drivers](events/drivers.md)|Details for in-use Windows device drivers. This does not display installed but unused drivers.|version_4.4.2| +|[etc_hosts](events/etc_hosts.md)|Line-parsed /etc/hosts.|version_4.4.2| +|[etc_protocols](events/etc_protocols.md)|Line-parsed /etc/protocols.|version_4.4.2| +|[etc_services](events/etc_services.md)|Line-parsed /etc/services.|version_4.4.2| +|[example](events/example.md)|This is an example table spec.|version_4.4.2| +|[file](events/file.md)|Interactive filesystem attributes and metadata.|version_4.4.2| +|[firefox_addons](events/firefox_addons.md)|Firefox browser extensions, webapps, and addons.|version_4.4.2| +|[groups](events/groups.md)|Local system groups.|version_4.4.2| +|[hash](events/hash.md)|Filesystem hash data.|version_4.4.2| +|[hvci_status](events/hvci_status.md)|Retrieve HVCI info of the machine.|version_4.4.2| +|[ie_extensions](events/ie_extensions.md)|Internet Explorer browser extensions.|version_4.4.2| +|[intel_me_info](events/intel_me_info.md)|Intel ME/CSE Info.|version_4.4.2| +|[interface_addresses](events/interface_addresses.md)|Network interfaces and relevant metadata.|version_4.4.2| +|[interface_details](events/interface_details.md)|Detailed information and stats of network interfaces.|version_4.4.2| +|[kernel_info](events/kernel_info.md)|Basic active kernel information.|version_4.4.2| +|[kva_speculative_info](events/kva_speculative_info.md)|Display kernel virtual address and speculative execution information for the system.|version_4.4.2| +|[listening_ports](events/listening_ports.md)|Processes with listening (bound) network sockets/ports.|version_4.4.2| +|[logged_in_users](events/logged_in_users.md)|Users with an active shell on the system.|version_4.4.2| +|[logical_drives](events/logical_drives.md)|Details for logical drives on the system. A logical drive generally represents a single partition.|version_4.4.2| +|[logon_sessions](events/logon_sessions.md)|Windows Logon Session.|version_4.4.2| +|[ntdomains](events/ntdomains.md)|Display basic NT domain information of a Windows machine.|version_4.4.2| +|[ntfs_acl_permissions](events/ntfs_acl_permissions.md)|Retrieve NTFS ACL permission information for files and directories.|version_4.4.2| +|[ntfs_journal_events](events/ntfs_journal_events.md)|Track time/action changes to files specified in configuration data.|version_4.4.2| +|[os_version](events/os_version.md)|A single row containing the operating system name and version.|version_4.4.2| +|[osquery_events](events/osquery_events.md)|Information about the event publishers and subscribers.|version_4.4.2| +|[osquery_extensions](events/osquery_extensions.md)|List of active osquery extensions.|version_4.4.2| +|[osquery_flags](events/osquery_flags.md)|Configurable flags that modify osquery's behavior.|version_4.4.2| +|[osquery_info](events/osquery_info.md)|Top level information about the running version of osquery.|version_4.4.2| +|[osquery_packs](events/osquery_packs.md)|Information about the current query packs that are loaded in osquery.|version_4.4.2| +|[osquery_registry](events/osquery_registry.md)|List the osquery registry plugins.|version_4.4.2| +|[osquery_schedule](events/osquery_schedule.md)|Information about the current queries that are scheduled in osquery.|version_4.4.2| +|[patches](events/patches.md)|Lists all the patches applied. Note: This does not include patches applied via MSI or downloaded from Windows Update (e.g. Service Packs).|version_4.4.2| +|[physical_disk_performance](events/physical_disk_performance.md)|Provides provides raw data from performance counters that monitor hard or fixed disk drives on the system.|version_4.4.2| +|[pipes](events/pipes.md)|Named and Anonymous pipes.|version_4.4.2| +|[platform_info](events/platform_info.md)|Information about EFI/UEFI/ROM and platform/boot.|version_4.4.2| +|[powershell_events](events/powershell_events.md)|Powershell script blocks reconstructed to their full script content, this table requires script block logging to be enabled.|version_4.4.2| +|[process_memory_map](events/process_memory_map.md)|Process memory mapped files and pseudo device/regions.|version_4.4.2| +|[process_open_sockets](events/process_open_sockets.md)|Processes which have open network sockets on the system.|version_4.4.2| +|[processes](events/processes.md)|All running processes on the host system.|version_4.4.2| +|[programs](events/programs.md)|Represents products as they are installed by Windows Installer. A product generally correlates to one installation package on Windows. Some fields may be blank as Windows installation details are left to the discretion of the product author.|version_4.4.2| +|[python_packages](events/python_packages.md)|Python packages installed in a system.|version_4.4.2| +|[registry](events/registry.md)|All of the Windows registry hives.|version_4.4.2| +|[routes](events/routes.md)|The active route table for the host system.|version_4.4.2| +|[scheduled_tasks](events/scheduled_tasks.md)|Lists all of the tasks in the Windows task scheduler.|version_4.4.2| +|[services](events/services.md)|Lists all installed Windows services and their relevant data.|version_4.4.2| +|[shared_resources](events/shared_resources.md)|Displays shared resources on a computer system running Windows. This may be a disk drive, printer, interprocess communication, or other sharable device.|version_4.4.2| +|[ssh_configs](events/ssh_configs.md)|A table of parsed ssh_configs.|version_4.4.2| +|[startup_items](events/startup_items.md)|Applications and binaries set as user/login startup items.|version_4.4.2| +|[system_info](events/system_info.md)|System information for identification.|version_4.4.2| +|[time](events/time.md)|Track current date and time in the system.|version_4.4.2| +|[uptime](events/uptime.md)|Track time passed since last boot.|version_4.4.2| +|[user_groups](events/user_groups.md)|Local system user group relationships.|version_4.4.2| +|[user_ssh_keys](events/user_ssh_keys.md)|Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.|version_4.4.2| +|[users](events/users.md)|Local user accounts (including domain accounts that have logged on locally (Windows)).|version_4.4.2| +|[video_info](events/video_info.md)|Retrieve video card information of the machine.|version_4.4.2| +|[winbaseobj](events/winbaseobj.md)|Lists named Windows objects in the default object directories, across all terminal services sessions.|version_4.4.2| +|[windows_crashes](events/windows_crashes.md)|Extracted information from Windows crash logs (Minidumps).|version_4.4.2| +|[windows_events](events/windows_events.md)|Windows Event logs.|version_4.4.2| +|[windows_optional_features](events/windows_optional_features.md)|Lists names and installation states of windows features. Maps to Win32_OptionalFeature WMI class.|version_4.4.2| +|[windows_security_products](events/windows_security_products.md)|Enumeration of registered Windows security products.|version_4.4.2| +|[wmi_bios_info](events/wmi_bios_info.md)|Lists important information from the system bios.|version_4.4.2| +|[wmi_cli_event_consumers](events/wmi_cli_event_consumers.md)|WMI CommandLineEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.|version_4.4.2| +|[wmi_event_filters](events/wmi_event_filters.md)|Lists WMI event filters.|version_4.4.2| +|[wmi_filter_consumer_binding](events/wmi_filter_consumer_binding.md)|Lists the relationship between event consumers and filters.|version_4.4.2| +|[wmi_script_event_consumers](events/wmi_script_event_consumers.md)|WMI ActiveScriptEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.|version_4.4.2| ## References -* [osquery schema 3.2.4 (website)](https://osquery.io/schema/3.2.4) +* [osquery schema 4.1.2 (website)](https://osquery.io/schema/4.1.2) * [osquery schema linux specs (GitHub)](https://github.com/facebook/osquery/tree/master/specs/windows) \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/appcompat_shims.md b/data_dictionaries/windows/osquery/events/appcompat_shims.md new file mode 100644 index 000000000..713f7138f --- /dev/null +++ b/data_dictionaries/windows/osquery/events/appcompat_shims.md @@ -0,0 +1,20 @@ +# Appcompat_shims Table + +## Description +Application Compatibility shims are a way to persist malware. This table presents the AppCompat Shim information from the registry in a nice format. See http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf for more details. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|executable|TEXT|Name of the executable that is being shimmed. This is pulled from the registry.|`TBD`| +|TBD|path|TEXT|This is the path to the SDB database.|`TBD`| +|TBD|description|TEXT|Description of the SDB.|`TBD`| +|TBD|install_time|INTEGER|Install time of the SDB|`TBD`| +|TBD|type|TEXT|Type of the SDB database.|`TBD`| +|TBD|sdb_id|TEXT|Unique GUID of the SDB.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#appcompat_shims) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/arp_cache.md b/data_dictionaries/windows/osquery/events/arp_cache.md new file mode 100644 index 000000000..3d2ae205d --- /dev/null +++ b/data_dictionaries/windows/osquery/events/arp_cache.md @@ -0,0 +1,18 @@ +# Arp_cache Table + +## Description +Address resolution cache, both static and dynamic (from ARP, NDP). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|address|TEXT|IPv4 address target|`TBD`| +|TBD|mac|TEXT|MAC address of broadcasted address|`TBD`| +|TBD|interface|TEXT|Interface of the network for the MAC|`TBD`| +|TBD|permanent|TEXT|1 for true, 0 for false|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#arp_cache) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/authenticode.md b/data_dictionaries/windows/osquery/events/authenticode.md new file mode 100644 index 000000000..56eda2ef6 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/authenticode.md @@ -0,0 +1,20 @@ +# Authenticode Table + +## Description +File (executable, bundle, installer, disk) code signing status. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Must provide a path or directory|`TBD`| +|TBD|original_program_name|TEXT|The original program name that the publisher has signed|`TBD`| +|TBD|serial_number|TEXT|The certificate serial number|`TBD`| +|TBD|issuer_name|TEXT|The certificate issuer name|`TBD`| +|TBD|subject_name|TEXT|The certificate subject name|`TBD`| +|TBD|result|TEXT|The signature check result|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#authenticode) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/autoexec.md b/data_dictionaries/windows/osquery/events/autoexec.md new file mode 100644 index 000000000..410f6a9d8 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/autoexec.md @@ -0,0 +1,17 @@ +# Autoexec Table + +## Description +Aggregate of executables that will automatically + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Path to the executable|`TBD`| +|TBD|name|TEXT|Name of the program|`TBD`| +|TBD|source|TEXT|Source table of the autoexec item|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#autoexec) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/azure_instance_metadata.md b/data_dictionaries/windows/osquery/events/azure_instance_metadata.md new file mode 100644 index 000000000..a5724217d --- /dev/null +++ b/data_dictionaries/windows/osquery/events/azure_instance_metadata.md @@ -0,0 +1,30 @@ +# Azure_instance_metadata Table + +## Description +Azure instance metadata. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|location|TEXT|Azure Region the VM is running in|`TBD`| +|TBD|name|TEXT|Name of the VM|`TBD`| +|TBD|offer|TEXT|Offer information for the VM image (Azure image gallery VMs only)|`TBD`| +|TBD|publisher|TEXT|Publisher of the VM image|`TBD`| +|TBD|sku|TEXT|SKU for the VM image|`TBD`| +|TBD|version|TEXT|Version of the VM image|`TBD`| +|TBD|os_type|TEXT|Linux or Windows|`TBD`| +|TBD|platform_update_domain|TEXT|Update domain the VM is running in|`TBD`| +|TBD|platform_fault_domain|TEXT|Fault domain the VM is running in|`TBD`| +|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`| +|TBD|vm_size|TEXT|VM size|`TBD`| +|TBD|subscription_id|TEXT|Azure subscription for the VM|`TBD`| +|TBD|resource_group_name|TEXT|Resource group for the VM|`TBD`| +|TBD|placement_group_id|TEXT|Placement group for the VM scale set|`TBD`| +|TBD|vm_scale_set_name|TEXT|VM scale set name|`TBD`| +|TBD|zone|TEXT|Availability zone of the VM|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_metadata) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/azure_instance_tags.md b/data_dictionaries/windows/osquery/events/azure_instance_tags.md new file mode 100644 index 000000000..1d237a229 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/azure_instance_tags.md @@ -0,0 +1,17 @@ +# Azure_instance_tags Table + +## Description +Azure instance tags. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`| +|TBD|key|TEXT|The tag key|`TBD`| +|TBD|value|TEXT|The tag value|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_tags) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/bitlocker_info.md b/data_dictionaries/windows/osquery/events/bitlocker_info.md new file mode 100644 index 000000000..69e579cca --- /dev/null +++ b/data_dictionaries/windows/osquery/events/bitlocker_info.md @@ -0,0 +1,23 @@ +# Bitlocker_info Table + +## Description +Retrieve bitlocker status of the machine. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device_id|TEXT|ID of the encrypted drive.|`TBD`| +|TBD|drive_letter|TEXT|Drive letter of the encrypted drive.|`TBD`| +|TBD|persistent_volume_id|TEXT|Persistent ID of the drive.|`TBD`| +|TBD|conversion_status|INTEGER|The bitlocker conversion status of the drive.|`TBD`| +|TBD|protection_status|INTEGER|The bitlocker protection status of the drive.|`TBD`| +|TBD|encryption_method|TEXT|The encryption type of the device.|`TBD`| +|TBD|version|INTEGER|The FVE metadata version of the drive.|`TBD`| +|TBD|percentage_encrypted|INTEGER|The percentage of the drive that is encrypted.|`TBD`| +|TBD|lock_status|INTEGER|The accessibility status of the drive from Windows.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#bitlocker_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/carbon_black_info.md b/data_dictionaries/windows/osquery/events/carbon_black_info.md new file mode 100644 index 000000000..42d8e8146 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/carbon_black_info.md @@ -0,0 +1,35 @@ +# Carbon_black_info Table + +## Description +Returns info about a Carbon Black sensor install. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|sensor_id|INTEGER|Sensor ID of the Carbon Black sensor|`TBD`| +|TBD|config_name|TEXT|Sensor group|`TBD`| +|TBD|collect_store_files|INTEGER|If the sensor is configured to send back binaries to the Carbon Black server|`TBD`| +|TBD|collect_module_loads|INTEGER|If the sensor is configured to capture module loads|`TBD`| +|TBD|collect_module_info|INTEGER|If the sensor is configured to collect metadata of binaries|`TBD`| +|TBD|collect_file_mods|INTEGER|If the sensor is configured to collect file modification events|`TBD`| +|TBD|collect_reg_mods|INTEGER|If the sensor is configured to collect registry modification events|`TBD`| +|TBD|collect_net_conns|INTEGER|If the sensor is configured to collect network connections|`TBD`| +|TBD|collect_processes|INTEGER|If the sensor is configured to process events|`TBD`| +|TBD|collect_cross_processes|INTEGER|If the sensor is configured to cross process events|`TBD`| +|TBD|collect_emet_events|INTEGER|If the sensor is configured to EMET events|`TBD`| +|TBD|collect_data_file_writes|INTEGER|If the sensor is configured to collect non binary file writes|`TBD`| +|TBD|collect_process_user_context|INTEGER|If the sensor is configured to collect the user running a process|`TBD`| +|TBD|collect_sensor_operations|INTEGER|Unknown|`TBD`| +|TBD|log_file_disk_quota_mb|INTEGER|Event file disk quota in MB|`TBD`| +|TBD|log_file_disk_quota_percentage|INTEGER|Event file disk quota in a percentage|`TBD`| +|TBD|protection_disabled|INTEGER|If the sensor is configured to report tamper events|`TBD`| +|TBD|sensor_ip_addr|TEXT|IP address of the sensor|`TBD`| +|TBD|sensor_backend_server|TEXT|Carbon Black server|`TBD`| +|TBD|event_queue|INTEGER|Size in bytes of Carbon Black event files on disk|`TBD`| +|TBD|binary_queue|INTEGER|Size in bytes of binaries waiting to be sent to Carbon Black server|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#carbon_black_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/carves.md b/data_dictionaries/windows/osquery/events/carves.md new file mode 100644 index 000000000..aaffca4bd --- /dev/null +++ b/data_dictionaries/windows/osquery/events/carves.md @@ -0,0 +1,21 @@ +# Carves Table + +## Description +Forensic Carves. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|time|BIGINT|Time at which the carve was kicked off|`TBD`| +|TBD|sha256|TEXT|A SHA256 sum of the carved archive|`TBD`| +|TBD|size|INTEGER|Size of the carved archive|`TBD`| +|TBD|path|TEXT|The path of the requested carve|`TBD`| +|TBD|status|TEXT|Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED|`TBD`| +|TBD|carve_guid|TEXT|Identifying value of the carve session|`TBD`| +|TBD|carve|INTEGER|Set this value to '1' to start a file carve|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#carves) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/certificates.md b/data_dictionaries/windows/osquery/events/certificates.md new file mode 100644 index 000000000..d6a4b6eea --- /dev/null +++ b/data_dictionaries/windows/osquery/events/certificates.md @@ -0,0 +1,35 @@ +# Certificates Table + +## Description +Certificate Authorities installed in Keychains/ca-bundles. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|common_name|TEXT|Certificate CommonName|`TBD`| +|TBD|subject|TEXT|Certificate distinguished name|`TBD`| +|TBD|issuer|TEXT|Certificate issuer distinguished name|`TBD`| +|TBD|ca|INTEGER|1 if CA: true (certificate is an authority) else 0|`TBD`| +|TBD|self_signed|INTEGER|1 if self-signed, else 0|`TBD`| +|TBD|not_valid_before|DATETIME|Lower bound of valid date|`TBD`| +|TBD|not_valid_after|DATETIME|Certificate expiration data|`TBD`| +|TBD|signing_algorithm|TEXT|Signing algorithm used|`TBD`| +|TBD|key_algorithm|TEXT|Key algorithm used|`TBD`| +|TBD|key_strength|TEXT|Key size used for RSA/DSA, or curve name|`TBD`| +|TBD|key_usage|TEXT|Certificate key usage and extended key usage|`TBD`| +|TBD|subject_key_id|TEXT|SKID an optionally included SHA1|`TBD`| +|TBD|authority_key_id|TEXT|AKID an optionally included SHA1|`TBD`| +|TBD|sha1|TEXT|SHA1 hash of the raw certificate contents|`TBD`| +|TBD|path|TEXT|Path to Keychain or PEM bundle|`TBD`| +|TBD|serial|TEXT|Certificate serial number|`TBD`| +|TBD|sid|TEXT|SID [WINDOWS]|`TBD`| +|TBD|store_location|TEXT|Certificate system store location [WINDOWS]|`TBD`| +|TBD|store|TEXT|Certificate system store [WINDOWS]|`TBD`| +|TBD|username|TEXT|Username [WINDOWS]|`TBD`| +|TBD|store_id|TEXT|Exists for service/user stores. Contains raw store id provided by WinAPI. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#certificates) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/chocolatey_packages.md b/data_dictionaries/windows/osquery/events/chocolatey_packages.md new file mode 100644 index 000000000..0d8bf2305 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/chocolatey_packages.md @@ -0,0 +1,20 @@ +# Chocolatey_packages Table + +## Description +Chocolatey packages installed in a system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package display name|`TBD`| +|TBD|version|TEXT|Package-supplied version|`TBD`| +|TBD|summary|TEXT|Package-supplied summary|`TBD`| +|TBD|author|TEXT|Optional package author|`TBD`| +|TBD|license|TEXT|License under which package is launched|`TBD`| +|TBD|path|TEXT|Path at which this package resides|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#chocolatey_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/chrome_extensions.md b/data_dictionaries/windows/osquery/events/chrome_extensions.md new file mode 100644 index 000000000..1446387d9 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/chrome_extensions.md @@ -0,0 +1,26 @@ +# Chrome_extensions Table + +## Description +Chrome browser extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the extension|`TBD`| +|TBD|name|TEXT|Extension display name|`TBD`| +|TBD|profile|TEXT|The Chrome profile that contains this extension|`TBD`| +|TBD|identifier|TEXT|Extension identifier|`TBD`| +|TBD|version|TEXT|Extension-supplied version|`TBD`| +|TBD|description|TEXT|Extension-optional description|`TBD`| +|TBD|locale|TEXT|Default locale supported by extension|`TBD`| +|TBD|update_url|TEXT|Extension-supplied update URI|`TBD`| +|TBD|author|TEXT|Optional extension author|`TBD`| +|TBD|path|TEXT|Path to extension folder|`TBD`| +|TBD|permissions|TEXT|The permissions required by the extension|`TBD`| +|TBD|optional_permissions|TEXT|The permissions optionally required by the extensions|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#chrome_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/connectivity.md b/data_dictionaries/windows/osquery/events/connectivity.md new file mode 100644 index 000000000..584ffd7cb --- /dev/null +++ b/data_dictionaries/windows/osquery/events/connectivity.md @@ -0,0 +1,23 @@ +# Connectivity Table + +## Description +Provides the overall system's network state. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|disconnected|INTEGER|True if the all interfaces are not connected to any network|`TBD`| +|TBD|ipv4_no_traffic|INTEGER|True if any interface is connected via IPv4, but has seen no traffic|`TBD`| +|TBD|ipv6_no_traffic|INTEGER|True if any interface is connected via IPv6, but has seen no traffic|`TBD`| +|TBD|ipv4_subnet|INTEGER|True if any interface is connected to the local subnet via IPv4|`TBD`| +|TBD|ipv4_local_network|INTEGER|True if any interface is connected to a routed network via IPv4|`TBD`| +|TBD|ipv4_internet|INTEGER|True if any interface is connected to the Internet via IPv4|`TBD`| +|TBD|ipv6_subnet|INTEGER|True if any interface is connected to the local subnet via IPv6|`TBD`| +|TBD|ipv6_local_network|INTEGER|True if any interface is connected to a routed network via IPv6|`TBD`| +|TBD|ipv6_internet|INTEGER|True if any interface is connected to the Internet via IPv6|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#connectivity) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/cpu_info.md b/data_dictionaries/windows/osquery/events/cpu_info.md new file mode 100644 index 000000000..eda267a00 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/cpu_info.md @@ -0,0 +1,26 @@ +# Cpu_info Table + +## Description +Retrieve cpu hardware info of the machine. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device_id|TEXT|The DeviceID of the CPU.|`TBD`| +|TBD|model|TEXT|The model of the CPU.|`TBD`| +|TBD|manufacturer|TEXT|The manufacturer of the CPU.|`TBD`| +|TBD|processor_type|TEXT|The processor type, such as Central, Math, or Video.|`TBD`| +|TBD|availability|TEXT|The availability and status of the CPU.|`TBD`| +|TBD|cpu_status|INTEGER|The current operating status of the CPU.|`TBD`| +|TBD|number_of_cores|TEXT|The number of cores of the CPU.|`TBD`| +|TBD|logical_processors|INTEGER|The number of logical processors of the CPU.|`TBD`| +|TBD|address_width|TEXT|The width of the CPU address bus.|`TBD`| +|TBD|current_clock_speed|INTEGER|The current frequency of the CPU.|`TBD`| +|TBD|max_clock_speed|INTEGER|The maximum possible frequency of the CPU.|`TBD`| +|TBD|socket_designation|TEXT|The assigned socket on the board for the given CPU.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#cpu_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/cpuid.md b/data_dictionaries/windows/osquery/events/cpuid.md new file mode 100644 index 000000000..b8e27a7f5 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/cpuid.md @@ -0,0 +1,19 @@ +# Cpuid Table + +## Description +Useful CPU features from the cpuid ASM call. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|feature|TEXT|Present feature flags|`TBD`| +|TBD|value|TEXT|Bit value or string|`TBD`| +|TBD|output_register|TEXT|Register used to for feature value|`TBD`| +|TBD|output_bit|INTEGER|Bit in register value for feature value|`TBD`| +|TBD|input_eax|TEXT|Value of EAX used|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#cpuid) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/curl.md b/data_dictionaries/windows/osquery/events/curl.md new file mode 100644 index 000000000..22c52b63e --- /dev/null +++ b/data_dictionaries/windows/osquery/events/curl.md @@ -0,0 +1,21 @@ +# Curl Table + +## Description +Perform an http request and return stats about it. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|url|TEXT|The url for the request|`TBD`| +|TBD|method|TEXT|The HTTP method for the request|`TBD`| +|TBD|user_agent|TEXT|The user-agent string to use for the request|`TBD`| +|TBD|response_code|INTEGER|The HTTP status code for the response|`TBD`| +|TBD|round_trip_time|BIGINT|Time taken to complete the request|`TBD`| +|TBD|bytes|BIGINT|Number of bytes in the response|`TBD`| +|TBD|result|TEXT|The HTTP response body|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#curl) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/curl_certificate.md b/data_dictionaries/windows/osquery/events/curl_certificate.md new file mode 100644 index 000000000..19f77ef6d --- /dev/null +++ b/data_dictionaries/windows/osquery/events/curl_certificate.md @@ -0,0 +1,26 @@ +# Curl_certificate Table + +## Description +Inspect TLS certificates by connecting to input hostnames. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|hostname|TEXT|Hostname (domain[:port]) to CURL|`TBD`| +|TBD|common_name|TEXT|Common name of company issued to|`TBD`| +|TBD|organization|TEXT|Organization issued to|`TBD`| +|TBD|organization_unit|TEXT|Organization unit issued to|`TBD`| +|TBD|serial_number|TEXT|Certificate serial number|`TBD`| +|TBD|issuer_common_name|TEXT|Issuer common name|`TBD`| +|TBD|issuer_organization|TEXT|Issuer organization|`TBD`| +|TBD|issuer_organization_unit|TEXT|Issuer organization unit|`TBD`| +|TBD|valid_from|TEXT|Period of validity start date|`TBD`| +|TBD|valid_to|TEXT|Period of validity end date|`TBD`| +|TBD|sha256_fingerprint|TEXT|SHA-256 fingerprint|`TBD`| +|TBD|sha1_fingerprint|TEXT|SHA1 fingerprint|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#curl_certificate) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/default_environment.md b/data_dictionaries/windows/osquery/events/default_environment.md new file mode 100644 index 000000000..e9aaa275c --- /dev/null +++ b/data_dictionaries/windows/osquery/events/default_environment.md @@ -0,0 +1,17 @@ +# Default_environment Table + +## Description +Default environment variables and values. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|variable|TEXT|Name of the environment variable|`TBD`| +|TBD|value|TEXT|Value of the environment variable|`TBD`| +|TBD|expand|INTEGER|1 if the variable needs expanding, 0 otherwise|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#default_environment) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/disk_info.md b/data_dictionaries/windows/osquery/events/disk_info.md new file mode 100644 index 000000000..c70184c0b --- /dev/null +++ b/data_dictionaries/windows/osquery/events/disk_info.md @@ -0,0 +1,25 @@ +# Disk_info Table + +## Description +Retrieve basic information about the physical disks of a system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|partitions|INTEGER|Number of detected partitions on disk.|`TBD`| +|TBD|disk_index|INTEGER|Physical drive number of the disk.|`TBD`| +|TBD|type|TEXT|The interface type of the disk.|`TBD`| +|TBD|id|TEXT|The unique identifier of the drive on the system.|`TBD`| +|TBD|pnp_device_id|TEXT|The unique identifier of the drive on the system.|`TBD`| +|TBD|disk_size|BIGINT|Size of the disk.|`TBD`| +|TBD|manufacturer|TEXT|The manufacturer of the disk.|`TBD`| +|TBD|hardware_model|TEXT|Hard drive model.|`TBD`| +|TBD|name|TEXT|The label of the disk object.|`TBD`| +|TBD|serial|TEXT|The serial number of the disk.|`TBD`| +|TBD|description|TEXT|The OS's description of the disk.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#disk_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/drivers.md b/data_dictionaries/windows/osquery/events/drivers.md new file mode 100644 index 000000000..675fb6ce9 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/drivers.md @@ -0,0 +1,28 @@ +# Drivers Table + +## Description +Details for in-use Windows device drivers. This does not display installed but unused drivers. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device_id|TEXT|Device ID|`TBD`| +|TBD|device_name|TEXT|Device name|`TBD`| +|TBD|image|TEXT|Path to driver image file|`TBD`| +|TBD|description|TEXT|Driver description|`TBD`| +|TBD|service|TEXT|Driver service name, if one exists|`TBD`| +|TBD|service_key|TEXT|Driver service registry key|`TBD`| +|TBD|version|TEXT|Driver version|`TBD`| +|TBD|inf|TEXT|Associated inf file|`TBD`| +|TBD|class|TEXT|Device/driver class name|`TBD`| +|TBD|provider|TEXT|Driver provider|`TBD`| +|TBD|manufacturer|TEXT|Device manufacturer|`TBD`| +|TBD|driver_key|TEXT|Driver key|`TBD`| +|TBD|date|BIGINT|Driver date|`TBD`| +|TBD|signed|INTEGER|Whether the driver is signed or not|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#drivers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/etc_hosts.md b/data_dictionaries/windows/osquery/events/etc_hosts.md new file mode 100644 index 000000000..e9d7d7b46 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/etc_hosts.md @@ -0,0 +1,16 @@ +# Etc_hosts Table + +## Description +Line-parsed /etc/hosts. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|address|TEXT|IP address mapping|`TBD`| +|TBD|hostnames|TEXT|Raw hosts mapping|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_hosts) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/etc_protocols.md b/data_dictionaries/windows/osquery/events/etc_protocols.md new file mode 100644 index 000000000..2f64147da --- /dev/null +++ b/data_dictionaries/windows/osquery/events/etc_protocols.md @@ -0,0 +1,18 @@ +# Etc_protocols Table + +## Description +Line-parsed /etc/protocols. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Protocol name|`TBD`| +|TBD|number|INTEGER|Protocol number|`TBD`| +|TBD|alias|TEXT|Protocol alias|`TBD`| +|TBD|comment|TEXT|Comment with protocol description|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_protocols) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/etc_services.md b/data_dictionaries/windows/osquery/events/etc_services.md new file mode 100644 index 000000000..07d2dc4d7 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/etc_services.md @@ -0,0 +1,19 @@ +# Etc_services Table + +## Description +Line-parsed /etc/services. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Service name|`TBD`| +|TBD|port|INTEGER|Service port number|`TBD`| +|TBD|protocol|TEXT|Transport protocol (TCP/UDP)|`TBD`| +|TBD|aliases|TEXT|Optional space separated list of other names for a service|`TBD`| +|TBD|comment|TEXT|Optional comment for a service.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#etc_services) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/example.md b/data_dictionaries/windows/osquery/events/example.md new file mode 100644 index 000000000..4c7554cd9 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/example.md @@ -0,0 +1,20 @@ +# Example Table + +## Description +This is an example table spec. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Description for name column|`TBD`| +|TBD|points|INTEGER|This is a signed SQLite int column|`TBD`| +|TBD|size|BIGINT|This is a signed SQLite bigint column|`TBD`| +|TBD|action|TEXT|Action performed in generation|`TBD`| +|TBD|id|INTEGER|An index of some sort|`TBD`| +|TBD|path|TEXT|Path of example|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#example) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/file.md b/data_dictionaries/windows/osquery/events/file.md index 6ea37fb94..e096193e4 100644 --- a/data_dictionaries/windows/osquery/events/file.md +++ b/data_dictionaries/windows/osquery/events/file.md @@ -6,23 +6,29 @@ Interactive filesystem attributes and metadata. ## Data Dictionary |Standard Name|Field Name|Type|Description|Sample Value| |---|---|---|---|---| -|file_path|path|TEXT|Absolute file path|``| -|file_directory|directory|TEXT|Directory of file(s)|``| -|file_name|filename|TEXT|Name portion of file path|``| -|file_inode|inode|BIGINT|Filesystem inode number|``| -|user_uid|uid|BIGINT|Owning user ID|``| -|user_gid|gid|BIGINT|Owning group ID|``| -|user_permissions|mode|TEXT|Permission bits|``| -|device_id|device|BIGINT|Device ID (optional)|``| -|file_size|size|BIGINT|Size of file in bytes|``| -|file_block_size|block_size|INTEGER|Block size of filesystem|``| -|date_last_access|atime|BIGINT|Last access time|``| -|date_last_modification|mtime|BIGINT|Last modification time|``| -|date_last_status_change|ctime|BIGINT|Last status change time|``| -|date_creation_time|btime|BIGINT|(B)irth or (cr)eate time|``| -|file_hard_links|hard_links|INTEGER|Number of hard links|``| -|file_symlink|symlink|INTEGER|1 if the path is a symlink, otherwise 0|``| -|file_type|type|TEXT|File status|``| +|file_path|path|TEXT|Absolute file path|`file_directory`| +|TBD|directory|TEXT|Directory of file(s)|`TBD`| +|file_name|filename|TEXT|Name portion of file path|`TBD`| +|file_inode|inode|BIGINT|Filesystem inode number|`TBD`| +|user_uid|uid|BIGINT|Owning user ID|`TBD`| +|user_gid|gid|BIGINT|Owning group ID|`TBD`| +|user_permissions|mode|TEXT|Permission bits|`TBD`| +|device_id|device|BIGINT|Device ID (optional)|`TBD`| +|file_size|size|BIGINT|Size of file in bytes|`TBD`| +|file_system_block_size|block_size|INTEGER|Block size of filesystem|`TBD`| +|date_last_access|atime|BIGINT|Last access time|`TBD`| +|date_last_modification|mtime|BIGINT|Last modification time|`TBD`| +|date_last_status_change|ctime|BIGINT|Last status change time|`TBD`| +|date_creation_time|btime|BIGINT|(B)irth or (cr)eate time|`TBD`| +|file_hard_links|hard_links|INTEGER|Number of hard links|`TBD`| +|file_symlink|symlink|INTEGER|1 if the path is a symlink, otherwise 0|`TBD`| +|file_type|type|TEXT|File status|`TBD`| +|TBD|attributes|TEXT|File attrib string. See: https://ss64.com/nt/attrib.html [WINDOWS]|`TBD`| +|TBD|volume_serial|TEXT|Volume serial number [WINDOWS]|`TBD`| +|TBD|file_id|TEXT|file ID [WINDOWS]|`TBD`| ## References -* [osquery GitHub](https://github.com/facebook/osquery/blob/master/specs/utility/file.table) +* [OSQuery table documentation](https://osquery.io/schema/current#file) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/firefox_addons.md b/data_dictionaries/windows/osquery/events/firefox_addons.md new file mode 100644 index 000000000..e84713206 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/firefox_addons.md @@ -0,0 +1,26 @@ +# Firefox_addons Table + +## Description +Firefox browser extensions, webapps, and addons. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the addon|`TBD`| +|TBD|name|TEXT|Addon display name|`TBD`| +|TBD|identifier|TEXT|Addon identifier|`TBD`| +|TBD|creator|TEXT|Addon-supported creator string|`TBD`| +|TBD|type|TEXT|Extension, addon, webapp|`TBD`| +|TBD|version|TEXT|Addon-supplied version string|`TBD`| +|TBD|description|TEXT|Addon-supplied description string|`TBD`| +|TBD|source_url|TEXT|URL that installed the addon|`TBD`| +|TBD|visible|INTEGER|1 If the addon is shown in browser else 0|`TBD`| +|TBD|active|INTEGER|1 If the addon is active else 0|`TBD`| +|TBD|location|TEXT|Global, profile location|`TBD`| +|TBD|path|TEXT|Path to plugin bundle|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#firefox_addons) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/groups.md b/data_dictionaries/windows/osquery/events/groups.md new file mode 100644 index 000000000..7f3d58f79 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/groups.md @@ -0,0 +1,20 @@ +# Groups Table + +## Description +Local system groups. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|gid|BIGINT|Unsigned int64 group ID|`TBD`| +|TBD|gid_signed|BIGINT|A signed int64 version of gid|`TBD`| +|TBD|groupname|TEXT|Canonical local group name|`TBD`| +|TBD|group_sid|TEXT|Unique group ID [WINDOWS]|`TBD`| +|TBD|comment|TEXT|Remarks or comments associated with the group [WINDOWS]|`TBD`| +|TBD|is_hidden|INTEGER|IsHidden attribute set in OpenDirectory [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#groups) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/hash.md b/data_dictionaries/windows/osquery/events/hash.md index 63c70ef56..3509844f5 100644 --- a/data_dictionaries/windows/osquery/events/hash.md +++ b/data_dictionaries/windows/osquery/events/hash.md @@ -6,11 +6,15 @@ Filesystem hash data. ## Data Dictionary |Standard Name|Field Name|Type|Description|Sample Value| |---|---|---|---|---| -|file_path|path|TEXT|Must provide a path or directory|``| -|file_directory|directory|TEXT|Must provide a path or directory|``| -|hash_md5|md5|TEXT|MD5 hash of provided filesystem data|``| -|hash_sha1|sha1|TEXT|SHA1 hash of provided filesystem data|``| -|hadh_sha256|sha256|TEXT|SHA256 hash of provided filesystem data|``| +|file_path|path|TEXT|Must provide a path or directory|`TBD`| +|file_directory|directory|TEXT|Must provide a path or directory|`TBD`| +|hash_md5|md5|TEXT|MD5 hash of provided filesystem data|`TBD`| +|hash_sha1|sha1|TEXT|SHA1 hash of provided filesystem data|`TBD`| +|hadh_sha256|sha256|TEXT|SHA256 hash of provided filesystem data|`TBD`| +|TBD|ssdeep|TEXT|ssdeep hash of provided filesystem data [POSIX]|`TBD`| ## References -* [osquery GitHub](https://github.com/facebook/osquery/blob/master/specs/hash.table) +* [OSQuery table documentation](https://osquery.io/schema/current#hash) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/hvci_status.md b/data_dictionaries/windows/osquery/events/hvci_status.md new file mode 100644 index 000000000..37f762ef8 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/hvci_status.md @@ -0,0 +1,19 @@ +# Hvci_status Table + +## Description +Retrieve HVCI info of the machine. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version|TEXT|The version number of the Device Guard build.|`TBD`| +|TBD|instance_identifier|TEXT|The instance ID of Device Guard.|`TBD`| +|TBD|vbs_status|TEXT|The status of the virtualization based security settings. Returns UNKNOWN if an error is encountered.|`TBD`| +|TBD|code_integrity_policy_enforcement_status|TEXT|The status of the code integrity policy enforcement settings. Returns UNKNOWN if an error is encountered.|`TBD`| +|TBD|umci_policy_status|TEXT|The status of the User Mode Code Integrity security settings. Returns UNKNOWN if an error is encountered.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#hvci_status) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/ie_extensions.md b/data_dictionaries/windows/osquery/events/ie_extensions.md index 8b5899c61..baf61d60b 100644 --- a/data_dictionaries/windows/osquery/events/ie_extensions.md +++ b/data_dictionaries/windows/osquery/events/ie_extensions.md @@ -1,4 +1,4 @@ -# Pipes Table +# Ie_extensions Table ## Description Internet Explorer browser extensions. @@ -6,10 +6,13 @@ Internet Explorer browser extensions. ## Data Dictionary |Standard Name|Field Name|Type|Description|Sample Value| |---|---|---|---|---| -|extension_name|name|TEXT|Extension display name|``| -|registry_path|registry_path|TEXT|Extension identifier|``| -|file_version|version|TEXT|Version of the executable|``| -|process_path|path|TEXT|Path to executable|``| +|extension_name|name|TEXT|Extension display name|`TBD`| +|registry_path|registry_path|TEXT|Extension identifier|`TBD`| +|file_version|version|TEXT|Version of the executable|`TBD`| +|process_path|path|TEXT|Path to executable|`TBD`| ## References -* [osquery GitHub](https://github.com/facebook/osquery/blob/master/specs/windows/ie_extensions.table) +* [OSQuery table documentation](https://osquery.io/schema/current#ie_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/intel_me_info.md b/data_dictionaries/windows/osquery/events/intel_me_info.md new file mode 100644 index 000000000..210297ff3 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/intel_me_info.md @@ -0,0 +1,15 @@ +# Intel_me_info Table + +## Description +Intel ME/CSE Info. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version| TEXT|Intel ME version|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#intel_me_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/interface_addresses.md b/data_dictionaries/windows/osquery/events/interface_addresses.md new file mode 100644 index 000000000..195a93f94 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/interface_addresses.md @@ -0,0 +1,21 @@ +# Interface_addresses Table + +## Description +Network interfaces and relevant metadata. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|address|TEXT|Specific address for interface|`TBD`| +|TBD|mask|TEXT|Interface netmask|`TBD`| +|TBD|broadcast|TEXT|Broadcast address for the interface|`TBD`| +|TBD|point_to_point|TEXT|PtP address for the interface|`TBD`| +|TBD|type|TEXT|Type of address. One of dhcp, manual, auto, other, unknown|`TBD`| +|TBD|friendly_name|TEXT|The friendly display name of the interface. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_addresses) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/interface_details.md b/data_dictionaries/windows/osquery/events/interface_details.md new file mode 100644 index 000000000..48f42856b --- /dev/null +++ b/data_dictionaries/windows/osquery/events/interface_details.md @@ -0,0 +1,49 @@ +# Interface_details Table + +## Description +Detailed information and stats of network interfaces. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|interface|TEXT|Interface name|`TBD`| +|TBD|mac|TEXT|MAC of interface (optional)|`TBD`| +|TBD|type|INTEGER|Interface type (includes virtual)|`TBD`| +|TBD|mtu|INTEGER|Network MTU|`TBD`| +|TBD|metric|INTEGER|Metric based on the speed of the interface|`TBD`| +|TBD|flags|INTEGER|Flags (netdevice) for the device|`TBD`| +|TBD|ipackets|BIGINT|Input packets|`TBD`| +|TBD|opackets|BIGINT|Output packets|`TBD`| +|TBD|ibytes|BIGINT|Input bytes|`TBD`| +|TBD|obytes|BIGINT|Output bytes|`TBD`| +|TBD|ierrors|BIGINT|Input errors|`TBD`| +|TBD|oerrors|BIGINT|Output errors|`TBD`| +|TBD|idrops|BIGINT|Input drops|`TBD`| +|TBD|odrops|BIGINT|Output drops|`TBD`| +|TBD|collisions|BIGINT|Packet Collisions detected|`TBD`| +|TBD|last_change|BIGINT|Time of last device modification (optional)|`TBD`| +|TBD|link_speed|BIGINT|Interface speed in Mb/s [POSIX]|`TBD`| +|TBD|pci_slot|TEXT|PCI slot number [LINUX]|`TBD`| +|TBD|friendly_name|TEXT|The friendly display name of the interface. [WINDOWS]|`TBD`| +|TBD|description|TEXT|Short description of the object a one-line string. [WINDOWS]|`TBD`| +|TBD|manufacturer|TEXT|Name of the network adapter's manufacturer. [WINDOWS]|`TBD`| +|TBD|connection_id|TEXT|Name of the network connection as it appears in the Network Connections Control Panel program. [WINDOWS]|`TBD`| +|TBD|connection_status|TEXT|State of the network adapter connection to the network. [WINDOWS]|`TBD`| +|TBD|enabled|INTEGER|Indicates whether the adapter is enabled or not. [WINDOWS]|`TBD`| +|TBD|physical_adapter|INTEGER|Indicates whether the adapter is a physical or a logical adapter. [WINDOWS]|`TBD`| +|TBD|speed|INTEGER|Estimate of the current bandwidth in bits per second. [WINDOWS]|`TBD`| +|TBD|service|TEXT|The name of the service the network adapter uses. [WINDOWS]|`TBD`| +|TBD|dhcp_enabled|INTEGER|If TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection. [WINDOWS]|`TBD`| +|TBD|dhcp_lease_expires|TEXT|Expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dhcp_lease_obtained|TEXT|Date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dhcp_server|TEXT|IP address of the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`| +|TBD|dns_domain|TEXT|Organization name followed by a period and an extension that indicates the type of organization, such as 'microsoft.com'. [WINDOWS]|`TBD`| +|TBD|dns_domain_suffix_search_order|TEXT|Array of DNS domain suffixes to be appended to the end of host names during name resolution. [WINDOWS]|`TBD`| +|TBD|dns_host_name|TEXT|Host name used to identify the local computer for authentication by some utilities. [WINDOWS]|`TBD`| +|TBD|dns_server_search_order|TEXT|Array of server IP addresses to be used in querying for DNS servers. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#interface_details) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/kernel_info.md b/data_dictionaries/windows/osquery/events/kernel_info.md new file mode 100644 index 000000000..a7801b5c2 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/kernel_info.md @@ -0,0 +1,18 @@ +# Kernel_info Table + +## Description +Basic active kernel information. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|version|TEXT|Kernel version|`TBD`| +|TBD|arguments|TEXT|Kernel arguments|`TBD`| +|TBD|path|TEXT|Kernel path|`TBD`| +|TBD|device|TEXT|Kernel device identifier|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#kernel_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/kva_speculative_info.md b/data_dictionaries/windows/osquery/events/kva_speculative_info.md new file mode 100644 index 000000000..e78b41518 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/kva_speculative_info.md @@ -0,0 +1,25 @@ +# Kva_speculative_info Table + +## Description +Display kernel virtual address and speculative execution information for the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|kva_shadow_enabled|INTEGER|Kernel Virtual Address shadowing is enabled.|`TBD`| +|TBD|kva_shadow_user_global|INTEGER|User pages are marked as global.|`TBD`| +|TBD|kva_shadow_pcid|INTEGER|Kernel VA PCID flushing optimization is enabled.|`TBD`| +|TBD|kva_shadow_inv_pcid|INTEGER|Kernel VA INVPCID is enabled.|`TBD`| +|TBD|bp_mitigations|INTEGER|Branch Prediction mitigations are enabled.|`TBD`| +|TBD|bp_system_pol_disabled|INTEGER|Branch Predictions are disabled via system policy.|`TBD`| +|TBD|bp_microcode_disabled|INTEGER|Branch Predictions are disabled due to lack of microcode update.|`TBD`| +|TBD|cpu_spec_ctrl_supported|INTEGER|SPEC_CTRL MSR supported by CPU Microcode.|`TBD`| +|TBD|ibrs_support_enabled|INTEGER|Windows uses IBRS.|`TBD`| +|TBD|stibp_support_enabled|INTEGER|Windows uses STIBP.|`TBD`| +|TBD|cpu_pred_cmd_supported|INTEGER|PRED_CMD MSR supported by CPU Microcode.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#kva_speculative_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/listening_ports.md b/data_dictionaries/windows/osquery/events/listening_ports.md new file mode 100644 index 000000000..2d8444045 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/listening_ports.md @@ -0,0 +1,23 @@ +# Listening_ports Table + +## Description +Processes with listening (bound) network sockets/ports. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|port|INTEGER|Transport layer port|`TBD`| +|TBD|protocol|INTEGER|Transport protocol (TCP/UDP)|`TBD`| +|TBD|family|INTEGER|Network protocol (IPv4, IPv6)|`TBD`| +|TBD|address|TEXT|Specific address for bind|`TBD`| +|TBD|fd|BIGINT|Socket file descriptor number|`TBD`| +|TBD|socket|BIGINT|Socket handle or inode number|`TBD`| +|TBD|path|TEXT|Path for UNIX domain sockets|`TBD`| +|TBD|net_namespace|TEXT|The inode number of the network namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#listening_ports) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/logged_in_users.md b/data_dictionaries/windows/osquery/events/logged_in_users.md new file mode 100644 index 000000000..4a6a32b34 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/logged_in_users.md @@ -0,0 +1,22 @@ +# Logged_in_users Table + +## Description +Users with an active shell on the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|Login type|`TBD`| +|TBD|user|TEXT|User login name|`TBD`| +|TBD|tty|TEXT|Device name|`TBD`| +|TBD|host|TEXT|Remote hostname|`TBD`| +|TBD|time|INTEGER|Time entry was made|`TBD`| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|sid|TEXT|The user's unique security identifier [WINDOWS]|`TBD`| +|TBD|registry_hive|TEXT|HKEY_USERS registry hive [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#logged_in_users) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/logical_drives.md b/data_dictionaries/windows/osquery/events/logical_drives.md new file mode 100644 index 000000000..2a632708f --- /dev/null +++ b/data_dictionaries/windows/osquery/events/logical_drives.md @@ -0,0 +1,21 @@ +# Logical_drives Table + +## Description +Details for logical drives on the system. A logical drive generally represents a single partition. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|device_id|TEXT|The drive id, usually the drive name, e.g., 'C:'.|`TBD`| +|TBD|type|TEXT|Deprecated (always 'Unknown').|`TBD`| +|TBD|description|TEXT|The canonical description of the drive, e.g. 'Logical Fixed Disk', 'CD-ROM Disk'.|`TBD`| +|TBD|free_space|BIGINT|The amount of free space, in bytes, of the drive (-1 on failure).|`TBD`| +|TBD|size|BIGINT|The total amount of space, in bytes, of the drive (-1 on failure).|`TBD`| +|TBD|file_system|TEXT|The file system of the drive.|`TBD`| +|TBD|boot_partition|INTEGER|True if Windows booted from this drive.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#logical_drives) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/logon_sessions.md b/data_dictionaries/windows/osquery/events/logon_sessions.md new file mode 100644 index 000000000..792226c78 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/logon_sessions.md @@ -0,0 +1,29 @@ +# Logon_sessions Table + +## Description +Windows Logon Session. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|logon_id|INTEGER|A locally unique identifier (LUID) that identifies a logon session.|`TBD`| +|TBD|user|TEXT|The account name of the security principal that owns the logon session.|`TBD`| +|TBD|logon_domain|TEXT|The name of the domain used to authenticate the owner of the logon session.|`TBD`| +|TBD|authentication_package|TEXT|The authentication package used to authenticate the owner of the logon session.|`TBD`| +|TBD|logon_type|TEXT|The logon method.|`TBD`| +|TBD|session_id|INTEGER|The Terminal Services session identifier.|`TBD`| +|TBD|logon_sid|TEXT|The user's security identifier (SID).|`TBD`| +|TBD|logon_time|BIGINT|The time the session owner logged on.|`TBD`| +|TBD|logon_server|TEXT|The name of the server used to authenticate the owner of the logon session.|`TBD`| +|TBD|dns_domain_name|TEXT|The DNS name for the owner of the logon session.|`TBD`| +|TBD|upn|TEXT|The user principal name (UPN) for the owner of the logon session.|`TBD`| +|TBD|logon_script|TEXT|The script used for logging on.|`TBD`| +|TBD|profile_path|TEXT|The home directory for the logon session.|`TBD`| +|TBD|home_directory|TEXT|The home directory for the logon session.|`TBD`| +|TBD|home_directory_drive|TEXT|The drive location of the home directory of the logon session.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#logon_sessions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/ntdomains.md b/data_dictionaries/windows/osquery/events/ntdomains.md new file mode 100644 index 000000000..d8142f2b3 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/ntdomains.md @@ -0,0 +1,22 @@ +# Ntdomains Table + +## Description +Display basic NT domain information of a Windows machine. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The label by which the object is known.|`TBD`| +|TBD|client_site_name|TEXT|The name of the site where the domain controller is configured.|`TBD`| +|TBD|dc_site_name|TEXT|The name of the site where the domain controller is located.|`TBD`| +|TBD|dns_forest_name|TEXT|The name of the root of the DNS tree.|`TBD`| +|TBD|domain_controller_address|TEXT|The IP Address of the discovered domain controller..|`TBD`| +|TBD|domain_controller_name|TEXT|The name of the discovered domain controller.|`TBD`| +|TBD|domain_name|TEXT|The name of the domain.|`TBD`| +|TBD|status|TEXT|The current status of the domain object.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ntdomains) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/ntfs_acl_permissions.md b/data_dictionaries/windows/osquery/events/ntfs_acl_permissions.md new file mode 100644 index 000000000..b100a2839 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/ntfs_acl_permissions.md @@ -0,0 +1,19 @@ +# Ntfs_acl_permissions Table + +## Description +Retrieve NTFS ACL permission information for files and directories. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|path|TEXT|Path to the file or directory.|`TBD`| +|TBD|type|TEXT|Type of access mode for the access control entry.|`TBD`| +|TBD|principal|TEXT|User or group to which the ACE applies.|`TBD`| +|TBD|access|TEXT|Specific permissions that indicate the rights described by the ACE.|`TBD`| +|TBD|inherited_from|TEXT|The inheritance policy of the ACE.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ntfs_acl_permissions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/ntfs_journal_events.md b/data_dictionaries/windows/osquery/events/ntfs_journal_events.md new file mode 100644 index 000000000..dcce4d018 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/ntfs_journal_events.md @@ -0,0 +1,27 @@ +# Ntfs_journal_events Table + +## Description +Track time/action changes to files specified in configuration data. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|action|TEXT|Change action (Write, Delete, etc)|`TBD`| +|TBD|category|TEXT|The category that the event originated from|`TBD`| +|TBD|old_path|TEXT|Old path (renames only)|`TBD`| +|TBD|path|TEXT|Path|`TBD`| +|TBD|record_timestamp|TEXT|Journal record timestamp|`TBD`| +|TBD|record_usn|TEXT|The update sequence number that identifies the journal record|`TBD`| +|TBD|node_ref_number|TEXT|The ordinal that associates a journal record with a filename|`TBD`| +|TBD|parent_ref_number|TEXT|The ordinal that associates a journal record with a filename's parent directory|`TBD`| +|TBD|drive_letter|TEXT|The drive letter identifying the source journal|`TBD`| +|TBD|file_attributes|TEXT|File attributes|`TBD`| +|TBD|partial|BIGINT|Set to 1 if either path or old_path only contains the file or folder name|`TBD`| +|TBD|time|BIGINT|Time of file event|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ntfs_journal_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/os_version.md b/data_dictionaries/windows/osquery/events/os_version.md new file mode 100644 index 000000000..0f7d5cd88 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/os_version.md @@ -0,0 +1,24 @@ +# Os_version Table + +## Description +A single row containing the operating system name and version. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Distribution or product name|`TBD`| +|TBD|version|TEXT|Pretty, suitable for presentation, OS version|`TBD`| +|TBD|major|INTEGER|Major release version|`TBD`| +|TBD|minor|INTEGER|Minor release version|`TBD`| +|TBD|patch|INTEGER|Optional patch release|`TBD`| +|TBD|build|TEXT|Optional build-specific or variant string|`TBD`| +|TBD|platform|TEXT|OS Platform or ID|`TBD`| +|TBD|platform_like|TEXT|Closely related platforms|`TBD`| +|TBD|codename|TEXT|OS version codename|`TBD`| +|TBD|install_date|TEXT|The install date of the OS. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#os_version) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/osquery_events.md b/data_dictionaries/windows/osquery/events/osquery_events.md new file mode 100644 index 000000000..8f658b32f --- /dev/null +++ b/data_dictionaries/windows/osquery/events/osquery_events.md @@ -0,0 +1,18 @@ +# Osquery_events Table + +## Description +Information about the event publishers and subscribers. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Event publisher or subscriber name|`TBD`| +|TBD|publisher|TEXT|Name of the associated publisher|`TBD`| +|TBD|type|TEXT|Either publisher or subscriber|`TBD`| +|TBD|refreshes|INTEGER|Publisher only: number of runloop restarts|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/osquery_extensions.md b/data_dictionaries/windows/osquery/events/osquery_extensions.md new file mode 100644 index 000000000..2052c8dec --- /dev/null +++ b/data_dictionaries/windows/osquery/events/osquery_extensions.md @@ -0,0 +1,20 @@ +# Osquery_extensions Table + +## Description +List of active osquery extensions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uuid|BIGINT|The transient ID assigned for communication|`TBD`| +|TBD|name|TEXT|Extension's name|`TBD`| +|TBD|version|TEXT|Extension's version|`TBD`| +|TBD|sdk_version|TEXT|osquery SDK version used to build the extension|`TBD`| +|TBD|path|TEXT|Path of the extenion's domain socket or library path|`TBD`| +|TBD|type|TEXT|SDK extension type: extension or module|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_extensions) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/osquery_flags.md b/data_dictionaries/windows/osquery/events/osquery_flags.md new file mode 100644 index 000000000..ac0ec4a46 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/osquery_flags.md @@ -0,0 +1,20 @@ +# Osquery_flags Table + +## Description +Configurable flags that modify osquery's behavior. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Flag name|`TBD`| +|TBD|type|TEXT|Flag type|`TBD`| +|TBD|description|TEXT|Flag description|`TBD`| +|TBD|default_value|TEXT|Flag default value|`TBD`| +|TBD|value|TEXT|Flag value|`TBD`| +|TBD|shell_only|INTEGER|Is the flag shell only?|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_flags) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/osquery_info.md b/data_dictionaries/windows/osquery/events/osquery_info.md new file mode 100644 index 000000000..823c21bfc --- /dev/null +++ b/data_dictionaries/windows/osquery/events/osquery_info.md @@ -0,0 +1,26 @@ +# Osquery_info Table + +## Description +Top level information about the running version of osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread/handle) ID|`TBD`| +|TBD|uuid|TEXT|Unique ID provided by the system|`TBD`| +|TBD|instance_id|TEXT|Unique, long-lived ID per instance of osquery|`TBD`| +|TBD|version|TEXT|osquery toolkit version|`TBD`| +|TBD|config_hash|TEXT|Hash of the working configuration state|`TBD`| +|TBD|config_valid|INTEGER|1 if the config was loaded and considered valid, else 0|`TBD`| +|TBD|extensions|TEXT|osquery extensions status|`TBD`| +|TBD|build_platform|TEXT|osquery toolkit build platform|`TBD`| +|TBD|build_distro|TEXT|osquery toolkit platform distribution name (os version)|`TBD`| +|TBD|start_time|INTEGER|UNIX time in seconds when the process started|`TBD`| +|TBD|watcher|INTEGER|Process (or thread/handle) ID of optional watcher process|`TBD`| +|TBD|platform_mask|INTEGER|The osquery platform bitmask|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/osquery_packs.md b/data_dictionaries/windows/osquery/events/osquery_packs.md new file mode 100644 index 000000000..ac1c811f3 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/osquery_packs.md @@ -0,0 +1,21 @@ +# Osquery_packs Table + +## Description +Information about the current query packs that are loaded in osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The given name for this query pack|`TBD`| +|TBD|platform|TEXT|Platforms this query is supported on|`TBD`| +|TBD|version|TEXT|Minimum osquery version that this query will run on|`TBD`| +|TBD|shard|INTEGER|Shard restriction limit, 1-100, 0 meaning no restriction|`TBD`| +|TBD|discovery_cache_hits|INTEGER|The number of times that the discovery query used cached values since the last time the config was reloaded|`TBD`| +|TBD|discovery_executions|INTEGER|The number of times that the discovery queries have been executed since the last time the config was reloaded|`TBD`| +|TBD|active|INTEGER|Whether this pack is active (the version, platform and discovery queries match) yes=1, no=0.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_packs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/osquery_registry.md b/data_dictionaries/windows/osquery/events/osquery_registry.md new file mode 100644 index 000000000..7d1432b37 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/osquery_registry.md @@ -0,0 +1,19 @@ +# Osquery_registry Table + +## Description +List the osquery registry plugins. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|registry|TEXT|Name of the osquery registry|`TBD`| +|TBD|name|TEXT|Name of the plugin item|`TBD`| +|TBD|owner_uuid|INTEGER|Extension route UUID (0 for core)|`TBD`| +|TBD|internal|INTEGER|1 If the plugin is internal else 0|`TBD`| +|TBD|active|INTEGER|1 If this plugin is active else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_registry) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/osquery_schedule.md b/data_dictionaries/windows/osquery/events/osquery_schedule.md new file mode 100644 index 000000000..f63371227 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/osquery_schedule.md @@ -0,0 +1,21 @@ +# Osquery_schedule Table + +## Description +Information about the current queries that are scheduled in osquery. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|The given name for this query|`TBD`| +|TBD|query|TEXT|The exact query to run|`TBD`| +|TBD|executions|BIGINT|Number of times the query was executed|`TBD`| +|TBD|blacklisted|INTEGER|1 if the query is blacklisted else 0|`TBD`| +|TBD|wall_time|BIGINT|Total wall time spent executing|`TBD`| +|TBD|user_time|BIGINT|Total user time spent executing|`TBD`| +|TBD|system_time|BIGINT|Total system time spent executing|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#osquery_schedule) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/patches.md b/data_dictionaries/windows/osquery/events/patches.md new file mode 100644 index 000000000..f7f0bd03f --- /dev/null +++ b/data_dictionaries/windows/osquery/events/patches.md @@ -0,0 +1,22 @@ +# Patches Table + +## Description +Lists all the patches applied. Note: This does not include patches applied via MSI or downloaded from Windows Update (e.g. Service Packs). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|csname|TEXT|The name of the host the patch is installed on.|`TBD`| +|TBD|hotfix_id|TEXT|The KB ID of the patch.|`TBD`| +|TBD|caption|TEXT|Short description of the patch.|`TBD`| +|TBD|description|TEXT|Fuller description of the patch.|`TBD`| +|TBD|fix_comments|TEXT|Additional comments about the patch.|`TBD`| +|TBD|installed_by|TEXT|The system context in which the patch as installed.|`TBD`| +|TBD|install_date|TEXT|Indicates when the patch was installed. Lack of a value does not indicate that the patch was not installed.|`TBD`| +|TBD|installed_on|TEXT|The date when the patch was installed.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#patches) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/physical_disk_performance.md b/data_dictionaries/windows/osquery/events/physical_disk_performance.md new file mode 100644 index 000000000..ce28b8f85 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/physical_disk_performance.md @@ -0,0 +1,26 @@ +# Physical_disk_performance Table + +## Description +Provides provides raw data from performance counters that monitor hard or fixed disk drives on the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Name of the physical disk|`TBD`| +|TBD|avg_disk_bytes_per_read|BIGINT|Average number of bytes transferred from the disk during read operations|`TBD`| +|TBD|avg_disk_bytes_per_write|BIGINT|Average number of bytes transferred to the disk during write operations|`TBD`| +|TBD|avg_disk_read_queue_length|BIGINT|Average number of read requests that were queued for the selected disk during the sample interval|`TBD`| +|TBD|avg_disk_write_queue_length|BIGINT|Average number of write requests that were queued for the selected disk during the sample interval|`TBD`| +|TBD|avg_disk_sec_per_read|INTEGER|Average time, in seconds, of a read operation of data from the disk|`TBD`| +|TBD|avg_disk_sec_per_write|INTEGER|Average time, in seconds, of a write operation of data to the disk|`TBD`| +|TBD|current_disk_queue_length|INTEGER|Number of requests outstanding on the disk at the time the performance data is collected|`TBD`| +|TBD|percent_disk_read_time|BIGINT|Percentage of elapsed time that the selected disk drive is busy servicing read requests|`TBD`| +|TBD|percent_disk_write_time|BIGINT|Percentage of elapsed time that the selected disk drive is busy servicing write requests|`TBD`| +|TBD|percent_disk_time|BIGINT|Percentage of elapsed time that the selected disk drive is busy servicing read or write requests|`TBD`| +|TBD|percent_idle_time|BIGINT|Percentage of time during the sample interval that the disk was idle|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#physical_disk_performance) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/pipes.md b/data_dictionaries/windows/osquery/events/pipes.md index af441f49e..63928d28e 100644 --- a/data_dictionaries/windows/osquery/events/pipes.md +++ b/data_dictionaries/windows/osquery/events/pipes.md @@ -6,11 +6,14 @@ Named and Anonymous pipes. ## Data Dictionary |Standard Name|Field Name|Type|Description|Sample Value| |---|---|---|---|---| -|process_id|pid|BIGINT|Process ID of the process to which the pipe belongs|``| -|pipe_name|name|TEXT|Name of the pipe|``| -|pipe_instances|instances|INTEGER|Number of instances of the named pipe|``| -|pipe_max_instances|max_instances|INTEGER|The maximum number of instances creatable for this pipe|``| -|pipe_flags|flags|TEXT|The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes|``| +|process_id|pid|BIGINT|Process ID of the process to which the pipe belongs|`TBD`| +|pipe_name|name|TEXT|Name of the pipe|`TBD`| +|pipe_instances|instances|INTEGER|Number of instances of the named pipe|`TBD`| +|pipe_max_instances|max_instances|INTEGER|The maximum number of instances creatable for this pipe|`TBD`| +|pipe_flags|flags|TEXT|The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes|`TBD`| ## References -* [osquery GitHub](https://github.com/facebook/osquery/blob/master/specs/windows/pipes.table) +* [OSQuery table documentation](https://osquery.io/schema/current#pipes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/platform_info.md b/data_dictionaries/windows/osquery/events/platform_info.md new file mode 100644 index 000000000..ee430f192 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/platform_info.md @@ -0,0 +1,22 @@ +# Platform_info Table + +## Description +Information about EFI/UEFI/ROM and platform/boot. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|vendor|TEXT|Platform code vendor|`TBD`| +|TBD|version|TEXT|Platform code version|`TBD`| +|TBD|date|TEXT|Self-reported platform code update date|`TBD`| +|TBD|revision|TEXT|BIOS major and minor revision|`TBD`| +|TBD|address|TEXT|Relative address of firmware mapping|`TBD`| +|TBD|size|TEXT|Size in bytes of firmware|`TBD`| +|TBD|volume_size|INTEGER|(Optional) size of firmware volume|`TBD`| +|TBD|extra|TEXT|Platform-specific additional information|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#platform_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/powershell_events.md b/data_dictionaries/windows/osquery/events/powershell_events.md new file mode 100644 index 000000000..56ddf3ec9 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/powershell_events.md @@ -0,0 +1,22 @@ +# Powershell_events Table + +## Description +Powershell script blocks reconstructed to their full script content, this table requires script block logging to be enabled. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|time|BIGINT|Timestamp the event was received by the osquery event publisher|`TBD`| +|TBD|datetime|TEXT|System time at which the Powershell script event occurred|`TBD`| +|TBD|script_block_id|TEXT|The unique GUID of the powershell script to which this block belongs|`TBD`| +|TBD|script_block_count|INTEGER|The total number of script blocks for this script|`TBD`| +|TBD|script_text|TEXT|The text content of the Powershell script|`TBD`| +|TBD|script_name|TEXT|The name of the Powershell script|`TBD`| +|TBD|script_path|TEXT|The path for the Powershell script|`TBD`| +|TBD|cosine_similarity|DOUBLE|How similar the Powershell script is to a provided 'normal' character frequency|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#powershell_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/process_memory_map.md b/data_dictionaries/windows/osquery/events/process_memory_map.md new file mode 100644 index 000000000..16fabc750 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/process_memory_map.md @@ -0,0 +1,23 @@ +# Process_memory_map Table + +## Description +Process memory mapped files and pseudo device/regions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|start|TEXT|Virtual start address (hex)|`TBD`| +|TBD|end|TEXT|Virtual end address (hex)|`TBD`| +|TBD|permissions|TEXT|r=read, w=write, x=execute, p=private (cow)|`TBD`| +|TBD|offset|BIGINT|Offset into mapped path|`TBD`| +|TBD|device|TEXT|MA:MI Major/minor device ID|`TBD`| +|TBD|inode|INTEGER|Mapped path inode, 0 means uninitialized (BSS)|`TBD`| +|TBD|path|TEXT|Path to mapped file or mapped type|`TBD`| +|TBD|pseudo|INTEGER|1 If path is a pseudo path, else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_memory_map) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/process_open_sockets.md b/data_dictionaries/windows/osquery/events/process_open_sockets.md new file mode 100644 index 000000000..25cedbac6 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/process_open_sockets.md @@ -0,0 +1,26 @@ +# Process_open_sockets Table + +## Description +Processes which have open network sockets on the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|INTEGER|Process (or thread) ID|`TBD`| +|TBD|fd|BIGINT|Socket file descriptor number|`TBD`| +|TBD|socket|BIGINT|Socket handle or inode number|`TBD`| +|TBD|family|INTEGER|Network protocol (IPv4, IPv6)|`TBD`| +|TBD|protocol|INTEGER|Transport protocol (TCP/UDP)|`TBD`| +|TBD|local_address|TEXT|Socket local address|`TBD`| +|TBD|remote_address|TEXT|Socket remote address|`TBD`| +|TBD|local_port|INTEGER|Socket local port|`TBD`| +|TBD|remote_port|INTEGER|Socket remote port|`TBD`| +|TBD|path|TEXT|For UNIX sockets (family=AF_UNIX), the domain path|`TBD`| +|TBD|state|TEXT|TCP socket state [lambda: LINUX() or DARWIN() or WINDOWS()]|`TBD`| +|TBD|net_namespace|TEXT|The inode number of the network namespace [LINUX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#process_open_sockets) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/processes.md b/data_dictionaries/windows/osquery/events/processes.md new file mode 100644 index 000000000..b2f1687d7 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/processes.md @@ -0,0 +1,47 @@ +# Processes Table + +## Description +All running processes on the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|pid|BIGINT|Process (or thread) ID|`TBD`| +|TBD|name|TEXT|The process path or shorthand argv[0]|`TBD`| +|TBD|path|TEXT|Path to executed binary|`TBD`| +|TBD|cmdline|TEXT|Complete argv|`TBD`| +|TBD|state|TEXT|Process state|`TBD`| +|TBD|cwd|TEXT|Process current working directory|`TBD`| +|TBD|root|TEXT|Process virtual root directory|`TBD`| +|TBD|uid|BIGINT|Unsigned user ID|`TBD`| +|TBD|gid|BIGINT|Unsigned group ID|`TBD`| +|TBD|euid|BIGINT|Unsigned effective user ID|`TBD`| +|TBD|egid|BIGINT|Unsigned effective group ID|`TBD`| +|TBD|suid|BIGINT|Unsigned saved user ID|`TBD`| +|TBD|sgid|BIGINT|Unsigned saved group ID|`TBD`| +|TBD|wired_size|BIGINT|Bytes of unpagable memory used by process|`TBD`| +|TBD|resident_size|BIGINT|Bytes of private memory used by process|`TBD`| +|TBD|total_size|BIGINT|Total virtual memory size|`TBD`| +|TBD|user_time|BIGINT|CPU time in milliseconds spent in user space|`TBD`| +|TBD|system_time|BIGINT|CPU time in milliseconds spent in kernel space|`TBD`| +|TBD|disk_bytes_read|BIGINT|Bytes read from disk|`TBD`| +|TBD|disk_bytes_written|BIGINT|Bytes written to disk|`TBD`| +|TBD|start_time|BIGINT|Process start time in seconds since Epoch, in case of error -1|`TBD`| +|TBD|parent|BIGINT|Process parent's PID|`TBD`| +|TBD|pgroup|BIGINT|Process group|`TBD`| +|TBD|threads|INTEGER|Number of threads used by process|`TBD`| +|TBD|nice|INTEGER|Process nice level (-20 to 20, default 0)|`TBD`| +|TBD|is_elevated_token|INTEGER|Process uses elevated token yes=1, no=0 [WINDOWS]|`TBD`| +|TBD|elapsed_time|BIGINT|Elapsed time in seconds this process has been running. [WINDOWS]|`TBD`| +|TBD|handle_count|BIGINT|Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process. [WINDOWS]|`TBD`| +|TBD|percent_processor_time|BIGINT|Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks. [WINDOWS]|`TBD`| +|TBD|upid|BIGINT|A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|uppid|BIGINT|The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|cpu_type|INTEGER|A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| +|TBD|cpu_subtype|INTEGER|The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#processes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/programs.md b/data_dictionaries/windows/osquery/events/programs.md new file mode 100644 index 000000000..9f81b5aef --- /dev/null +++ b/data_dictionaries/windows/osquery/events/programs.md @@ -0,0 +1,23 @@ +# Programs Table + +## Description +Represents products as they are installed by Windows Installer. A product generally correlates to one installation package on Windows. Some fields may be blank as Windows installation details are left to the discretion of the product author. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Commonly used product name.|`TBD`| +|TBD|version|TEXT|Product version information.|`TBD`| +|TBD|install_location|TEXT|The installation location directory of the product.|`TBD`| +|TBD|install_source|TEXT|The installation source of the product.|`TBD`| +|TBD|language|TEXT|The language of the product.|`TBD`| +|TBD|publisher|TEXT|Name of the product supplier.|`TBD`| +|TBD|uninstall_string|TEXT|Path and filename of the uninstaller.|`TBD`| +|TBD|install_date|TEXT|Date that this product was installed on the system. |`TBD`| +|TBD|identifying_number|TEXT|Product identification such as a serial number on software, or a die number on a hardware chip.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#programs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/python_packages.md b/data_dictionaries/windows/osquery/events/python_packages.md new file mode 100644 index 000000000..af502ce5b --- /dev/null +++ b/data_dictionaries/windows/osquery/events/python_packages.md @@ -0,0 +1,21 @@ +# Python_packages Table + +## Description +Python packages installed in a system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Package display name|`TBD`| +|TBD|version|TEXT|Package-supplied version|`TBD`| +|TBD|summary|TEXT|Package-supplied summary|`TBD`| +|TBD|author|TEXT|Optional package author|`TBD`| +|TBD|license|TEXT|License under which package is launched|`TBD`| +|TBD|path|TEXT|Path at which this module resides|`TBD`| +|TBD|directory|TEXT|Directory where Python modules are located|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#python_packages) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/registry.md b/data_dictionaries/windows/osquery/events/registry.md new file mode 100644 index 000000000..7614dbaeb --- /dev/null +++ b/data_dictionaries/windows/osquery/events/registry.md @@ -0,0 +1,20 @@ +# Registry Table + +## Description +All of the Windows registry hives. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|key|TEXT|Name of the key to search for|`TBD`| +|TBD|path|TEXT|Full path to the value|`TBD`| +|TBD|name|TEXT|Name of the registry value entry|`TBD`| +|TBD|type|TEXT|Type of the registry value, or 'subkey' if item is a subkey|`TBD`| +|TBD|data|TEXT|Data content of registry value|`TBD`| +|TBD|mtime|BIGINT|timestamp of the most recent registry write|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#registry) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/routes.md b/data_dictionaries/windows/osquery/events/routes.md new file mode 100644 index 000000000..5197fbf35 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/routes.md @@ -0,0 +1,24 @@ +# Routes Table + +## Description +The active route table for the host system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|destination|TEXT|Destination IP address|`TBD`| +|TBD|netmask|INTEGER|Netmask length|`TBD`| +|TBD|gateway|TEXT|Route gateway|`TBD`| +|TBD|source|TEXT|Route source|`TBD`| +|TBD|flags|INTEGER|Flags to describe route|`TBD`| +|TBD|interface|TEXT|Route local interface|`TBD`| +|TBD|mtu|INTEGER|Maximum Transmission Unit for the route|`TBD`| +|TBD|metric|INTEGER|Cost of route. Lowest is preferred|`TBD`| +|TBD|type|TEXT|Type of route|`TBD`| +|TBD|hopcount|INTEGER|Max hops expected [POSIX]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#routes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/scheduled_tasks.md b/data_dictionaries/windows/osquery/events/scheduled_tasks.md new file mode 100644 index 000000000..e50c92e75 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/scheduled_tasks.md @@ -0,0 +1,24 @@ +# Scheduled_tasks Table + +## Description +Lists all of the tasks in the Windows task scheduler. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Name of the scheduled task|`TBD`| +|TBD|action|TEXT|Actions executed by the scheduled task|`TBD`| +|TBD|path|TEXT|Path to the executable to be run|`TBD`| +|TBD|enabled|INTEGER|Whether or not the scheduled task is enabled|`TBD`| +|TBD|state|TEXT|State of the scheduled task|`TBD`| +|TBD|hidden|INTEGER|Whether or not the task is visible in the UI|`TBD`| +|TBD|last_run_time|INTEGER|Timestamp the task last ran|`TBD`| +|TBD|next_run_time|INTEGER|Timestamp the task is scheduled to run next|`TBD`| +|TBD|last_run_message|TEXT|Exit status message of the last task run|`TBD`| +|TBD|last_run_code|TEXT|Exit status code of the last task run|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#scheduled_tasks) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/services.md b/data_dictionaries/windows/osquery/events/services.md index 87f2e2f54..d0608baef 100644 --- a/data_dictionaries/windows/osquery/events/services.md +++ b/data_dictionaries/windows/osquery/events/services.md @@ -1,23 +1,26 @@ # Services Table ## Description -List all installed Windows services and their relevant data. +Lists all installed Windows services and their relevant data. ## Data Dictionary |Standard Name|Field Name|Type|Description|Sample Value| |---|---|---|---|---| -|service_name|name|TEXT|Service name|``| -|service_type|service_type|TEXT|Service Type: OWN_PROCESS, SHARE_PROCESS and maybe Interactive (can interact with the desktop)|``| -|service_display_name|display_name|TEXT|Service Display name|``| -|service_status|status|TEXT|Service Current status: STOPPED, START_PENDING, STOP_PENDING, RUNNING, CONTINUE_PENDING, PAUSE_PENDING, PAUSED|``| -|process_id|pid|INTEGER|the Process ID of the service|``| -|service_start_type|start_type|TEXT|Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED|``| -|service_error_code|win32_exit_code|INTEGER|The error code that the service uses to report an error that occurs when it is starting or stopping|``| -|service_exit_code|service_exit_code|INTEGER|The service-specific error code that the service returns when an error occurs while the service is starting or stopping|``| -|file_path|path|TEXT|Path to Service Executable|``| -|module_path|module_path|TEXT|Path to ServiceDll|``| -|service_description|description|TEXT|Service Description|``| -|user_name|user_account|TEXT|The name of the account that the service process will be logged on as when it runs. This name can be of the form Domain\UserName. If the account belongs to the built-in domain, the name can be of the form .\UserName.|``| +|service_name|name|TEXT|Service name|`TBD`| +|service_type|service_type|TEXT|Service Type: OWN_PROCESS, SHARE_PROCESS and maybe Interactive (can interact with the desktop)|`TBD`| +|service_display_name|display_name|TEXT|Service Display name|`TBD`| +|service_status|status|TEXT|Service Current status: STOPPED, START_PENDING, STOP_PENDING, RUNNING, CONTINUE_PENDING, PAUSE_PENDING, PAUSED|`TBD`| +|process_id|pid|INTEGER|the Process ID of the service|`TBD`| +|service_start_type|start_type|TEXT|Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED|`TBD`| +|service_error_code|win32_exit_code|INTEGER|The error code that the service uses to report an error that occurs when it is starting or stopping|`TBD`| +|service_exit_code|service_exit_code|INTEGER|The service-specific error code that the service returns when an error occurs while the service is starting or stopping|`TBD`| +|file_path|path|TEXT|Path to Service Executable|`TBD`| +|module_path|module_path|TEXT|Path to ServiceDll|`TBD`| +|service_description|description|TEXT|Service Description|`TBD`| +|user_name|user_account|TEXT|The name of the account that the service process will be logged on as when it runs. This name can be of the form Domain\\UserName. If the account belongs to the built-in domain, the name can be of the form .\\UserName.|`TBD`| ## References -* [osquery GitHub](https://github.com/facebook/osquery/blob/master/specs/windows/services.table) +* [OSQuery table documentation](https://osquery.io/schema/current#services) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/shared_resources.md b/data_dictionaries/windows/osquery/events/shared_resources.md new file mode 100644 index 000000000..9d5a72da7 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/shared_resources.md @@ -0,0 +1,22 @@ +# Shared_resources Table + +## Description +Displays shared resources on a computer system running Windows. This may be a disk drive, printer, interprocess communication, or other sharable device. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|description|TEXT|A textual description of the object|`TBD`| +|TBD|install_date|TEXT|Indicates when the object was installed. Lack of a value does not indicate that the object is not installed.|`TBD`| +|TBD|status|TEXT|String that indicates the current status of the object.|`TBD`| +|TBD|allow_maximum|INTEGER|Number of concurrent users for this resource has been limited. If True, the value in the MaximumAllowed property is ignored.|`TBD`| +|TBD|maximum_allowed|INTEGER|Limit on the maximum number of users allowed to use this resource concurrently. The value is only valid if the AllowMaximum property is set to FALSE.|`TBD`| +|TBD|name|TEXT|Alias given to a path set up as a share on a computer system running Windows.|`TBD`| +|TBD|path|TEXT|Local path of the Windows share.|`TBD`| +|TBD|type|INTEGER|Type of resource being shared. Types include: disk drives, print queues, interprocess communications (IPC), and general devices.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#shared_resources) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/ssh_configs.md b/data_dictionaries/windows/osquery/events/ssh_configs.md new file mode 100644 index 000000000..66ac48247 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/ssh_configs.md @@ -0,0 +1,17 @@ +# Ssh_configs Table + +## Description +A table of parsed ssh_configs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local owner of the ssh_config file|`TBD`| +|TBD|option|TEXT|The option and value|`TBD`| +|TBD|ssh_config_file|TEXT|Path to the ssh_config file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#ssh_configs) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/startup_items.md b/data_dictionaries/windows/osquery/events/startup_items.md new file mode 100644 index 000000000..e6d1ec5a4 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/startup_items.md @@ -0,0 +1,21 @@ +# Startup_items Table + +## Description +Applications and binaries set as user/login startup items. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Name of startup item|`TBD`| +|TBD|path|TEXT|Path of startup item|`TBD`| +|TBD|args|TEXT|Arguments provided to startup executable|`TBD`| +|TBD|type|TEXT|Startup Item or Login Item|`TBD`| +|TBD|source|TEXT|Directory or plist containing startup item|`TBD`| +|TBD|status|TEXT|Startup status; either enabled or disabled|`TBD`| +|TBD|username|TEXT|The user associated with the startup item|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#startup_items) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/system_info.md b/data_dictionaries/windows/osquery/events/system_info.md new file mode 100644 index 000000000..482c3c621 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/system_info.md @@ -0,0 +1,29 @@ +# System_info Table + +## Description +System information for identification. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|hostname|TEXT|Network hostname including domain|`TBD`| +|TBD|uuid|TEXT|Unique ID provided by the system|`TBD`| +|TBD|cpu_type|TEXT|CPU type|`TBD`| +|TBD|cpu_subtype|TEXT|CPU subtype|`TBD`| +|TBD|cpu_brand|TEXT|CPU brand string, contains vendor and model|`TBD`| +|TBD|cpu_physical_cores|INTEGER|Number of physical CPU cores in to the system|`TBD`| +|TBD|cpu_logical_cores|INTEGER|Number of logical CPU cores available to the system|`TBD`| +|TBD|cpu_microcode|TEXT|Microcode version|`TBD`| +|TBD|physical_memory|BIGINT|Total physical memory in bytes|`TBD`| +|TBD|hardware_vendor|TEXT|Hardware or board vendor|`TBD`| +|TBD|hardware_model|TEXT|Hardware or board model|`TBD`| +|TBD|hardware_version|TEXT|Hardware or board version|`TBD`| +|TBD|hardware_serial|TEXT|Device or board serial number|`TBD`| +|TBD|computer_name|TEXT|Friendly computer name (optional)|`TBD`| +|TBD|local_hostname|TEXT|Local hostname (optional)|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#system_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/time.md b/data_dictionaries/windows/osquery/events/time.md new file mode 100644 index 000000000..9f9b27746 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/time.md @@ -0,0 +1,28 @@ +# Time Table + +## Description +Track current date and time in the system. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|weekday|TEXT|Current weekday in the system|`TBD`| +|TBD|year|INTEGER|Current year in the system|`TBD`| +|TBD|month|INTEGER|Current month in the system|`TBD`| +|TBD|day|INTEGER|Current day in the system|`TBD`| +|TBD|hour|INTEGER|Current hour in the system|`TBD`| +|TBD|minutes|INTEGER|Current minutes in the system|`TBD`| +|TBD|seconds|INTEGER|Current seconds in the system|`TBD`| +|TBD|timezone|TEXT|Current timezone in the system|`TBD`| +|TBD|local_time|INTEGER|Current local UNIX time in the system|`TBD`| +|TBD|local_timezone|TEXT|Current local timezone in the system|`TBD`| +|TBD|timestamp|TEXT|Current timestamp (log format) in the system|`TBD`| +|TBD|datetime|TEXT|Current date and time (ISO format) in the system|`TBD`| +|TBD|iso_8601|TEXT|Current time (ISO format) in the system|`TBD`| +|TBD|win_timestamp|BIGINT|Timestamp value in 100 nanosecond units. [WINDOWS]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#time) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/uptime.md b/data_dictionaries/windows/osquery/events/uptime.md new file mode 100644 index 000000000..932b0c6f9 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/uptime.md @@ -0,0 +1,19 @@ +# Uptime Table + +## Description +Track time passed since last boot. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|days|INTEGER|Days of uptime|`TBD`| +|TBD|hours|INTEGER|Hours of uptime|`TBD`| +|TBD|minutes|INTEGER|Minutes of uptime|`TBD`| +|TBD|seconds|INTEGER|Seconds of uptime|`TBD`| +|TBD|total_seconds|BIGINT|Total uptime seconds|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#uptime) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/user_groups.md b/data_dictionaries/windows/osquery/events/user_groups.md new file mode 100644 index 000000000..1a21adc67 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/user_groups.md @@ -0,0 +1,16 @@ +# User_groups Table + +## Description +Local system user group relationships. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|gid|BIGINT|Group ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_groups) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/user_ssh_keys.md b/data_dictionaries/windows/osquery/events/user_ssh_keys.md new file mode 100644 index 000000000..3629444fc --- /dev/null +++ b/data_dictionaries/windows/osquery/events/user_ssh_keys.md @@ -0,0 +1,17 @@ +# User_ssh_keys Table + +## Description +Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|The local user that owns the key file|`TBD`| +|TBD|path|TEXT|Path to key file|`TBD`| +|TBD|encrypted|INTEGER|1 if key is encrypted, 0 otherwise|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#user_ssh_keys) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/users.md b/data_dictionaries/windows/osquery/events/users.md new file mode 100644 index 000000000..e67c033ca --- /dev/null +++ b/data_dictionaries/windows/osquery/events/users.md @@ -0,0 +1,25 @@ +# Users Table + +## Description +Local user accounts (including domain accounts that have logged on locally (Windows)). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|uid|BIGINT|User ID|`TBD`| +|TBD|gid|BIGINT|Group ID (unsigned)|`TBD`| +|TBD|uid_signed|BIGINT|User ID as int64 signed (Apple)|`TBD`| +|TBD|gid_signed|BIGINT|Default group ID as int64 signed (Apple)|`TBD`| +|TBD|username|TEXT|Username|`TBD`| +|TBD|description|TEXT|Optional user description|`TBD`| +|TBD|directory|TEXT|User's home directory|`TBD`| +|TBD|shell|TEXT|User's configured default shell|`TBD`| +|TBD|uuid|TEXT|User's UUID (Apple) or SID (Windows)|`TBD`| +|TBD|type|TEXT|Whether the account is roaming (domain), local, or a system profile [WINDOWS]|`TBD`| +|TBD|is_hidden|INTEGER|IsHidden attribute set in OpenDirectory [DARWIN]|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#users) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/video_info.md b/data_dictionaries/windows/osquery/events/video_info.md new file mode 100644 index 000000000..9f1227725 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/video_info.md @@ -0,0 +1,22 @@ +# Video_info Table + +## Description +Retrieve video card information of the machine. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|color_depth|INTEGER|The amount of bits per pixel to represent color.|`TBD`| +|TBD|driver|TEXT|The driver of the device.|`TBD`| +|TBD|driver_date|TEXT|The date listed on the installed driver.|`TBD`| +|TBD|driver_version|TEXT|The version of the installed driver.|`TBD`| +|TBD|manufacturer|TEXT|The manufaturer of the gpu.|`TBD`| +|TBD|model|TEXT|The model of the gpu.|`TBD`| +|TBD|series|TEXT|The series of the gpu.|`TBD`| +|TBD|video_mode|TEXT|The current resolution of the display.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#video_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/winbaseobj.md b/data_dictionaries/windows/osquery/events/winbaseobj.md new file mode 100644 index 000000000..d277f5e40 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/winbaseobj.md @@ -0,0 +1,17 @@ +# Winbaseobj Table + +## Description +Lists named Windows objects in the default object directories, across all terminal services sessions. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|session_id|INTEGER|Terminal Services Session Id|`TBD`| +|TBD|object_name|TEXT|Object Name|`TBD`| +|TBD|object_type|TEXT|Object Type|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#winbaseobj) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/windows_crashes.md b/data_dictionaries/windows/osquery/events/windows_crashes.md new file mode 100644 index 000000000..7160c63ed --- /dev/null +++ b/data_dictionaries/windows/osquery/events/windows_crashes.md @@ -0,0 +1,35 @@ +# Windows_crashes Table + +## Description +Extracted information from Windows crash logs (Minidumps). + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|datetime|TEXT|Timestamp (log format) of the crash|`TBD`| +|TBD|module|TEXT|Path of the crashed module within the process|`TBD`| +|TBD|path|TEXT|Path of the executable file for the crashed process|`TBD`| +|TBD|pid|BIGINT|Process ID of the crashed process|`TBD`| +|TBD|tid|BIGINT|Thread ID of the crashed thread|`TBD`| +|TBD|version|TEXT|File version info of the crashed process|`TBD`| +|TBD|process_uptime|BIGINT|Uptime of the process in seconds|`TBD`| +|TBD|stack_trace|TEXT|Multiple stack frames from the stack trace|`TBD`| +|TBD|exception_code|TEXT|The Windows exception code|`TBD`| +|TBD|exception_message|TEXT|The NTSTATUS error message associated with the exception code|`TBD`| +|TBD|exception_address|TEXT|Address (in hex) where the exception occurred|`TBD`| +|TBD|registers|TEXT|The values of the system registers|`TBD`| +|TBD|command_line|TEXT|Command-line string passed to the crashed process|`TBD`| +|TBD|current_directory|TEXT|Current working directory of the crashed process|`TBD`| +|TBD|username|TEXT|Username of the user who ran the crashed process|`TBD`| +|TBD|machine_name|TEXT|Name of the machine where the crash happened|`TBD`| +|TBD|major_version|INTEGER|Windows major version of the machine|`TBD`| +|TBD|minor_version|INTEGER|Windows minor version of the machine|`TBD`| +|TBD|build_number|INTEGER|Windows build number of the crashing machine|`TBD`| +|TBD|type|TEXT|Type of crash log|`TBD`| +|TBD|crash_path|TEXT|Path of the log file|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#windows_crashes) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/windows_events.md b/data_dictionaries/windows/osquery/events/windows_events.md new file mode 100644 index 000000000..299fdf52e --- /dev/null +++ b/data_dictionaries/windows/osquery/events/windows_events.md @@ -0,0 +1,25 @@ +# Windows_events Table + +## Description +Windows Event logs. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|time|BIGINT|Timestamp the event was received|`TBD`| +|TBD|datetime|TEXT|System time at which the event occurred|`TBD`| +|TBD|source|TEXT|Source or channel of the event|`TBD`| +|TBD|provider_name|TEXT|Provider name of the event|`TBD`| +|TBD|provider_guid|TEXT|Provider guid of the event|`TBD`| +|TBD|eventid|INTEGER|Event ID of the event|`TBD`| +|TBD|task|INTEGER|Task value associated with the event|`TBD`| +|TBD|level|INTEGER|The severity level associated with the event|`TBD`| +|TBD|keywords|BIGINT|A bitmask of the keywords defined in the event|`TBD`| +|TBD|data|TEXT|Data associated with the event|`TBD`| +|TBD|eid|TEXT|Event ID|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#windows_events) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/windows_optional_features.md b/data_dictionaries/windows/osquery/events/windows_optional_features.md new file mode 100644 index 000000000..b55649d57 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/windows_optional_features.md @@ -0,0 +1,18 @@ +# Windows_optional_features Table + +## Description +Lists names and installation states of windows features. Maps to Win32_OptionalFeature WMI class. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Name of the feature|`TBD`| +|TBD|caption|TEXT|Caption of feature in settings UI|`TBD`| +|TBD|state|INTEGER|Installation state value. 1 == Enabled, 2 == Disabled, 3 == Absent|`TBD`| +|TBD|statename|TEXT|Installation state name. 'Enabled','Disabled','Absent'|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#windows_optional_features) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/windows_security_products.md b/data_dictionaries/windows/osquery/events/windows_security_products.md new file mode 100644 index 000000000..421e6f4b5 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/windows_security_products.md @@ -0,0 +1,20 @@ +# Windows_security_products Table + +## Description +Enumeration of registered Windows security products. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|type|TEXT|Type of security product|`TBD`| +|TBD|name|TEXT|Name of product|`TBD`| +|TBD|state|TEXT|State of protection|`TBD`| +|TBD|state_timestamp|TEXT|Timestamp for the product state|`TBD`| +|TBD|remediation_path|TEXT|Remediation path|`TBD`| +|TBD|signatures_up_to_date|INTEGER|1 if product signatures are up to date, else 0|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#windows_security_products) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/wmi_bios_info.md b/data_dictionaries/windows/osquery/events/wmi_bios_info.md new file mode 100644 index 000000000..f57ebcc2c --- /dev/null +++ b/data_dictionaries/windows/osquery/events/wmi_bios_info.md @@ -0,0 +1,16 @@ +# Wmi_bios_info Table + +## Description +Lists important information from the system bios. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Name of the Bios setting|`TBD`| +|TBD|value|TEXT|Value of the Bios setting|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#wmi_bios_info) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/wmi_cli_event_consumers.md b/data_dictionaries/windows/osquery/events/wmi_cli_event_consumers.md new file mode 100644 index 000000000..16b07fe16 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/wmi_cli_event_consumers.md @@ -0,0 +1,19 @@ +# Wmi_cli_event_consumers Table + +## Description +WMI CommandLineEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Unique name of a consumer.|`TBD`| +|TBD|command_line_template|TEXT|Standard string template that specifies the process to be started. This property can be NULL, and the ExecutablePath property is used as the command line.|`TBD`| +|TBD|executable_path|TEXT|Module to execute. The string can specify the full path and file name of the module to execute, or it can specify a partial name. If a partial name is specified, the current drive and current directory are assumed.|`TBD`| +|TBD|class|TEXT|The name of the class.|`TBD`| +|TBD|relative_path|TEXT|Relative path to the class or instance.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#wmi_cli_event_consumers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/wmi_event_filters.md b/data_dictionaries/windows/osquery/events/wmi_event_filters.md new file mode 100644 index 000000000..075e8d7b5 --- /dev/null +++ b/data_dictionaries/windows/osquery/events/wmi_event_filters.md @@ -0,0 +1,19 @@ +# Wmi_event_filters Table + +## Description +Lists WMI event filters. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Unique identifier of an event filter.|`TBD`| +|TBD|query|TEXT|Windows Management Instrumentation Query Language (WQL) event query that specifies the set of events for consumer notification, and the specific conditions for notification.|`TBD`| +|TBD|query_language|TEXT|Query language that the query is written in.|`TBD`| +|TBD|class|TEXT|The name of the class.|`TBD`| +|TBD|relative_path|TEXT|Relative path to the class or instance.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#wmi_event_filters) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/wmi_filter_consumer_binding.md b/data_dictionaries/windows/osquery/events/wmi_filter_consumer_binding.md new file mode 100644 index 000000000..6f0223bdb --- /dev/null +++ b/data_dictionaries/windows/osquery/events/wmi_filter_consumer_binding.md @@ -0,0 +1,18 @@ +# Wmi_filter_consumer_binding Table + +## Description +Lists the relationship between event consumers and filters. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|consumer|TEXT|Reference to an instance of __EventConsumer that represents the object path to a logical consumer, the recipient of an event.|`TBD`| +|TBD|filter|TEXT|Reference to an instance of __EventFilter that represents the object path to an event filter which is a query that specifies the type of event to be received.|`TBD`| +|TBD|class|TEXT|The name of the class.|`TBD`| +|TBD|relative_path|TEXT|Relative path to the class or instance.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#wmi_filter_consumer_binding) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/data_dictionaries/windows/osquery/events/wmi_script_event_consumers.md b/data_dictionaries/windows/osquery/events/wmi_script_event_consumers.md new file mode 100644 index 000000000..37ebb32bf --- /dev/null +++ b/data_dictionaries/windows/osquery/events/wmi_script_event_consumers.md @@ -0,0 +1,20 @@ +# Wmi_script_event_consumers Table + +## Description +WMI ActiveScriptEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details. + +## Data Dictionary +|Standard Name|Field Name|Type|Description|Sample Value| +|---|---|---|---|---| +|TBD|name|TEXT|Unique identifier for the event consumer. |`TBD`| +|TBD|scripting_engine|TEXT|Name of the scripting engine to use, for example, 'VBScript'. This property cannot be NULL.|`TBD`| +|TBD|script_file_name|TEXT|Name of the file from which the script text is read, intended as an alternative to specifying the text of the script in the ScriptText property.|`TBD`| +|TBD|script_text|TEXT|Text of the script that is expressed in a language known to the scripting engine. This property must be NULL if the ScriptFileName property is not NULL.|`TBD`| +|TBD|class|TEXT|The name of the class.|`TBD`| +|TBD|relative_path|TEXT|Relative path to the class or instance.|`TBD`| + +## References +* [OSQuery table documentation](https://osquery.io/schema/current#wmi_script_event_consumers) + +## Tags +* version_4.4.2 \ No newline at end of file diff --git a/source/data_dictionaries/freebsd/README.yml b/source/data_dictionaries/freebsd/README.yml new file mode 100644 index 000000000..5f20d758a --- /dev/null +++ b/source/data_dictionaries/freebsd/README.yml @@ -0,0 +1,4 @@ +title: FreeBSD +description: Data dictionaries for FreeBSD based events. +images: [] +references: [] diff --git a/source/data_dictionaries/freebsd/osquery/README.yml b/source/data_dictionaries/freebsd/osquery/README.yml new file mode 100644 index 000000000..201665371 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/README.yml @@ -0,0 +1,8 @@ +title: FreeBSD Osquery Event Logs +description: Osquery schema is defined in tables by osquery engineers. +images: [] +references: +- text: osquery schema 4.1.2 (website) + link: https://osquery.io/schema/4.1.2 +- text: osquery schema linux specs (GitHub) + link: https://github.com/facebook/osquery/tree/master/specs/windows diff --git a/source/data_dictionaries/freebsd/osquery/events/apt_sources.yml b/source/data_dictionaries/freebsd/osquery/events/apt_sources.yml new file mode 100644 index 000000000..44961e7eb --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/apt_sources.yml @@ -0,0 +1,59 @@ +title: Apt_sources Table +description: Current list of APT repositories or software channels. +platform: freebsd +log_source: osquery +event_code: apt_sources +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Repository name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: base_uri + type: TEXT + description: Repository base URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: release + type: TEXT + description: Release name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Repository source version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: maintainer + type: TEXT + description: Repository maintainer + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: components + type: TEXT + description: Repository components + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: architectures + type: TEXT + description: Repository architectures + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#apt_sources +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/augeas.yml b/source/data_dictionaries/freebsd/osquery/events/augeas.yml new file mode 100644 index 000000000..9e5becfed --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/augeas.yml @@ -0,0 +1,35 @@ +title: Augeas Table +description: Configuration files parsed by augeas. +platform: freebsd +log_source: osquery +event_code: augeas +event_fields: +- standard_name: TBD + standard_type: TBD + name: node + type: TEXT + description: The node path of the configuration item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: The value of the configuration item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: The label of the configuration item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path to the configuration file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#augeas +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/authorized_keys.yml b/source/data_dictionaries/freebsd/osquery/events/authorized_keys.yml new file mode 100644 index 000000000..5234a2965 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/authorized_keys.yml @@ -0,0 +1,29 @@ +title: Authorized_keys Table +description: A line-delimited authorized_keys table. +platform: freebsd +log_source: osquery +event_code: authorized_keys +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local owner of authorized_keys file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: parsed authorized keys line + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_file + type: TEXT + description: Path to the authorized_keys file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#authorized_keys +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/azure_instance_metadata.yml b/source/data_dictionaries/freebsd/osquery/events/azure_instance_metadata.yml new file mode 100644 index 000000000..756652580 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/azure_instance_metadata.yml @@ -0,0 +1,107 @@ +title: Azure_instance_metadata Table +description: Azure instance metadata. +platform: freebsd +log_source: osquery +event_code: azure_instance_metadata +event_fields: +- standard_name: TBD + standard_type: TBD + name: location + type: TEXT + description: Azure Region the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offer + type: TEXT + description: Offer information for the VM image (Azure image gallery VMs only) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: publisher + type: TEXT + description: Publisher of the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sku + type: TEXT + description: SKU for the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Version of the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os_type + type: TEXT + description: Linux or Windows + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_update_domain + type: TEXT + description: Update domain the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_fault_domain + type: TEXT + description: Fault domain the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_id + type: TEXT + description: Unique identifier for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_size + type: TEXT + description: VM size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subscription_id + type: TEXT + description: Azure subscription for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resource_group_name + type: TEXT + description: Resource group for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: placement_group_id + type: TEXT + description: Placement group for the VM scale set + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_scale_set_name + type: TEXT + description: VM scale set name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: zone + type: TEXT + description: Availability zone of the VM + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#azure_instance_metadata +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/azure_instance_tags.yml b/source/data_dictionaries/freebsd/osquery/events/azure_instance_tags.yml new file mode 100644 index 000000000..3d6eb55df --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/azure_instance_tags.yml @@ -0,0 +1,29 @@ +title: Azure_instance_tags Table +description: Azure instance tags. +platform: freebsd +log_source: osquery +event_code: azure_instance_tags +event_fields: +- standard_name: TBD + standard_type: TBD + name: vm_id + type: TEXT + description: Unique identifier for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: The tag key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: The tag value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#azure_instance_tags +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/carbon_black_info.yml b/source/data_dictionaries/freebsd/osquery/events/carbon_black_info.yml new file mode 100644 index 000000000..df03ac1de --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/carbon_black_info.yml @@ -0,0 +1,138 @@ +title: Carbon_black_info Table +description: Returns info about a Carbon Black sensor install. +platform: freebsd +log_source: osquery +event_code: carbon_black_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: sensor_id + type: INTEGER + description: Sensor ID of the Carbon Black sensor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_name + type: TEXT + description: Sensor group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_store_files + type: INTEGER + description: If the sensor is configured to send back binaries to the Carbon Black + server + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_module_loads + type: INTEGER + description: If the sensor is configured to capture module loads + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_module_info + type: INTEGER + description: If the sensor is configured to collect metadata of binaries + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_file_mods + type: INTEGER + description: If the sensor is configured to collect file modification events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_reg_mods + type: INTEGER + description: If the sensor is configured to collect registry modification events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_net_conns + type: INTEGER + description: If the sensor is configured to collect network connections + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_processes + type: INTEGER + description: If the sensor is configured to process events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_cross_processes + type: INTEGER + description: If the sensor is configured to cross process events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_emet_events + type: INTEGER + description: If the sensor is configured to EMET events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_data_file_writes + type: INTEGER + description: If the sensor is configured to collect non binary file writes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_process_user_context + type: INTEGER + description: If the sensor is configured to collect the user running a process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_sensor_operations + type: INTEGER + description: Unknown + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: log_file_disk_quota_mb + type: INTEGER + description: Event file disk quota in MB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: log_file_disk_quota_percentage + type: INTEGER + description: Event file disk quota in a percentage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protection_disabled + type: INTEGER + description: If the sensor is configured to report tamper events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sensor_ip_addr + type: TEXT + description: IP address of the sensor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sensor_backend_server + type: TEXT + description: Carbon Black server + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: event_queue + type: INTEGER + description: Size in bytes of Carbon Black event files on disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: binary_queue + type: INTEGER + description: Size in bytes of binaries waiting to be sent to Carbon Black server + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#carbon_black_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/carves.yml b/source/data_dictionaries/freebsd/osquery/events/carves.yml new file mode 100644 index 000000000..518337958 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/carves.yml @@ -0,0 +1,53 @@ +title: Carves Table +description: Forensic Carves. +platform: freebsd +log_source: osquery +event_code: carves +event_fields: +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time at which the carve was kicked off + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: A SHA256 sum of the carved archive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of the carved archive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path of the requested carve + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: carve_guid + type: TEXT + description: Identifying value of the carve session + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: carve + type: INTEGER + description: Set this value to '1' to start a file carve + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#carves +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/chrome_extensions.yml b/source/data_dictionaries/freebsd/osquery/events/chrome_extensions.yml new file mode 100644 index 000000000..5c4800b35 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/chrome_extensions.yml @@ -0,0 +1,83 @@ +title: Chrome_extensions Table +description: Chrome browser extensions. +platform: freebsd +log_source: osquery +event_code: chrome_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: profile + type: TEXT + description: The Chrome profile that contains this extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Extension identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Extension-optional description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: locale + type: TEXT + description: Default locale supported by extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: update_url + type: TEXT + description: Extension-supplied update URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional extension author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to extension folder + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: The permissions required by the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: optional_permissions + type: TEXT + description: The permissions optionally required by the extensions + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#chrome_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/cpu_time.yml b/source/data_dictionaries/freebsd/osquery/events/cpu_time.yml new file mode 100644 index 000000000..7f1e06f56 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/cpu_time.yml @@ -0,0 +1,80 @@ +title: Cpu_time Table +description: Displays information from /proc/stat file about the time the cpu cores + spent in different parts of the system. +platform: freebsd +log_source: osquery +event_code: cpu_time +event_fields: +- standard_name: TBD + standard_type: TBD + name: core + type: INTEGER + description: Name of the cpu (core) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: BIGINT + description: Time spent in user mode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: nice + type: BIGINT + description: Time spent in user mode with low priority (nice) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system + type: BIGINT + description: Time spent in system mode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: idle + type: BIGINT + description: Time spent in the idle task + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: iowait + type: BIGINT + description: Time spent waiting for I/O to complete + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: irq + type: BIGINT + description: Time spent servicing interrupts + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: softirq + type: BIGINT + description: Time spent servicing softirqs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: steal + type: BIGINT + description: Time spent in other operating systems when running in a virtualized + environment + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: guest + type: BIGINT + description: Time spent running a virtual CPU for a guest OS under the control of + the Linux kernel + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: guest_nice + type: BIGINT + description: 'Time spent running a niced guest ' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#cpu_time +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/cpuid.yml b/source/data_dictionaries/freebsd/osquery/events/cpuid.yml new file mode 100644 index 000000000..86b05fe7e --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/cpuid.yml @@ -0,0 +1,41 @@ +title: Cpuid Table +description: Useful CPU features from the cpuid ASM call. +platform: freebsd +log_source: osquery +event_code: cpuid +event_fields: +- standard_name: TBD + standard_type: TBD + name: feature + type: TEXT + description: Present feature flags + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Bit value or string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: output_register + type: TEXT + description: Register used to for feature value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: output_bit + type: INTEGER + description: Bit in register value for feature value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: input_eax + type: TEXT + description: Value of EAX used + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#cpuid +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/crontab.yml b/source/data_dictionaries/freebsd/osquery/events/crontab.yml new file mode 100644 index 000000000..a32988949 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/crontab.yml @@ -0,0 +1,59 @@ +title: Crontab Table +description: Line parsed values from system and user cron/tab. +platform: freebsd +log_source: osquery +event_code: crontab +event_fields: +- standard_name: TBD + standard_type: TBD + name: event + type: TEXT + description: The job @event name (rare) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minute + type: TEXT + description: The exact minute for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hour + type: TEXT + description: The hour of the day for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: day_of_month + type: TEXT + description: The day of the month for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: month + type: TEXT + description: The month of the year for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: day_of_week + type: TEXT + description: The day of the week for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command + type: TEXT + description: Raw command string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: File parsed + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#crontab +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/curl.yml b/source/data_dictionaries/freebsd/osquery/events/curl.yml new file mode 100644 index 000000000..be6980458 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/curl.yml @@ -0,0 +1,53 @@ +title: Curl Table +description: Perform an http request and return stats about it. +platform: freebsd +log_source: osquery +event_code: curl +event_fields: +- standard_name: TBD + standard_type: TBD + name: url + type: TEXT + description: The url for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: method + type: TEXT + description: The HTTP method for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_agent + type: TEXT + description: The user-agent string to use for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: response_code + type: INTEGER + description: The HTTP status code for the response + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: round_trip_time + type: BIGINT + description: Time taken to complete the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bytes + type: BIGINT + description: Number of bytes in the response + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: result + type: TEXT + description: The HTTP response body + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#curl +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/curl_certificate.yml b/source/data_dictionaries/freebsd/osquery/events/curl_certificate.yml new file mode 100644 index 000000000..4588af94a --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/curl_certificate.yml @@ -0,0 +1,83 @@ +title: Curl_certificate Table +description: Inspect TLS certificates by connecting to input hostnames. +platform: freebsd +log_source: osquery +event_code: curl_certificate +event_fields: +- standard_name: TBD + standard_type: TBD + name: hostname + type: TEXT + description: Hostname (domain[:port]) to CURL + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: common_name + type: TEXT + description: Common name of company issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: organization + type: TEXT + description: Organization issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: organization_unit + type: TEXT + description: Organization unit issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial_number + type: TEXT + description: Certificate serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_common_name + type: TEXT + description: Issuer common name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_organization + type: TEXT + description: Issuer organization + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_organization_unit + type: TEXT + description: Issuer organization unit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: valid_from + type: TEXT + description: Period of validity start date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: valid_to + type: TEXT + description: Period of validity end date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256_fingerprint + type: TEXT + description: SHA-256 fingerprint + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1_fingerprint + type: TEXT + description: SHA1 fingerprint + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#curl_certificate +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/device_file.yml b/source/data_dictionaries/freebsd/osquery/events/device_file.yml new file mode 100644 index 000000000..d19fdffe4 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/device_file.yml @@ -0,0 +1,101 @@ +title: Device_file Table +description: Similar to the file table, but use TSK and allow block address access. +platform: freebsd +log_source: osquery +event_code: device_file +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Absolute file path to device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partition + type: TEXT + description: A partition number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: A logical path within the device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: filename + type: TEXT + description: Name portion of file path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: BIGINT + description: Filesystem inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Owning user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Owning group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: Permission bits + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Size of file in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: block_size + type: INTEGER + description: Block size of filesystem + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: atime + type: BIGINT + description: Last access time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: BIGINT + description: Last modification time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ctime + type: BIGINT + description: Creation time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hard_links + type: INTEGER + description: Number of hard links + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: File status + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#device_file +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/device_hash.yml b/source/data_dictionaries/freebsd/osquery/events/device_hash.yml new file mode 100644 index 000000000..4e866c23c --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/device_hash.yml @@ -0,0 +1,47 @@ +title: Device_hash Table +description: Similar to the hash table, but use TSK and allow block address access. +platform: freebsd +log_source: osquery +event_code: device_hash +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Absolute file path to device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partition + type: TEXT + description: A partition number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: BIGINT + description: Filesystem inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: MD5 hash of provided inode data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: SHA1 hash of provided inode data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: SHA256 hash of provided inode data + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#device_hash +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/device_partitions.yml b/source/data_dictionaries/freebsd/osquery/events/device_partitions.yml new file mode 100644 index 000000000..00510eb0f --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/device_partitions.yml @@ -0,0 +1,65 @@ +title: Device_partitions Table +description: Use TSK to enumerate details about partitions on a disk device. +platform: freebsd +log_source: osquery +event_code: device_partitions +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Absolute file path to device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partition + type: INTEGER + description: A partition number or description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offset + type: BIGINT + description: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_size + type: BIGINT + description: Byte size of each block + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks + type: BIGINT + description: Number of blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inodes + type: BIGINT + description: Number of meta nodes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: '' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#device_partitions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/dns_resolvers.yml b/source/data_dictionaries/freebsd/osquery/events/dns_resolvers.yml new file mode 100644 index 000000000..cb5998035 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/dns_resolvers.yml @@ -0,0 +1,41 @@ +title: Dns_resolvers Table +description: Resolvers used by this host. +platform: freebsd +log_source: osquery +event_code: dns_resolvers +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: INTEGER + description: Address type index or order + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: 'Address type: sortlist, nameserver, search' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Resolver IP/IPv6 address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: netmask + type: TEXT + description: Address (sortlist) netmask length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: options + type: BIGINT + description: Resolver options + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#dns_resolvers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_container_labels.yml b/source/data_dictionaries/freebsd/osquery/events/docker_container_labels.yml new file mode 100644 index 000000000..91470f9c8 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_container_labels.yml @@ -0,0 +1,29 @@ +title: Docker_container_labels Table +description: Docker container labels. +platform: freebsd +log_source: osquery +event_code: docker_container_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_container_mounts.yml b/source/data_dictionaries/freebsd/osquery/events/docker_container_mounts.yml new file mode 100644 index 000000000..4958c01db --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_container_mounts.yml @@ -0,0 +1,65 @@ +title: Docker_container_mounts Table +description: Docker container mounts. +platform: freebsd +log_source: osquery +event_code: docker_container_mounts +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of mount (bind, volume) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Optional mount name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source path on host + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: destination + type: TEXT + description: Destination path inside container + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Driver providing the mount + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: Mount options (rw, ro) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rw + type: INTEGER + description: 1 if read/write. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: propagation + type: TEXT + description: Mount propagation + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_mounts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_container_networks.yml b/source/data_dictionaries/freebsd/osquery/events/docker_container_networks.yml new file mode 100644 index 000000000..ed5dded0b --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_container_networks.yml @@ -0,0 +1,77 @@ +title: Docker_container_networks Table +description: Docker container networks. +platform: freebsd +log_source: osquery +event_code: docker_container_networks +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Network name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_id + type: TEXT + description: Network ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: endpoint_id + type: TEXT + description: Endpoint ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gateway + type: TEXT + description: Gateway + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ip_address + type: TEXT + description: IP address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ip_prefix_len + type: INTEGER + description: IP subnet prefix length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_gateway + type: TEXT + description: IPv6 gateway + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_address + type: TEXT + description: IPv6 address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_prefix_len + type: INTEGER + description: IPv6 subnet prefix length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac_address + type: TEXT + description: MAC address + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_networks +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_container_ports.yml b/source/data_dictionaries/freebsd/osquery/events/docker_container_ports.yml new file mode 100644 index 000000000..ef8806a3b --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_container_ports.yml @@ -0,0 +1,41 @@ +title: Docker_container_ports Table +description: Docker container ports. +platform: freebsd +log_source: osquery +event_code: docker_container_ports +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Protocol (tcp, udp) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Port inside the container + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host_ip + type: TEXT + description: Host IP address on which public port is listening + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host_port + type: INTEGER + description: Host port + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_ports +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_container_processes.yml b/source/data_dictionaries/freebsd/osquery/events/docker_container_processes.yml new file mode 100644 index 000000000..591224614 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_container_processes.yml @@ -0,0 +1,143 @@ +title: Docker_container_processes Table +description: Docker container processes. +platform: freebsd +log_source: osquery +event_code: docker_container_processes +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The process path or shorthand argv[0] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline + type: TEXT + description: Complete argv + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: Process state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: BIGINT + description: Effective user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: BIGINT + description: Effective group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: suid + type: BIGINT + description: Saved user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sgid + type: BIGINT + description: Saved group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wired_size + type: BIGINT + description: Bytes of unpagable memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resident_size + type: BIGINT + description: Bytes of private memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_size + type: BIGINT + description: Total virtual memory size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Process parent's PID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pgroup + type: BIGINT + description: Process group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: threads + type: INTEGER + description: Number of threads used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: nice + type: INTEGER + description: Process nice level (-20 to 20, default 0) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: TEXT + description: User name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: TEXT + description: Cumulative CPU time. [DD-]HH:MM:SS format + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu + type: DOUBLE + description: CPU utilization as percentage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mem + type: DOUBLE + description: Memory utilization as percentage + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_processes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_container_stats.yml b/source/data_dictionaries/freebsd/osquery/events/docker_container_stats.yml new file mode 100644 index 000000000..9c5689eaf --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_container_stats.yml @@ -0,0 +1,156 @@ +title: Docker_container_stats Table +description: Docker container statistics. Queries on this table take at least one + second. +platform: freebsd +log_source: osquery +event_code: docker_container_stats +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Container name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pids + type: INTEGER + description: Number of processes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: read + type: BIGINT + description: UNIX time when stats were read + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: preread + type: BIGINT + description: UNIX time when stats were last read + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: interval + type: BIGINT + description: Difference between read and preread in nano-seconds + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_read + type: BIGINT + description: Total disk read bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_write + type: BIGINT + description: Total disk write bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: num_procs + type: INTEGER + description: Number of processors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_total_usage + type: BIGINT + description: Total CPU usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_kernelmode_usage + type: BIGINT + description: CPU kernel mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_usermode_usage + type: BIGINT + description: CPU user mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_cpu_usage + type: BIGINT + description: CPU system usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: online_cpus + type: INTEGER + description: Online CPUs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_cpu_total_usage + type: BIGINT + description: Last read total CPU usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_cpu_kernelmode_usage + type: BIGINT + description: Last read CPU kernel mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_cpu_usermode_usage + type: BIGINT + description: Last read CPU user mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_system_cpu_usage + type: BIGINT + description: Last read CPU system usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_online_cpus + type: INTEGER + description: Last read online CPUs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_usage + type: BIGINT + description: Memory usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_max_usage + type: BIGINT + description: Memory maximum usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_limit + type: BIGINT + description: Memory limit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_rx_bytes + type: BIGINT + description: Total network bytes read + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_tx_bytes + type: BIGINT + description: Total network bytes transmitted + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_stats +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_containers.yml b/source/data_dictionaries/freebsd/osquery/events/docker_containers.yml new file mode 100644 index 000000000..68748722c --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_containers.yml @@ -0,0 +1,156 @@ +title: Docker_containers Table +description: Docker containers information. +platform: freebsd +log_source: osquery +event_code: docker_containers +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Container name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: image + type: TEXT + description: Docker image (name) used to launch this container + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: image_id + type: TEXT + description: Docker image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command + type: TEXT + description: Command with arguments + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: BIGINT + description: Time of creation as UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: Container state (created, restarting, running, removing, paused, exited, + dead) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Container status information + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Identifier of the initial process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Container path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_entrypoint + type: TEXT + description: Container entrypoint(s) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: started_at + type: TEXT + description: Container start time as string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: finished_at + type: TEXT + description: Container finish time as string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: privileged + type: INTEGER + description: Is the container privileged + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: security_options + type: TEXT + description: List of container security options + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env_variables + type: TEXT + description: Container environmental variables + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: readonly_rootfs + type: INTEGER + description: Is the root filesystem mounted as read only + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cgroup_namespace + type: TEXT + description: cgroup namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipc_namespace + type: TEXT + description: IPC namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mnt_namespace + type: TEXT + description: Mount namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: Network namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid_namespace + type: TEXT + description: PID namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_namespace + type: TEXT + description: User namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uts_namespace + type: TEXT + description: UTS namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_containers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_image_labels.yml b/source/data_dictionaries/freebsd/osquery/events/docker_image_labels.yml new file mode 100644 index 000000000..9134ae114 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_image_labels.yml @@ -0,0 +1,29 @@ +title: Docker_image_labels Table +description: Docker image labels. +platform: freebsd +log_source: osquery +event_code: docker_image_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_image_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_image_layers.yml b/source/data_dictionaries/freebsd/osquery/events/docker_image_layers.yml new file mode 100644 index 000000000..d5c7d17d8 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_image_layers.yml @@ -0,0 +1,29 @@ +title: Docker_image_layers Table +description: Docker image layers information. +platform: freebsd +log_source: osquery +event_code: docker_image_layers +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: layer_id + type: TEXT + description: Layer ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: layer_order + type: INTEGER + description: Layer Order (1 = base layer) + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_image_layers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_images.yml b/source/data_dictionaries/freebsd/osquery/events/docker_images.yml new file mode 100644 index 000000000..d877bf88b --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_images.yml @@ -0,0 +1,35 @@ +title: Docker_images Table +description: Docker images information. +platform: freebsd +log_source: osquery +event_code: docker_images +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: BIGINT + description: Time of creation as UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size_bytes + type: BIGINT + description: Size of image in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tags + type: TEXT + description: Comma-separated list of repository tags + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_images +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_info.yml b/source/data_dictionaries/freebsd/osquery/events/docker_info.yml new file mode 100644 index 000000000..bd9eab5f4 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_info.yml @@ -0,0 +1,206 @@ +title: Docker_info Table +description: Docker system information. +platform: freebsd +log_source: osquery +event_code: docker_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Docker system ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers + type: INTEGER + description: Total number of containers + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers_running + type: INTEGER + description: Number of containers currently running + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers_paused + type: INTEGER + description: Number of containers in paused state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers_stopped + type: INTEGER + description: Number of containers in stopped state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: images + type: INTEGER + description: Number of images + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: storage_driver + type: TEXT + description: Storage driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_limit + type: INTEGER + description: 1 if memory limit support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: swap_limit + type: INTEGER + description: 1 if swap limit support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kernel_memory + type: INTEGER + description: 1 if kernel memory limit support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_cfs_period + type: INTEGER + description: 1 if CPU Completely Fair Scheduler (CFS) period support is enabled. + 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_cfs_quota + type: INTEGER + description: 1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. + 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_shares + type: INTEGER + description: 1 if CPU share weighting support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_set + type: INTEGER + description: 1 if CPU set selection support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv4_forwarding + type: INTEGER + description: 1 if IPv4 forwarding is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bridge_nf_iptables + type: INTEGER + description: 1 if bridge netfilter iptables is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bridge_nf_ip6tables + type: INTEGER + description: 1 if bridge netfilter ip6tables is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: oom_kill_disable + type: INTEGER + description: 1 if Out-of-memory kill is disabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logging_driver + type: TEXT + description: Logging driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cgroup_driver + type: TEXT + description: Control groups driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kernel_version + type: TEXT + description: Kernel version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os + type: TEXT + description: Operating system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os_type + type: TEXT + description: Operating system type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: architecture + type: TEXT + description: Hardware architecture + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpus + type: INTEGER + description: Number of CPUs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory + type: BIGINT + description: Total memory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: http_proxy + type: TEXT + description: HTTP proxy + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: https_proxy + type: TEXT + description: HTTPS proxy + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: no_proxy + type: TEXT + description: Comma-separated list of domain extensions proxy should not be used + for + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the docker host + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: server_version + type: TEXT + description: Server version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: root_dir + type: TEXT + description: Docker root directory + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_network_labels.yml b/source/data_dictionaries/freebsd/osquery/events/docker_network_labels.yml new file mode 100644 index 000000000..8f746c6b0 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_network_labels.yml @@ -0,0 +1,29 @@ +title: Docker_network_labels Table +description: Docker network labels. +platform: freebsd +log_source: osquery +event_code: docker_network_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Network ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_network_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_networks.yml b/source/data_dictionaries/freebsd/osquery/events/docker_networks.yml new file mode 100644 index 000000000..7dfc0c8be --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_networks.yml @@ -0,0 +1,53 @@ +title: Docker_networks Table +description: Docker networks information. +platform: freebsd +log_source: osquery +event_code: docker_networks +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Network ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Network name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Network driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: BIGINT + description: Time of creation as UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enable_ipv6 + type: INTEGER + description: 1 if IPv6 is enabled on this network. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subnet + type: TEXT + description: Network subnet + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gateway + type: TEXT + description: Network gateway + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_networks +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_version.yml b/source/data_dictionaries/freebsd/osquery/events/docker_version.yml new file mode 100644 index 000000000..f252bc0f1 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_version.yml @@ -0,0 +1,65 @@ +title: Docker_version Table +description: Docker version information. +platform: freebsd +log_source: osquery +event_code: docker_version +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Docker version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: api_version + type: TEXT + description: API version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: min_api_version + type: TEXT + description: Minimum API version supported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: git_commit + type: TEXT + description: Docker build git commit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: go_version + type: TEXT + description: Go version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os + type: TEXT + description: Operating system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: arch + type: TEXT + description: Hardware architecture + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kernel_version + type: TEXT + description: Kernel version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_time + type: TEXT + description: Build time + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_version +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_volume_labels.yml b/source/data_dictionaries/freebsd/osquery/events/docker_volume_labels.yml new file mode 100644 index 000000000..162238eb7 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_volume_labels.yml @@ -0,0 +1,29 @@ +title: Docker_volume_labels Table +description: Docker volume labels. +platform: freebsd +log_source: osquery +event_code: docker_volume_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Volume name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_volume_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/docker_volumes.yml b/source/data_dictionaries/freebsd/osquery/events/docker_volumes.yml new file mode 100644 index 000000000..ea7bba3fa --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/docker_volumes.yml @@ -0,0 +1,35 @@ +title: Docker_volumes Table +description: Docker volumes information. +platform: freebsd +log_source: osquery +event_code: docker_volumes +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Volume name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Volume driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mount_point + type: TEXT + description: Mount point + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Volume type + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_volumes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/etc_hosts.yml b/source/data_dictionaries/freebsd/osquery/events/etc_hosts.yml new file mode 100644 index 000000000..0b0386356 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/etc_hosts.yml @@ -0,0 +1,23 @@ +title: Etc_hosts Table +description: Line-parsed /etc/hosts. +platform: freebsd +log_source: osquery +event_code: etc_hosts +event_fields: +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: IP address mapping + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hostnames + type: TEXT + description: Raw hosts mapping + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_hosts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/etc_protocols.yml b/source/data_dictionaries/freebsd/osquery/events/etc_protocols.yml new file mode 100644 index 000000000..53b41810a --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/etc_protocols.yml @@ -0,0 +1,35 @@ +title: Etc_protocols Table +description: Line-parsed /etc/protocols. +platform: freebsd +log_source: osquery +event_code: etc_protocols +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Protocol name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: number + type: INTEGER + description: Protocol number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: alias + type: TEXT + description: Protocol alias + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Comment with protocol description + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_protocols +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/etc_services.yml b/source/data_dictionaries/freebsd/osquery/events/etc_services.yml new file mode 100644 index 000000000..b7c1664c9 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/etc_services.yml @@ -0,0 +1,41 @@ +title: Etc_services Table +description: Line-parsed /etc/services. +platform: freebsd +log_source: osquery +event_code: etc_services +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Service name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Service port number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: TEXT + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: aliases + type: TEXT + description: Optional space separated list of other names for a service + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Optional comment for a service. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_services +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/example.yml b/source/data_dictionaries/freebsd/osquery/events/example.yml new file mode 100644 index 000000000..d392ae352 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/example.yml @@ -0,0 +1,47 @@ +title: Example Table +description: This is an example table spec. +platform: freebsd +log_source: osquery +event_code: example +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Description for name column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: points + type: INTEGER + description: This is a signed SQLite int column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: This is a signed SQLite bigint column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Action performed in generation + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: id + type: INTEGER + description: An index of some sort + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of example + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#example +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/fbsd_kmods.yml b/source/data_dictionaries/freebsd/osquery/events/fbsd_kmods.yml new file mode 100644 index 000000000..6cc5f8047 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/fbsd_kmods.yml @@ -0,0 +1,35 @@ +title: Fbsd_kmods Table +description: Loaded FreeBSD kernel modules. +platform: freebsd +log_source: osquery +event_code: fbsd_kmods +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Module name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of module content + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: refs + type: INTEGER + description: Module reverse dependencies + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Kernel module address + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#fbsd_kmods +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/file.yml b/source/data_dictionaries/freebsd/osquery/events/file.yml new file mode 100644 index 000000000..20bb2ff01 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/file.yml @@ -0,0 +1,113 @@ +title: File Table +description: Interactive filesystem attributes and metadata. +platform: freebsd +log_source: osquery +event_code: file +event_fields: +- standard_name: file_path + standard_type: TBD + name: path + type: TEXT + description: Absolute file path + sample_value: file_directory +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: Directory of file(s) + sample_value: TBD +- standard_name: file_name + standard_type: TBD + name: filename + type: TEXT + description: Name portion of file path + sample_value: TBD +- standard_name: file_inode + standard_type: TBD + name: inode + type: BIGINT + description: Filesystem inode number + sample_value: TBD +- standard_name: user_uid + standard_type: TBD + name: uid + type: BIGINT + description: Owning user ID + sample_value: TBD +- standard_name: user_gid + standard_type: TBD + name: gid + type: BIGINT + description: Owning group ID + sample_value: TBD +- standard_name: user_permissions + standard_type: TBD + name: mode + type: TEXT + description: Permission bits + sample_value: TBD +- standard_name: device_id + standard_type: TBD + name: device + type: BIGINT + description: Device ID (optional) + sample_value: TBD +- standard_name: file_size + standard_type: TBD + name: size + type: BIGINT + description: Size of file in bytes + sample_value: TBD +- standard_name: file_system_block_size + standard_type: TBD + name: block_size + type: INTEGER + description: Block size of filesystem + sample_value: TBD +- standard_name: date_last_access + standard_type: TBD + name: atime + type: BIGINT + description: Last access time + sample_value: TBD +- standard_name: date_last_modification + standard_type: TBD + name: mtime + type: BIGINT + description: Last modification time + sample_value: TBD +- standard_name: date_last_status_change + standard_type: TBD + name: ctime + type: BIGINT + description: Last status change time + sample_value: TBD +- standard_name: date_creation_time + standard_type: TBD + name: btime + type: BIGINT + description: (B)irth or (cr)eate time + sample_value: TBD +- standard_name: file_hard_links + standard_type: TBD + name: hard_links + type: INTEGER + description: Number of hard links + sample_value: TBD +- standard_name: file_symlink + standard_type: TBD + name: symlink + type: INTEGER + description: 1 if the path is a symlink, otherwise 0 + sample_value: TBD +- standard_name: file_type + standard_type: TBD + name: type + type: TEXT + description: File status + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#file +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/firefox_addons.yml b/source/data_dictionaries/freebsd/osquery/events/firefox_addons.yml new file mode 100644 index 000000000..6b52a4669 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/firefox_addons.yml @@ -0,0 +1,83 @@ +title: Firefox_addons Table +description: Firefox browser extensions, webapps, and addons. +platform: freebsd +log_source: osquery +event_code: firefox_addons +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the addon + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Addon display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Addon identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: creator + type: TEXT + description: Addon-supported creator string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Extension, addon, webapp + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Addon-supplied version string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Addon-supplied description string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source_url + type: TEXT + description: URL that installed the addon + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: visible + type: INTEGER + description: 1 If the addon is shown in browser else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: 1 If the addon is active else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: location + type: TEXT + description: Global, profile location + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to plugin bundle + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#firefox_addons +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/groups.yml b/source/data_dictionaries/freebsd/osquery/events/groups.yml new file mode 100644 index 000000000..114df393c --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/groups.yml @@ -0,0 +1,47 @@ +title: Groups Table +description: Local system groups. +platform: freebsd +log_source: osquery +event_code: groups +event_fields: +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Unsigned int64 group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid_signed + type: BIGINT + description: A signed int64 version of gid + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: groupname + type: TEXT + description: Canonical local group name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: group_sid + type: TEXT + description: Unique group ID [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Remarks or comments associated with the group [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_hidden + type: INTEGER + description: IsHidden attribute set in OpenDirectory [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#groups +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/hash.yml b/source/data_dictionaries/freebsd/osquery/events/hash.yml new file mode 100644 index 000000000..f06973613 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/hash.yml @@ -0,0 +1,47 @@ +title: Hash Table +description: Filesystem hash data. +platform: freebsd +log_source: osquery +event_code: hash +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Must provide a path or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: Must provide a path or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: MD5 hash of provided filesystem data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: SHA1 hash of provided filesystem data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: SHA256 hash of provided filesystem data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssdeep + type: TEXT + description: ssdeep hash of provided filesystem data [POSIX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#hash +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/hvci_status.yml b/source/data_dictionaries/freebsd/osquery/events/hvci_status.yml new file mode 100644 index 000000000..8c85deefc --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/hvci_status.yml @@ -0,0 +1,44 @@ +title: Hvci_status Table +description: Retrieve HVCI info of the machine. +platform: freebsd +log_source: osquery +event_code: hvci_status +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: The version number of the Device Guard build. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: instance_identifier + type: TEXT + description: The instance ID of Device Guard. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vbs_status + type: TEXT + description: The status of the virtualization based security settings. Returns UNKNOWN + if an error is encountered. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: code_integrity_policy_enforcement_status + type: TEXT + description: The status of the code integrity policy enforcement settings. Returns + UNKNOWN if an error is encountered. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: umci_policy_status + type: TEXT + description: The status of the User Mode Code Integrity security settings. Returns + UNKNOWN if an error is encountered. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#hvci_status +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/interface_addresses.yml b/source/data_dictionaries/freebsd/osquery/events/interface_addresses.yml new file mode 100644 index 000000000..4abc6b95a --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/interface_addresses.yml @@ -0,0 +1,53 @@ +title: Interface_addresses Table +description: Network interfaces and relevant metadata. +platform: freebsd +log_source: osquery +event_code: interface_addresses +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Specific address for interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mask + type: TEXT + description: Interface netmask + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: broadcast + type: TEXT + description: Broadcast address for the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: point_to_point + type: TEXT + description: PtP address for the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of address. One of dhcp, manual, auto, other, unknown + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: friendly_name + type: TEXT + description: The friendly display name of the interface. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_addresses +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/interface_details.yml b/source/data_dictionaries/freebsd/osquery/events/interface_details.yml new file mode 100644 index 000000000..f10d25a03 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/interface_details.yml @@ -0,0 +1,231 @@ +title: Interface_details Table +description: Detailed information and stats of network interfaces. +platform: freebsd +log_source: osquery +event_code: interface_details +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac + type: TEXT + description: MAC of interface (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: Interface type (includes virtual) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtu + type: INTEGER + description: Network MTU + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric + type: INTEGER + description: Metric based on the speed of the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: Flags (netdevice) for the device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipackets + type: BIGINT + description: Input packets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: opackets + type: BIGINT + description: Output packets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ibytes + type: BIGINT + description: Input bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: obytes + type: BIGINT + description: Output bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ierrors + type: BIGINT + description: Input errors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: oerrors + type: BIGINT + description: Output errors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: idrops + type: BIGINT + description: Input drops + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: odrops + type: BIGINT + description: Output drops + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collisions + type: BIGINT + description: Packet Collisions detected + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_change + type: BIGINT + description: Time of last device modification (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: link_speed + type: BIGINT + description: Interface speed in Mb/s [POSIX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_slot + type: TEXT + description: PCI slot number [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: friendly_name + type: TEXT + description: The friendly display name of the interface. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Short description of the object a one-line string. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: Name of the network adapter's manufacturer. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: connection_id + type: TEXT + description: Name of the network connection as it appears in the Network Connections + Control Panel program. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: connection_status + type: TEXT + description: State of the network adapter connection to the network. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: INTEGER + description: Indicates whether the adapter is enabled or not. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: physical_adapter + type: INTEGER + description: Indicates whether the adapter is a physical or a logical adapter. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: speed + type: INTEGER + description: Estimate of the current bandwidth in bits per second. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: service + type: TEXT + description: The name of the service the network adapter uses. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_enabled + type: INTEGER + description: If TRUE, the dynamic host configuration protocol (DHCP) server automatically + assigns an IP address to the computer system when establishing a network connection. + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_lease_expires + type: TEXT + description: Expiration date and time for a leased IP address that was assigned + to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_lease_obtained + type: TEXT + description: Date and time the lease was obtained for the IP address assigned to + the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_server + type: TEXT + description: IP address of the dynamic host configuration protocol (DHCP) server. + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_domain + type: TEXT + description: Organization name followed by a period and an extension that indicates + the type of organization, such as 'microsoft.com'. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_domain_suffix_search_order + type: TEXT + description: Array of DNS domain suffixes to be appended to the end of host names + during name resolution. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_host_name + type: TEXT + description: Host name used to identify the local computer for authentication by + some utilities. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_server_search_order + type: TEXT + description: Array of server IP addresses to be used in querying for DNS servers. + [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_details +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/interface_ipv6.yml b/source/data_dictionaries/freebsd/osquery/events/interface_ipv6.yml new file mode 100644 index 000000000..feb7ec84b --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/interface_ipv6.yml @@ -0,0 +1,41 @@ +title: Interface_ipv6 Table +description: IPv6 configuration and stats of network interfaces. +platform: freebsd +log_source: osquery +event_code: interface_ipv6 +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hop_limit + type: INTEGER + description: Current Hop Limit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: forwarding_enabled + type: INTEGER + description: Enable IP forwarding + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: redirect_accept + type: INTEGER + description: Accept ICMP redirect messages + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rtadv_accept + type: INTEGER + description: Accept ICMP Router Advertisement + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_ipv6 +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/known_hosts.yml b/source/data_dictionaries/freebsd/osquery/events/known_hosts.yml new file mode 100644 index 000000000..d3c64fbcf --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/known_hosts.yml @@ -0,0 +1,29 @@ +title: Known_hosts Table +description: A line-delimited known_hosts table. +platform: freebsd +log_source: osquery +event_code: known_hosts +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the known_hosts file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: parsed authorized keys line + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_file + type: TEXT + description: Path to known_hosts file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#known_hosts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/last.yml b/source/data_dictionaries/freebsd/osquery/events/last.yml new file mode 100644 index 000000000..250dfc0f1 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/last.yml @@ -0,0 +1,47 @@ +title: Last Table +description: System logins and logouts. +platform: freebsd +log_source: osquery +event_code: last +event_fields: +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Entry username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tty + type: TEXT + description: Entry terminal + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: Entry type, according to ut_type types (utmp.h) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Entry timestamp + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host + type: TEXT + description: Entry hostname + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#last +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/listening_ports.yml b/source/data_dictionaries/freebsd/osquery/events/listening_ports.yml new file mode 100644 index 000000000..ecd6f82ef --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/listening_ports.yml @@ -0,0 +1,65 @@ +title: Listening_ports Table +description: Processes with listening (bound) network sockets/ports. +platform: freebsd +log_source: osquery +event_code: listening_ports +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Transport layer port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: INTEGER + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: family + type: INTEGER + description: Network protocol (IPv4, IPv6) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Specific address for bind + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Socket file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: socket + type: BIGINT + description: Socket handle or inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path for UNIX domain sockets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: The inode number of the network namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#listening_ports +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/lldp_neighbors.yml b/source/data_dictionaries/freebsd/osquery/events/lldp_neighbors.yml new file mode 100644 index 000000000..b685afa95 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/lldp_neighbors.yml @@ -0,0 +1,425 @@ +title: Lldp_neighbors Table +description: LLDP neighbors of interfaces. +platform: freebsd +log_source: osquery +event_code: lldp_neighbors +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rid + type: INTEGER + description: Neighbor chassis index + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_id_type + type: TEXT + description: Neighbor chassis ID type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_id + type: TEXT + description: Neighbor chassis ID value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_sysname + type: TEXT + description: CPU brand string, contains vendor and model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_sys_description + type: INTEGER + description: Max number of CPU physical cores + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_bridge_capability_available + type: INTEGER + description: Chassis bridge capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_bridge_capability_enabled + type: INTEGER + description: Is chassis bridge capability enabled. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_router_capability_available + type: INTEGER + description: Chassis router capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_router_capability_enabled + type: INTEGER + description: Chassis router capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_repeater_capability_available + type: INTEGER + description: Chassis repeater capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_repeater_capability_enabled + type: INTEGER + description: Chassis repeater capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_wlan_capability_available + type: INTEGER + description: Chassis wlan capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_wlan_capability_enabled + type: INTEGER + description: Chassis wlan capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_tel_capability_available + type: INTEGER + description: Chassis telephone capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_tel_capability_enabled + type: INTEGER + description: Chassis telephone capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_docsis_capability_available + type: INTEGER + description: Chassis DOCSIS capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_docsis_capability_enabled + type: INTEGER + description: Chassis DOCSIS capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_station_capability_available + type: INTEGER + description: Chassis station capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_station_capability_enabled + type: INTEGER + description: Chassis station capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_other_capability_available + type: INTEGER + description: Chassis other capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_other_capability_enabled + type: INTEGER + description: Chassis other capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_mgmt_ips + type: TEXT + description: Comma delimited list of chassis management IPS + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_id_type + type: TEXT + description: Port ID type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_id + type: TEXT + description: Port ID value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_description + type: TEXT + description: Port description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_ttl + type: BIGINT + description: Age of neighbor port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_mfs + type: BIGINT + description: Port max frame size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_aggregation_id + type: TEXT + description: Port aggregation ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_supported + type: INTEGER + description: Auto negotiation supported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_enabled + type: INTEGER + description: Is auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_mau_type + type: TEXT + description: MAU type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_10baset_hd_enabled + type: INTEGER + description: 10Base-T HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_10baset_fd_enabled + type: INTEGER + description: 10Base-T FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100basetx_hd_enabled + type: INTEGER + description: 100Base-TX HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100basetx_fd_enabled + type: INTEGER + description: 100Base-TX FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset2_hd_enabled + type: INTEGER + description: 100Base-T2 HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset2_fd_enabled + type: INTEGER + description: 100Base-T2 FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset4_hd_enabled + type: INTEGER + description: 100Base-T4 HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset4_fd_enabled + type: INTEGER + description: 100Base-T4 FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000basex_hd_enabled + type: INTEGER + description: 1000Base-X HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000basex_fd_enabled + type: INTEGER + description: 1000Base-X FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000baset_hd_enabled + type: INTEGER + description: 1000Base-T HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000baset_fd_enabled + type: INTEGER + description: 1000Base-T FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_device_type + type: TEXT + description: Dot3 power device type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_mdi_supported + type: INTEGER + description: MDI power supported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_mdi_enabled + type: INTEGER + description: Is MDI power enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_paircontrol_enabled + type: INTEGER + description: Is power pair control enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_pairs + type: TEXT + description: Dot3 power pairs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_class + type: TEXT + description: Power class + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_enabled + type: INTEGER + description: Is 802.3at enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_type + type: TEXT + description: 802.3at power type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_source + type: TEXT + description: 802.3at power source + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_priority + type: TEXT + description: 802.3at power priority + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_allocated + type: TEXT + description: 802.3at power allocated + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_requested + type: TEXT + description: 802.3at power requested + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_device_type + type: TEXT + description: Chassis MED type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_capabilities + type: INTEGER + description: Is MED capabilities enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_policy + type: INTEGER + description: Is MED policy capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_location + type: INTEGER + description: Is MED location capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_mdi_pse + type: INTEGER + description: Is MED MDI PSE capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_mdi_pd + type: INTEGER + description: Is MED MDI PD capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_inventory + type: INTEGER + description: Is MED inventory capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_policies + type: TEXT + description: Comma delimited list of MED policies + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vlans + type: TEXT + description: Comma delimited list of vlan ids + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pvid + type: TEXT + description: Primary VLAN id + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ppvids_supported + type: TEXT + description: Comma delimited list of supported PPVIDs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ppvids_enabled + type: TEXT + description: Comma delimited list of enabled PPVIDs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pids + type: TEXT + description: Comma delimited list of PIDs + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#lldp_neighbors +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/load_average.yml b/source/data_dictionaries/freebsd/osquery/events/load_average.yml new file mode 100644 index 000000000..135a3ef70 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/load_average.yml @@ -0,0 +1,23 @@ +title: Load_average Table +description: Displays information about the system wide load averages. +platform: freebsd +log_source: osquery +event_code: load_average +event_fields: +- standard_name: TBD + standard_type: TBD + name: period + type: TEXT + description: Period over which the average is calculated. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: average + type: TEXT + description: Load average over the specified period. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#load_average +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/logged_in_users.yml b/source/data_dictionaries/freebsd/osquery/events/logged_in_users.yml new file mode 100644 index 000000000..761b21443 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/logged_in_users.yml @@ -0,0 +1,59 @@ +title: Logged_in_users Table +description: Users with an active shell on the system. +platform: freebsd +log_source: osquery +event_code: logged_in_users +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Login type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: TEXT + description: User login name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tty + type: TEXT + description: Device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host + type: TEXT + description: Remote hostname + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Time entry was made + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sid + type: TEXT + description: The user's unique security identifier [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: registry_hive + type: TEXT + description: HKEY_USERS registry hive [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#logged_in_users +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/magic.yml b/source/data_dictionaries/freebsd/osquery/events/magic.yml new file mode 100644 index 000000000..cc3dd0613 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/magic.yml @@ -0,0 +1,43 @@ +title: Magic Table +description: Magic number recognition library table. +platform: freebsd +log_source: osquery +event_code: magic +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Absolute path to target file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: magic_db_files + type: TEXT + description: 'Colon(:) separated list of files where the magic db file can be found. + By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic + or /usr/share/misc/magic.mgc' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: data + type: TEXT + description: Magic number data from libmagic + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mime_type + type: TEXT + description: MIME type data from libmagic + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mime_encoding + type: TEXT + description: MIME encoding data from libmagic + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#magic +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/mounts.yml b/source/data_dictionaries/freebsd/osquery/events/mounts.yml new file mode 100644 index 000000000..ea389925e --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/mounts.yml @@ -0,0 +1,77 @@ +title: Mounts Table +description: System mounted devices and filesystems (not process specific). +platform: freebsd +log_source: osquery +event_code: mounts +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Mounted device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device_alias + type: TEXT + description: Mounted device alias + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Mounted device path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Mounted device type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_size + type: BIGINT + description: Block size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks + type: BIGINT + description: Mounted device used blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_free + type: BIGINT + description: Mounted device free blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_available + type: BIGINT + description: Mounted device available blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inodes + type: BIGINT + description: Mounted device used inodes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inodes_free + type: BIGINT + description: Mounted device free inodes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: TEXT + description: Mounted device flags + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#mounts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/opera_extensions.yml b/source/data_dictionaries/freebsd/osquery/events/opera_extensions.yml new file mode 100644 index 000000000..5721956e4 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/opera_extensions.yml @@ -0,0 +1,65 @@ +title: Opera_extensions Table +description: Opera browser extensions. +platform: freebsd +log_source: osquery +event_code: opera_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Extension identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Extension-optional description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: locale + type: TEXT + description: Default locale supported by extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: update_url + type: TEXT + description: Extension-supplied update URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional extension author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to extension folder + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#opera_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/os_version.yml b/source/data_dictionaries/freebsd/osquery/events/os_version.yml new file mode 100644 index 000000000..9b026c4c1 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/os_version.yml @@ -0,0 +1,71 @@ +title: Os_version Table +description: A single row containing the operating system name and version. +platform: freebsd +log_source: osquery +event_code: os_version +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Distribution or product name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Pretty, suitable for presentation, OS version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: major + type: INTEGER + description: Major release version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minor + type: INTEGER + description: Minor release version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: patch + type: INTEGER + description: Optional patch release + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build + type: TEXT + description: Optional build-specific or variant string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform + type: TEXT + description: OS Platform or ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_like + type: TEXT + description: Closely related platforms + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: codename + type: TEXT + description: OS version codename + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_date + type: TEXT + description: The install date of the OS. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#os_version +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/osquery_events.yml b/source/data_dictionaries/freebsd/osquery/events/osquery_events.yml new file mode 100644 index 000000000..ad01b7139 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/osquery_events.yml @@ -0,0 +1,35 @@ +title: Osquery_events Table +description: Information about the event publishers and subscribers. +platform: freebsd +log_source: osquery +event_code: osquery_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Event publisher or subscriber name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: publisher + type: TEXT + description: Name of the associated publisher + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Either publisher or subscriber + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: refreshes + type: INTEGER + description: 'Publisher only: number of runloop restarts' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/osquery_extensions.yml b/source/data_dictionaries/freebsd/osquery/events/osquery_extensions.yml new file mode 100644 index 000000000..ea6db57fa --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/osquery_extensions.yml @@ -0,0 +1,47 @@ +title: Osquery_extensions Table +description: List of active osquery extensions. +platform: freebsd +log_source: osquery +event_code: osquery_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uuid + type: BIGINT + description: The transient ID assigned for communication + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension's name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension's version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sdk_version + type: TEXT + description: osquery SDK version used to build the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of the extenion's domain socket or library path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: 'SDK extension type: extension or module' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/osquery_flags.yml b/source/data_dictionaries/freebsd/osquery/events/osquery_flags.yml new file mode 100644 index 000000000..c63aebe4a --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/osquery_flags.yml @@ -0,0 +1,47 @@ +title: Osquery_flags Table +description: Configurable flags that modify osquery's behavior. +platform: freebsd +log_source: osquery +event_code: osquery_flags +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Flag name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Flag type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Flag description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: default_value + type: TEXT + description: Flag default value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Flag value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shell_only + type: INTEGER + description: Is the flag shell only? + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_flags +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/osquery_info.yml b/source/data_dictionaries/freebsd/osquery/events/osquery_info.yml new file mode 100644 index 000000000..82c6f576b --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/osquery_info.yml @@ -0,0 +1,83 @@ +title: Osquery_info Table +description: Top level information about the running version of osquery. +platform: freebsd +log_source: osquery +event_code: osquery_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread/handle) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Unique ID provided by the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: instance_id + type: TEXT + description: Unique, long-lived ID per instance of osquery + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: osquery toolkit version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_hash + type: TEXT + description: Hash of the working configuration state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_valid + type: INTEGER + description: 1 if the config was loaded and considered valid, else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: extensions + type: TEXT + description: osquery extensions status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_platform + type: TEXT + description: osquery toolkit build platform + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_distro + type: TEXT + description: osquery toolkit platform distribution name (os version) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start_time + type: INTEGER + description: UNIX time in seconds when the process started + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: watcher + type: INTEGER + description: Process (or thread/handle) ID of optional watcher process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_mask + type: INTEGER + description: The osquery platform bitmask + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/osquery_packs.yml b/source/data_dictionaries/freebsd/osquery/events/osquery_packs.yml new file mode 100644 index 000000000..7ccefe850 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/osquery_packs.yml @@ -0,0 +1,56 @@ +title: Osquery_packs Table +description: Information about the current query packs that are loaded in osquery. +platform: freebsd +log_source: osquery +event_code: osquery_packs +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The given name for this query pack + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform + type: TEXT + description: Platforms this query is supported on + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Minimum osquery version that this query will run on + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shard + type: INTEGER + description: Shard restriction limit, 1-100, 0 meaning no restriction + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: discovery_cache_hits + type: INTEGER + description: The number of times that the discovery query used cached values since + the last time the config was reloaded + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: discovery_executions + type: INTEGER + description: The number of times that the discovery queries have been executed since + the last time the config was reloaded + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: Whether this pack is active (the version, platform and discovery queries + match) yes=1, no=0. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_packs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/osquery_registry.yml b/source/data_dictionaries/freebsd/osquery/events/osquery_registry.yml new file mode 100644 index 000000000..b5e72eec4 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/osquery_registry.yml @@ -0,0 +1,41 @@ +title: Osquery_registry Table +description: List the osquery registry plugins. +platform: freebsd +log_source: osquery +event_code: osquery_registry +event_fields: +- standard_name: TBD + standard_type: TBD + name: registry + type: TEXT + description: Name of the osquery registry + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the plugin item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_uuid + type: INTEGER + description: Extension route UUID (0 for core) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: internal + type: INTEGER + description: 1 If the plugin is internal else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: 1 If this plugin is active else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_registry +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/osquery_schedule.yml b/source/data_dictionaries/freebsd/osquery/events/osquery_schedule.yml new file mode 100644 index 000000000..0fd1b86f9 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/osquery_schedule.yml @@ -0,0 +1,53 @@ +title: Osquery_schedule Table +description: Information about the current queries that are scheduled in osquery. +platform: freebsd +log_source: osquery +event_code: osquery_schedule +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The given name for this query + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: query + type: TEXT + description: The exact query to run + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: executions + type: BIGINT + description: Number of times the query was executed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blacklisted + type: INTEGER + description: 1 if the query is blacklisted else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wall_time + type: BIGINT + description: Total wall time spent executing + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_time + type: BIGINT + description: Total user time spent executing + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_time + type: BIGINT + description: Total system time spent executing + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_schedule +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/pkg_packages.yml b/source/data_dictionaries/freebsd/osquery/events/pkg_packages.yml new file mode 100644 index 000000000..0757f4317 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/pkg_packages.yml @@ -0,0 +1,35 @@ +title: Pkg_packages Table +description: pkgng packages that are currently installed on the host system. +platform: freebsd +log_source: osquery +event_code: pkg_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flatsize + type: BIGINT + description: Package size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: arch + type: TEXT + description: Architecture(s) supported + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#pkg_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/platform_info.yml b/source/data_dictionaries/freebsd/osquery/events/platform_info.yml new file mode 100644 index 000000000..b8868ba72 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/platform_info.yml @@ -0,0 +1,59 @@ +title: Platform_info Table +description: Information about EFI/UEFI/ROM and platform/boot. +platform: freebsd +log_source: osquery +event_code: platform_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: Platform code vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Platform code version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: date + type: TEXT + description: Self-reported platform code update date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: revision + type: TEXT + description: BIOS major and minor revision + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Relative address of firmware mapping + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: TEXT + description: Size in bytes of firmware + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: volume_size + type: INTEGER + description: (Optional) size of firmware volume + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: extra + type: TEXT + description: Platform-specific additional information + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#platform_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/process_envs.yml b/source/data_dictionaries/freebsd/osquery/events/process_envs.yml new file mode 100644 index 000000000..a6b0d3dfe --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/process_envs.yml @@ -0,0 +1,29 @@ +title: Process_envs Table +description: A key/value table of environment variables for each process. +platform: freebsd +log_source: osquery +event_code: process_envs +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Environment variable name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Environment variable value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_envs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/process_events.yml b/source/data_dictionaries/freebsd/osquery/events/process_events.yml new file mode 100644 index 000000000..864caf4e5 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/process_events.yml @@ -0,0 +1,173 @@ +title: Process_events Table +description: Track time/action process executions. +platform: freebsd +log_source: osquery +event_code: process_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of executed file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: File mode permissions + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline + type: TEXT + description: Command line arguments (argv) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline_size + type: BIGINT + description: Actual size (bytes) of command line arguments + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env + type: TEXT + description: Environment variables delimited by spaces + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env_count + type: BIGINT + description: Number of environment variables + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env_size + type: BIGINT + description: Actual size (bytes) of environment list + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cwd + type: TEXT + description: The process current working directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: auid + type: BIGINT + description: Audit User ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: BIGINT + description: Effective user ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: BIGINT + description: Effective group ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_uid + type: BIGINT + description: File owner user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_gid + type: BIGINT + description: File owner group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: atime + type: BIGINT + description: File last access in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: BIGINT + description: File modification in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ctime + type: BIGINT + description: File last metadata change in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: btime + type: BIGINT + description: File creation in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: overflows + type: TEXT + description: List of structures that overflowed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Process parent's PID, or -1 if cannot be determined. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of execution in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uptime + type: BIGINT + description: Time of execution in system uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: BIGINT + description: 'OpenBSM Attribute: Status of the process [DARWIN]' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: syscall + type: TEXT + description: 'Syscall name: fork, vfork, clone, execve, execveat [LINUX]' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/process_memory_map.yml b/source/data_dictionaries/freebsd/osquery/events/process_memory_map.yml new file mode 100644 index 000000000..4cc49eaa2 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/process_memory_map.yml @@ -0,0 +1,65 @@ +title: Process_memory_map Table +description: Process memory mapped files and pseudo device/regions. +platform: freebsd +log_source: osquery +event_code: process_memory_map +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start + type: TEXT + description: Virtual start address (hex) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: end + type: TEXT + description: Virtual end address (hex) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: r=read, w=write, x=execute, p=private (cow) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offset + type: BIGINT + description: Offset into mapped path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: MA:MI Major/minor device ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: INTEGER + description: Mapped path inode, 0 means uninitialized (BSS) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to mapped file or mapped type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pseudo + type: INTEGER + description: 1 If path is a pseudo path, else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_memory_map +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/process_open_files.yml b/source/data_dictionaries/freebsd/osquery/events/process_open_files.yml new file mode 100644 index 000000000..0a303e485 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/process_open_files.yml @@ -0,0 +1,29 @@ +title: Process_open_files Table +description: File descriptors for each process. +platform: freebsd +log_source: osquery +event_code: process_open_files +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Process-specific file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Filesystem path of descriptor + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_open_files +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/process_open_sockets.yml b/source/data_dictionaries/freebsd/osquery/events/process_open_sockets.yml new file mode 100644 index 000000000..d2e57d5af --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/process_open_sockets.yml @@ -0,0 +1,83 @@ +title: Process_open_sockets Table +description: Processes which have open network sockets on the system. +platform: freebsd +log_source: osquery +event_code: process_open_sockets +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Socket file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: socket + type: BIGINT + description: Socket handle or inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: family + type: INTEGER + description: Network protocol (IPv4, IPv6) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: INTEGER + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_address + type: TEXT + description: Socket local address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_address + type: TEXT + description: Socket remote address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_port + type: INTEGER + description: Socket local port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_port + type: INTEGER + description: Socket remote port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: For UNIX sockets (family=AF_UNIX), the domain path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: 'TCP socket state [lambda: LINUX() or DARWIN() or WINDOWS()]' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: The inode number of the network namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_open_sockets +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/processes.yml b/source/data_dictionaries/freebsd/osquery/events/processes.yml new file mode 100644 index 000000000..845cfb95b --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/processes.yml @@ -0,0 +1,215 @@ +title: Processes Table +description: All running processes on the host system. +platform: freebsd +log_source: osquery +event_code: processes +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The process path or shorthand argv[0] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to executed binary + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline + type: TEXT + description: Complete argv + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: Process state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cwd + type: TEXT + description: Process current working directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: root + type: TEXT + description: Process virtual root directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Unsigned user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Unsigned group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: BIGINT + description: Unsigned effective user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: BIGINT + description: Unsigned effective group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: suid + type: BIGINT + description: Unsigned saved user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sgid + type: BIGINT + description: Unsigned saved group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wired_size + type: BIGINT + description: Bytes of unpagable memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resident_size + type: BIGINT + description: Bytes of private memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_size + type: BIGINT + description: Total virtual memory size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_time + type: BIGINT + description: CPU time in milliseconds spent in user space + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_time + type: BIGINT + description: CPU time in milliseconds spent in kernel space + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_bytes_read + type: BIGINT + description: Bytes read from disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_bytes_written + type: BIGINT + description: Bytes written to disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start_time + type: BIGINT + description: Process start time in seconds since Epoch, in case of error -1 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Process parent's PID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pgroup + type: BIGINT + description: Process group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: threads + type: INTEGER + description: Number of threads used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: nice + type: INTEGER + description: Process nice level (-20 to 20, default 0) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_elevated_token + type: INTEGER + description: Process uses elevated token yes=1, no=0 [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: elapsed_time + type: BIGINT + description: Elapsed time in seconds this process has been running. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: handle_count + type: BIGINT + description: Total number of handles that the process has open. This number is the + sum of the handles currently opened by each thread in the process. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: percent_processor_time + type: BIGINT + description: Returns elapsed time that all of the threads of this process used the + processor to execute instructions in 100 nanoseconds ticks. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: upid + type: BIGINT + description: A 64bit pid that is never reused. Returns -1 if we couldn't gather + them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uppid + type: BIGINT + description: The 64bit parent pid that is never reused. Returns -1 if we couldn't + gather them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_type + type: INTEGER + description: A 64bit pid that is never reused. Returns -1 if we couldn't gather + them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_subtype + type: INTEGER + description: The 64bit parent pid that is never reused. Returns -1 if we couldn't + gather them from the system. [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#processes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/prometheus_metrics.yml b/source/data_dictionaries/freebsd/osquery/events/prometheus_metrics.yml new file mode 100644 index 000000000..1db02982b --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/prometheus_metrics.yml @@ -0,0 +1,35 @@ +title: Prometheus_metrics Table +description: Retrieve metrics from a Prometheus server. +platform: freebsd +log_source: osquery +event_code: prometheus_metrics +event_fields: +- standard_name: TBD + standard_type: TBD + name: target_name + type: TEXT + description: Address of prometheus target + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric_name + type: TEXT + description: Name of collected Prometheus metric + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric_value + type: DOUBLE + description: Value of collected Prometheus metric + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timestamp_ms + type: BIGINT + description: Unix timestamp of collected data in MS + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#prometheus_metrics +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/python_packages.yml b/source/data_dictionaries/freebsd/osquery/events/python_packages.yml new file mode 100644 index 000000000..e18a607a3 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/python_packages.yml @@ -0,0 +1,53 @@ +title: Python_packages Table +description: Python packages installed in a system. +platform: freebsd +log_source: osquery +event_code: python_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: summary + type: TEXT + description: Package-supplied summary + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional package author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: license + type: TEXT + description: License under which package is launched + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path at which this module resides + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: Directory where Python modules are located + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#python_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/routes.yml b/source/data_dictionaries/freebsd/osquery/events/routes.yml new file mode 100644 index 000000000..849a7cec3 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/routes.yml @@ -0,0 +1,71 @@ +title: Routes Table +description: The active route table for the host system. +platform: freebsd +log_source: osquery +event_code: routes +event_fields: +- standard_name: TBD + standard_type: TBD + name: destination + type: TEXT + description: Destination IP address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: netmask + type: INTEGER + description: Netmask length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gateway + type: TEXT + description: Route gateway + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Route source + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: Flags to describe route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Route local interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtu + type: INTEGER + description: Maximum Transmission Unit for the route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric + type: INTEGER + description: Cost of route. Lowest is preferred + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hopcount + type: INTEGER + description: Max hops expected [POSIX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#routes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/shell_history.yml b/source/data_dictionaries/freebsd/osquery/events/shell_history.yml new file mode 100644 index 000000000..91a96fc32 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/shell_history.yml @@ -0,0 +1,35 @@ +title: Shell_history Table +description: A line-delimited (command) table of per-user .*_history data. +platform: freebsd +log_source: osquery +event_code: shell_history +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Shell history owner + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Entry timestamp. It could be absent, default value is 0. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command + type: TEXT + description: Unparsed date/line/command history line + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: history_file + type: TEXT + description: Path to the .*_history for this user + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#shell_history +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/ssh_configs.yml b/source/data_dictionaries/freebsd/osquery/events/ssh_configs.yml new file mode 100644 index 000000000..10d653766 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/ssh_configs.yml @@ -0,0 +1,29 @@ +title: Ssh_configs Table +description: A table of parsed ssh_configs. +platform: freebsd +log_source: osquery +event_code: ssh_configs +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local owner of the ssh_config file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: option + type: TEXT + description: The option and value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssh_config_file + type: TEXT + description: Path to the ssh_config file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ssh_configs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/sudoers.yml b/source/data_dictionaries/freebsd/osquery/events/sudoers.yml new file mode 100644 index 000000000..0a66d9769 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/sudoers.yml @@ -0,0 +1,29 @@ +title: Sudoers Table +description: Rules for running commands as other users via sudo. +platform: freebsd +log_source: osquery +event_code: sudoers +event_fields: +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source file containing the given rule + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: header + type: TEXT + description: Symbol for given rule + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rule_details + type: TEXT + description: Rule definition + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#sudoers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/suid_bin.yml b/source/data_dictionaries/freebsd/osquery/events/suid_bin.yml new file mode 100644 index 000000000..9586cc392 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/suid_bin.yml @@ -0,0 +1,35 @@ +title: Suid_bin Table +description: suid binaries in common locations. +platform: freebsd +log_source: osquery +event_code: suid_bin +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Binary path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Binary owner username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: groupname + type: TEXT + description: Binary owner group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: Binary permissions + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#suid_bin +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/system_controls.yml b/source/data_dictionaries/freebsd/osquery/events/system_controls.yml new file mode 100644 index 000000000..c8b8706b3 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/system_controls.yml @@ -0,0 +1,53 @@ +title: System_controls Table +description: sysctl names, values, and settings information. +platform: freebsd +log_source: osquery +event_code: system_controls +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Full sysctl MIB name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: oid + type: TEXT + description: Control MIB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem + type: TEXT + description: Subsystem ID, control type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: current_value + type: TEXT + description: Value of setting + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_value + type: TEXT + description: The MIB value set in /etc/sysctl.conf + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Data type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: field_name + type: TEXT + description: Specific attribute of opaque type [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#system_controls +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/system_info.yml b/source/data_dictionaries/freebsd/osquery/events/system_info.yml new file mode 100644 index 000000000..f29d520f0 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/system_info.yml @@ -0,0 +1,101 @@ +title: System_info Table +description: System information for identification. +platform: freebsd +log_source: osquery +event_code: system_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: hostname + type: TEXT + description: Network hostname including domain + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Unique ID provided by the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_type + type: TEXT + description: CPU type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_subtype + type: TEXT + description: CPU subtype + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_brand + type: TEXT + description: CPU brand string, contains vendor and model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_physical_cores + type: INTEGER + description: Number of physical CPU cores in to the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_logical_cores + type: INTEGER + description: Number of logical CPU cores available to the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_microcode + type: TEXT + description: Microcode version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: physical_memory + type: BIGINT + description: Total physical memory in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_vendor + type: TEXT + description: Hardware or board vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_model + type: TEXT + description: Hardware or board model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_version + type: TEXT + description: Hardware or board version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_serial + type: TEXT + description: Device or board serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: computer_name + type: TEXT + description: Friendly computer name (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_hostname + type: TEXT + description: Local hostname (optional) + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#system_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/time.yml b/source/data_dictionaries/freebsd/osquery/events/time.yml new file mode 100644 index 000000000..e76b1f675 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/time.yml @@ -0,0 +1,95 @@ +title: Time Table +description: Track current date and time in the system. +platform: freebsd +log_source: osquery +event_code: time +event_fields: +- standard_name: TBD + standard_type: TBD + name: weekday + type: TEXT + description: Current weekday in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: year + type: INTEGER + description: Current year in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: month + type: INTEGER + description: Current month in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: day + type: INTEGER + description: Current day in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hour + type: INTEGER + description: Current hour in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minutes + type: INTEGER + description: Current minutes in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: seconds + type: INTEGER + description: Current seconds in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timezone + type: TEXT + description: Current timezone in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_time + type: INTEGER + description: Current local UNIX time in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_timezone + type: TEXT + description: Current local timezone in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timestamp + type: TEXT + description: Current timestamp (log format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: datetime + type: TEXT + description: Current date and time (ISO format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: iso_8601 + type: TEXT + description: Current time (ISO format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: win_timestamp + type: BIGINT + description: Timestamp value in 100 nanosecond units. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#time +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/ulimit_info.yml b/source/data_dictionaries/freebsd/osquery/events/ulimit_info.yml new file mode 100644 index 000000000..fb24c81e7 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/ulimit_info.yml @@ -0,0 +1,29 @@ +title: Ulimit_info Table +description: System resource usage limits. +platform: freebsd +log_source: osquery +event_code: ulimit_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: System resource to be limited + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: soft_limit + type: TEXT + description: Current limit value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hard_limit + type: TEXT + description: Maximum limit value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ulimit_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/uptime.yml b/source/data_dictionaries/freebsd/osquery/events/uptime.yml new file mode 100644 index 000000000..b7180b872 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/uptime.yml @@ -0,0 +1,41 @@ +title: Uptime Table +description: Track time passed since last boot. +platform: freebsd +log_source: osquery +event_code: uptime +event_fields: +- standard_name: TBD + standard_type: TBD + name: days + type: INTEGER + description: Days of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hours + type: INTEGER + description: Hours of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minutes + type: INTEGER + description: Minutes of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: seconds + type: INTEGER + description: Seconds of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_seconds + type: BIGINT + description: Total uptime seconds + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#uptime +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/user_events.yml b/source/data_dictionaries/freebsd/osquery/events/user_events.yml new file mode 100644 index 000000000..d5601306b --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/user_events.yml @@ -0,0 +1,77 @@ +title: User_events Table +description: Track user events from the audit framework. +platform: freebsd +log_source: osquery +event_code: user_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: auid + type: BIGINT + description: Audit User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: message + type: TEXT + description: Message from the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: The file description for the process socket + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Supplied path from event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: The Internet protocol address or family ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: terminal + type: TEXT + description: The network protocol ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of execution in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uptime + type: BIGINT + description: Time of execution in system uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/user_ssh_keys.yml b/source/data_dictionaries/freebsd/osquery/events/user_ssh_keys.yml new file mode 100644 index 000000000..e972b1150 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/user_ssh_keys.yml @@ -0,0 +1,30 @@ +title: User_ssh_keys Table +description: Returns the private keys in the users ~/.ssh directory and whether or + not they are encrypted. +platform: freebsd +log_source: osquery +event_code: user_ssh_keys +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the key file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to key file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: encrypted + type: INTEGER + description: 1 if key is encrypted, 0 otherwise + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_ssh_keys +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/users.yml b/source/data_dictionaries/freebsd/osquery/events/users.yml new file mode 100644 index 000000000..5d38a32b6 --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/users.yml @@ -0,0 +1,79 @@ +title: Users Table +description: Local user accounts (including domain accounts that have logged on locally + (Windows)). +platform: freebsd +log_source: osquery +event_code: users +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID (unsigned) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid_signed + type: BIGINT + description: User ID as int64 signed (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid_signed + type: BIGINT + description: Default group ID as int64 signed (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Optional user description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: User's home directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shell + type: TEXT + description: User's configured default shell + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: User's UUID (Apple) or SID (Windows) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Whether the account is roaming (domain), local, or a system profile + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_hidden + type: INTEGER + description: IsHidden attribute set in OpenDirectory [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#users +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/yara.yml b/source/data_dictionaries/freebsd/osquery/events/yara.yml new file mode 100644 index 000000000..70b9cf39f --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/yara.yml @@ -0,0 +1,53 @@ +title: Yara Table +description: Track YARA matches for files or PIDs. +platform: freebsd +log_source: osquery +event_code: yara +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path scanned + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: matches + type: TEXT + description: List of YARA matches + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: count + type: INTEGER + description: Number of YARA matches + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sig_group + type: TEXT + description: Signature group used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sigfile + type: TEXT + description: Signature file used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: strings + type: TEXT + description: Matching strings + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tags + type: TEXT + description: Matching tags + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#yara +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/freebsd/osquery/events/yum_sources.yml b/source/data_dictionaries/freebsd/osquery/events/yum_sources.yml new file mode 100644 index 000000000..5cd67be5b --- /dev/null +++ b/source/data_dictionaries/freebsd/osquery/events/yum_sources.yml @@ -0,0 +1,41 @@ +title: Yum_sources Table +description: Current list of Yum repositories or software channels. +platform: freebsd +log_source: osquery +event_code: yum_sources +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Repository name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: baseurl + type: TEXT + description: Repository base URL + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: TEXT + description: Whether the repository is used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gpgcheck + type: TEXT + description: Whether packages are GPG checked + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gpgkey + type: TEXT + description: URL to GPG key + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#yum_sources +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/README.yml b/source/data_dictionaries/linux/osquery/README.yml index cbd399308..241e1eeb7 100644 --- a/source/data_dictionaries/linux/osquery/README.yml +++ b/source/data_dictionaries/linux/osquery/README.yml @@ -2,7 +2,7 @@ title: Linux Osquery Event Logs description: Osquery schema is defined in tables by osquery engineers. images: [] references: -- text: osquery schema 3.2.4 (website) - link: https://osquery.io/schema/3.2.4 +- text: osquery schema 4.1.2 (website) + link: https://osquery.io/schema/4.1.2 - text: osquery schema linux specs (GitHub) link: https://github.com/facebook/osquery/tree/master/specs/linux diff --git a/source/data_dictionaries/linux/osquery/events/acpi_tables.yml b/source/data_dictionaries/linux/osquery/events/acpi_tables.yml new file mode 100644 index 000000000..c1fd5fed3 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/acpi_tables.yml @@ -0,0 +1,29 @@ +title: Acpi_tables Table +description: Firmware ACPI functional table common metadata and content. +platform: linux +log_source: osquery +event_code: acpi_tables +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: ACPI table name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of compiled table data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: MD5 hash of table content + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#acpi_tables +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/apparmor_profiles.yml b/source/data_dictionaries/linux/osquery/events/apparmor_profiles.yml new file mode 100644 index 000000000..2368691f6 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/apparmor_profiles.yml @@ -0,0 +1,41 @@ +title: Apparmor_profiles Table +description: Track active AppArmor profiles. +platform: linux +log_source: osquery +event_code: apparmor_profiles +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Unique, aa-status compatible, policy identifier. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Policy name. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: attach + type: TEXT + description: Which executable(s) a profile will attach to. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: How the policy is applied. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: A unique hash that identifies this policy. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#apparmor_profiles +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/apt_sources.yml b/source/data_dictionaries/linux/osquery/events/apt_sources.yml new file mode 100644 index 000000000..d4add30e9 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/apt_sources.yml @@ -0,0 +1,59 @@ +title: Apt_sources Table +description: Current list of APT repositories or software channels. +platform: linux +log_source: osquery +event_code: apt_sources +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Repository name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: base_uri + type: TEXT + description: Repository base URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: release + type: TEXT + description: Release name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Repository source version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: maintainer + type: TEXT + description: Repository maintainer + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: components + type: TEXT + description: Repository components + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: architectures + type: TEXT + description: Repository architectures + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#apt_sources +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/arp_cache.yml b/source/data_dictionaries/linux/osquery/events/arp_cache.yml new file mode 100644 index 000000000..f646fe059 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/arp_cache.yml @@ -0,0 +1,35 @@ +title: Arp_cache Table +description: Address resolution cache, both static and dynamic (from ARP, NDP). +platform: linux +log_source: osquery +event_code: arp_cache +event_fields: +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: IPv4 address target + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac + type: TEXT + description: MAC address of broadcasted address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface of the network for the MAC + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permanent + type: TEXT + description: 1 for true, 0 for false + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#arp_cache +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/atom_packages.yml b/source/data_dictionaries/linux/osquery/events/atom_packages.yml new file mode 100644 index 000000000..b0e8578fd --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/atom_packages.yml @@ -0,0 +1,53 @@ +title: Atom_packages Table +description: Lists all atom packages in a directory or globally installed in a system. +platform: linux +log_source: osquery +event_code: atom_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Package supplied description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Package's package.json path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: license + type: TEXT + description: License for package + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: homepage + type: TEXT + description: Package supplied homepage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the plugin + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#atom_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/augeas.yml b/source/data_dictionaries/linux/osquery/events/augeas.yml new file mode 100644 index 000000000..fe320c835 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/augeas.yml @@ -0,0 +1,35 @@ +title: Augeas Table +description: Configuration files parsed by augeas. +platform: linux +log_source: osquery +event_code: augeas +event_fields: +- standard_name: TBD + standard_type: TBD + name: node + type: TEXT + description: The node path of the configuration item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: The value of the configuration item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: The label of the configuration item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path to the configuration file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#augeas +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/authorized_keys.yml b/source/data_dictionaries/linux/osquery/events/authorized_keys.yml new file mode 100644 index 000000000..3179d20a7 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/authorized_keys.yml @@ -0,0 +1,29 @@ +title: Authorized_keys Table +description: A line-delimited authorized_keys table. +platform: linux +log_source: osquery +event_code: authorized_keys +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local owner of authorized_keys file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: parsed authorized keys line + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_file + type: TEXT + description: Path to the authorized_keys file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#authorized_keys +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/azure_instance_metadata.yml b/source/data_dictionaries/linux/osquery/events/azure_instance_metadata.yml new file mode 100644 index 000000000..f3418d959 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/azure_instance_metadata.yml @@ -0,0 +1,107 @@ +title: Azure_instance_metadata Table +description: Azure instance metadata. +platform: linux +log_source: osquery +event_code: azure_instance_metadata +event_fields: +- standard_name: TBD + standard_type: TBD + name: location + type: TEXT + description: Azure Region the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offer + type: TEXT + description: Offer information for the VM image (Azure image gallery VMs only) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: publisher + type: TEXT + description: Publisher of the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sku + type: TEXT + description: SKU for the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Version of the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os_type + type: TEXT + description: Linux or Windows + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_update_domain + type: TEXT + description: Update domain the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_fault_domain + type: TEXT + description: Fault domain the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_id + type: TEXT + description: Unique identifier for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_size + type: TEXT + description: VM size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subscription_id + type: TEXT + description: Azure subscription for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resource_group_name + type: TEXT + description: Resource group for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: placement_group_id + type: TEXT + description: Placement group for the VM scale set + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_scale_set_name + type: TEXT + description: VM scale set name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: zone + type: TEXT + description: Availability zone of the VM + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#azure_instance_metadata +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/azure_instance_tags.yml b/source/data_dictionaries/linux/osquery/events/azure_instance_tags.yml new file mode 100644 index 000000000..f9d3a604f --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/azure_instance_tags.yml @@ -0,0 +1,29 @@ +title: Azure_instance_tags Table +description: Azure instance tags. +platform: linux +log_source: osquery +event_code: azure_instance_tags +event_fields: +- standard_name: TBD + standard_type: TBD + name: vm_id + type: TEXT + description: Unique identifier for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: The tag key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: The tag value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#azure_instance_tags +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/block_devices.yml b/source/data_dictionaries/linux/osquery/events/block_devices.yml new file mode 100644 index 000000000..1ea27de3b --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/block_devices.yml @@ -0,0 +1,66 @@ +title: Block_devices Table +description: 'Block (buffered access) device file nodes: disks, ramdisks, and DMG + containers.' +platform: linux +log_source: osquery +event_code: block_devices +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Block device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: TEXT + description: Block device parent name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: Block device vendor string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: Block device model string identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Block device size in blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: block_size + type: INTEGER + description: Block size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Block device Universally Unique Identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Block device type string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: Block device label string + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#block_devices +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/carbon_black_info.yml b/source/data_dictionaries/linux/osquery/events/carbon_black_info.yml new file mode 100644 index 000000000..bf1c58c02 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/carbon_black_info.yml @@ -0,0 +1,138 @@ +title: Carbon_black_info Table +description: Returns info about a Carbon Black sensor install. +platform: linux +log_source: osquery +event_code: carbon_black_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: sensor_id + type: INTEGER + description: Sensor ID of the Carbon Black sensor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_name + type: TEXT + description: Sensor group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_store_files + type: INTEGER + description: If the sensor is configured to send back binaries to the Carbon Black + server + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_module_loads + type: INTEGER + description: If the sensor is configured to capture module loads + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_module_info + type: INTEGER + description: If the sensor is configured to collect metadata of binaries + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_file_mods + type: INTEGER + description: If the sensor is configured to collect file modification events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_reg_mods + type: INTEGER + description: If the sensor is configured to collect registry modification events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_net_conns + type: INTEGER + description: If the sensor is configured to collect network connections + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_processes + type: INTEGER + description: If the sensor is configured to process events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_cross_processes + type: INTEGER + description: If the sensor is configured to cross process events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_emet_events + type: INTEGER + description: If the sensor is configured to EMET events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_data_file_writes + type: INTEGER + description: If the sensor is configured to collect non binary file writes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_process_user_context + type: INTEGER + description: If the sensor is configured to collect the user running a process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_sensor_operations + type: INTEGER + description: Unknown + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: log_file_disk_quota_mb + type: INTEGER + description: Event file disk quota in MB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: log_file_disk_quota_percentage + type: INTEGER + description: Event file disk quota in a percentage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protection_disabled + type: INTEGER + description: If the sensor is configured to report tamper events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sensor_ip_addr + type: TEXT + description: IP address of the sensor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sensor_backend_server + type: TEXT + description: Carbon Black server + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: event_queue + type: INTEGER + description: Size in bytes of Carbon Black event files on disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: binary_queue + type: INTEGER + description: Size in bytes of binaries waiting to be sent to Carbon Black server + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#carbon_black_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/carves.yml b/source/data_dictionaries/linux/osquery/events/carves.yml new file mode 100644 index 000000000..31d4495f9 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/carves.yml @@ -0,0 +1,53 @@ +title: Carves Table +description: Forensic Carves. +platform: linux +log_source: osquery +event_code: carves +event_fields: +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time at which the carve was kicked off + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: A SHA256 sum of the carved archive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of the carved archive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path of the requested carve + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: carve_guid + type: TEXT + description: Identifying value of the carve session + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: carve + type: INTEGER + description: Set this value to '1' to start a file carve + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#carves +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/chrome_extensions.yml b/source/data_dictionaries/linux/osquery/events/chrome_extensions.yml new file mode 100644 index 000000000..ce225655e --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/chrome_extensions.yml @@ -0,0 +1,83 @@ +title: Chrome_extensions Table +description: Chrome browser extensions. +platform: linux +log_source: osquery +event_code: chrome_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: profile + type: TEXT + description: The Chrome profile that contains this extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Extension identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Extension-optional description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: locale + type: TEXT + description: Default locale supported by extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: update_url + type: TEXT + description: Extension-supplied update URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional extension author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to extension folder + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: The permissions required by the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: optional_permissions + type: TEXT + description: The permissions optionally required by the extensions + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#chrome_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/cpu_time.yml b/source/data_dictionaries/linux/osquery/events/cpu_time.yml new file mode 100644 index 000000000..c4a0fa422 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/cpu_time.yml @@ -0,0 +1,80 @@ +title: Cpu_time Table +description: Displays information from /proc/stat file about the time the cpu cores + spent in different parts of the system. +platform: linux +log_source: osquery +event_code: cpu_time +event_fields: +- standard_name: TBD + standard_type: TBD + name: core + type: INTEGER + description: Name of the cpu (core) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: BIGINT + description: Time spent in user mode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: nice + type: BIGINT + description: Time spent in user mode with low priority (nice) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system + type: BIGINT + description: Time spent in system mode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: idle + type: BIGINT + description: Time spent in the idle task + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: iowait + type: BIGINT + description: Time spent waiting for I/O to complete + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: irq + type: BIGINT + description: Time spent servicing interrupts + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: softirq + type: BIGINT + description: Time spent servicing softirqs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: steal + type: BIGINT + description: Time spent in other operating systems when running in a virtualized + environment + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: guest + type: BIGINT + description: Time spent running a virtual CPU for a guest OS under the control of + the Linux kernel + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: guest_nice + type: BIGINT + description: 'Time spent running a niced guest ' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#cpu_time +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/cpuid.yml b/source/data_dictionaries/linux/osquery/events/cpuid.yml new file mode 100644 index 000000000..28c939869 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/cpuid.yml @@ -0,0 +1,41 @@ +title: Cpuid Table +description: Useful CPU features from the cpuid ASM call. +platform: linux +log_source: osquery +event_code: cpuid +event_fields: +- standard_name: TBD + standard_type: TBD + name: feature + type: TEXT + description: Present feature flags + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Bit value or string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: output_register + type: TEXT + description: Register used to for feature value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: output_bit + type: INTEGER + description: Bit in register value for feature value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: input_eax + type: TEXT + description: Value of EAX used + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#cpuid +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/crontab.yml b/source/data_dictionaries/linux/osquery/events/crontab.yml new file mode 100644 index 000000000..5aad0ed45 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/crontab.yml @@ -0,0 +1,59 @@ +title: Crontab Table +description: Line parsed values from system and user cron/tab. +platform: linux +log_source: osquery +event_code: crontab +event_fields: +- standard_name: TBD + standard_type: TBD + name: event + type: TEXT + description: The job @event name (rare) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minute + type: TEXT + description: The exact minute for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hour + type: TEXT + description: The hour of the day for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: day_of_month + type: TEXT + description: The day of the month for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: month + type: TEXT + description: The month of the year for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: day_of_week + type: TEXT + description: The day of the week for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command + type: TEXT + description: Raw command string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: File parsed + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#crontab +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/curl.yml b/source/data_dictionaries/linux/osquery/events/curl.yml new file mode 100644 index 000000000..c1ca29eaf --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/curl.yml @@ -0,0 +1,53 @@ +title: Curl Table +description: Perform an http request and return stats about it. +platform: linux +log_source: osquery +event_code: curl +event_fields: +- standard_name: TBD + standard_type: TBD + name: url + type: TEXT + description: The url for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: method + type: TEXT + description: The HTTP method for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_agent + type: TEXT + description: The user-agent string to use for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: response_code + type: INTEGER + description: The HTTP status code for the response + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: round_trip_time + type: BIGINT + description: Time taken to complete the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bytes + type: BIGINT + description: Number of bytes in the response + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: result + type: TEXT + description: The HTTP response body + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#curl +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/curl_certificate.yml b/source/data_dictionaries/linux/osquery/events/curl_certificate.yml new file mode 100644 index 000000000..dd3ae7f18 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/curl_certificate.yml @@ -0,0 +1,83 @@ +title: Curl_certificate Table +description: Inspect TLS certificates by connecting to input hostnames. +platform: linux +log_source: osquery +event_code: curl_certificate +event_fields: +- standard_name: TBD + standard_type: TBD + name: hostname + type: TEXT + description: Hostname (domain[:port]) to CURL + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: common_name + type: TEXT + description: Common name of company issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: organization + type: TEXT + description: Organization issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: organization_unit + type: TEXT + description: Organization unit issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial_number + type: TEXT + description: Certificate serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_common_name + type: TEXT + description: Issuer common name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_organization + type: TEXT + description: Issuer organization + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_organization_unit + type: TEXT + description: Issuer organization unit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: valid_from + type: TEXT + description: Period of validity start date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: valid_to + type: TEXT + description: Period of validity end date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256_fingerprint + type: TEXT + description: SHA-256 fingerprint + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1_fingerprint + type: TEXT + description: SHA1 fingerprint + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#curl_certificate +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/deb_packages.yml b/source/data_dictionaries/linux/osquery/events/deb_packages.yml new file mode 100644 index 000000000..adec09f13 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/deb_packages.yml @@ -0,0 +1,47 @@ +title: Deb_packages Table +description: The installed DEB package database. +platform: linux +log_source: osquery +event_code: deb_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Package source + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Package size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: arch + type: TEXT + description: Package architecture + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: revision + type: TEXT + description: Package revision + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#deb_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/device_file.yml b/source/data_dictionaries/linux/osquery/events/device_file.yml new file mode 100644 index 000000000..273852382 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/device_file.yml @@ -0,0 +1,101 @@ +title: Device_file Table +description: Similar to the file table, but use TSK and allow block address access. +platform: linux +log_source: osquery +event_code: device_file +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Absolute file path to device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partition + type: TEXT + description: A partition number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: A logical path within the device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: filename + type: TEXT + description: Name portion of file path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: BIGINT + description: Filesystem inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Owning user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Owning group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: Permission bits + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Size of file in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: block_size + type: INTEGER + description: Block size of filesystem + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: atime + type: BIGINT + description: Last access time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: BIGINT + description: Last modification time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ctime + type: BIGINT + description: Creation time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hard_links + type: INTEGER + description: Number of hard links + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: File status + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#device_file +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/device_hash.yml b/source/data_dictionaries/linux/osquery/events/device_hash.yml new file mode 100644 index 000000000..768c6e584 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/device_hash.yml @@ -0,0 +1,47 @@ +title: Device_hash Table +description: Similar to the hash table, but use TSK and allow block address access. +platform: linux +log_source: osquery +event_code: device_hash +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Absolute file path to device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partition + type: TEXT + description: A partition number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: BIGINT + description: Filesystem inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: MD5 hash of provided inode data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: SHA1 hash of provided inode data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: SHA256 hash of provided inode data + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#device_hash +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/device_partitions.yml b/source/data_dictionaries/linux/osquery/events/device_partitions.yml new file mode 100644 index 000000000..4d782038c --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/device_partitions.yml @@ -0,0 +1,65 @@ +title: Device_partitions Table +description: Use TSK to enumerate details about partitions on a disk device. +platform: linux +log_source: osquery +event_code: device_partitions +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Absolute file path to device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partition + type: INTEGER + description: A partition number or description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offset + type: BIGINT + description: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_size + type: BIGINT + description: Byte size of each block + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks + type: BIGINT + description: Number of blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inodes + type: BIGINT + description: Number of meta nodes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: '' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#device_partitions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/disk_encryption.yml b/source/data_dictionaries/linux/osquery/events/disk_encryption.yml new file mode 100644 index 000000000..2ffdf8faf --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/disk_encryption.yml @@ -0,0 +1,54 @@ +title: Disk_encryption Table +description: Disk encryption status and information. +platform: linux +log_source: osquery +event_code: disk_encryption +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Disk name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Disk Universally Unique Identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: encrypted + type: INTEGER + description: '1 If encrypted: true (disk is encrypted), else 0' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Description of cipher type and mode if available + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: TEXT + description: Currently authenticated user if available (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_uuid + type: TEXT + description: UUID of authenticated user if available (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: encryption_status + type: TEXT + description: 'Disk encryption status with one of following values: encrypted | not + encrypted | undefined' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#disk_encryption +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/dns_resolvers.yml b/source/data_dictionaries/linux/osquery/events/dns_resolvers.yml new file mode 100644 index 000000000..5adfa2476 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/dns_resolvers.yml @@ -0,0 +1,41 @@ +title: Dns_resolvers Table +description: Resolvers used by this host. +platform: linux +log_source: osquery +event_code: dns_resolvers +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: INTEGER + description: Address type index or order + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: 'Address type: sortlist, nameserver, search' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Resolver IP/IPv6 address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: netmask + type: TEXT + description: Address (sortlist) netmask length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: options + type: BIGINT + description: Resolver options + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#dns_resolvers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_container_labels.yml b/source/data_dictionaries/linux/osquery/events/docker_container_labels.yml new file mode 100644 index 000000000..e90fbe432 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_container_labels.yml @@ -0,0 +1,29 @@ +title: Docker_container_labels Table +description: Docker container labels. +platform: linux +log_source: osquery +event_code: docker_container_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_container_mounts.yml b/source/data_dictionaries/linux/osquery/events/docker_container_mounts.yml new file mode 100644 index 000000000..af95d80d1 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_container_mounts.yml @@ -0,0 +1,65 @@ +title: Docker_container_mounts Table +description: Docker container mounts. +platform: linux +log_source: osquery +event_code: docker_container_mounts +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of mount (bind, volume) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Optional mount name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source path on host + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: destination + type: TEXT + description: Destination path inside container + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Driver providing the mount + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: Mount options (rw, ro) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rw + type: INTEGER + description: 1 if read/write. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: propagation + type: TEXT + description: Mount propagation + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_mounts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_container_networks.yml b/source/data_dictionaries/linux/osquery/events/docker_container_networks.yml new file mode 100644 index 000000000..e39741e70 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_container_networks.yml @@ -0,0 +1,77 @@ +title: Docker_container_networks Table +description: Docker container networks. +platform: linux +log_source: osquery +event_code: docker_container_networks +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Network name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_id + type: TEXT + description: Network ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: endpoint_id + type: TEXT + description: Endpoint ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gateway + type: TEXT + description: Gateway + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ip_address + type: TEXT + description: IP address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ip_prefix_len + type: INTEGER + description: IP subnet prefix length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_gateway + type: TEXT + description: IPv6 gateway + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_address + type: TEXT + description: IPv6 address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_prefix_len + type: INTEGER + description: IPv6 subnet prefix length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac_address + type: TEXT + description: MAC address + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_networks +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_container_ports.yml b/source/data_dictionaries/linux/osquery/events/docker_container_ports.yml new file mode 100644 index 000000000..c6f7727b3 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_container_ports.yml @@ -0,0 +1,41 @@ +title: Docker_container_ports Table +description: Docker container ports. +platform: linux +log_source: osquery +event_code: docker_container_ports +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Protocol (tcp, udp) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Port inside the container + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host_ip + type: TEXT + description: Host IP address on which public port is listening + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host_port + type: INTEGER + description: Host port + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_ports +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_container_processes.yml b/source/data_dictionaries/linux/osquery/events/docker_container_processes.yml new file mode 100644 index 000000000..561ae9af2 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_container_processes.yml @@ -0,0 +1,143 @@ +title: Docker_container_processes Table +description: Docker container processes. +platform: linux +log_source: osquery +event_code: docker_container_processes +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The process path or shorthand argv[0] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline + type: TEXT + description: Complete argv + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: Process state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: BIGINT + description: Effective user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: BIGINT + description: Effective group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: suid + type: BIGINT + description: Saved user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sgid + type: BIGINT + description: Saved group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wired_size + type: BIGINT + description: Bytes of unpagable memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resident_size + type: BIGINT + description: Bytes of private memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_size + type: BIGINT + description: Total virtual memory size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Process parent's PID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pgroup + type: BIGINT + description: Process group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: threads + type: INTEGER + description: Number of threads used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: nice + type: INTEGER + description: Process nice level (-20 to 20, default 0) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: TEXT + description: User name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: TEXT + description: Cumulative CPU time. [DD-]HH:MM:SS format + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu + type: DOUBLE + description: CPU utilization as percentage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mem + type: DOUBLE + description: Memory utilization as percentage + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_processes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_container_stats.yml b/source/data_dictionaries/linux/osquery/events/docker_container_stats.yml new file mode 100644 index 000000000..26dc3e99f --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_container_stats.yml @@ -0,0 +1,156 @@ +title: Docker_container_stats Table +description: Docker container statistics. Queries on this table take at least one + second. +platform: linux +log_source: osquery +event_code: docker_container_stats +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Container name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pids + type: INTEGER + description: Number of processes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: read + type: BIGINT + description: UNIX time when stats were read + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: preread + type: BIGINT + description: UNIX time when stats were last read + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: interval + type: BIGINT + description: Difference between read and preread in nano-seconds + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_read + type: BIGINT + description: Total disk read bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_write + type: BIGINT + description: Total disk write bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: num_procs + type: INTEGER + description: Number of processors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_total_usage + type: BIGINT + description: Total CPU usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_kernelmode_usage + type: BIGINT + description: CPU kernel mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_usermode_usage + type: BIGINT + description: CPU user mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_cpu_usage + type: BIGINT + description: CPU system usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: online_cpus + type: INTEGER + description: Online CPUs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_cpu_total_usage + type: BIGINT + description: Last read total CPU usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_cpu_kernelmode_usage + type: BIGINT + description: Last read CPU kernel mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_cpu_usermode_usage + type: BIGINT + description: Last read CPU user mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_system_cpu_usage + type: BIGINT + description: Last read CPU system usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_online_cpus + type: INTEGER + description: Last read online CPUs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_usage + type: BIGINT + description: Memory usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_max_usage + type: BIGINT + description: Memory maximum usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_limit + type: BIGINT + description: Memory limit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_rx_bytes + type: BIGINT + description: Total network bytes read + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_tx_bytes + type: BIGINT + description: Total network bytes transmitted + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_stats +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_containers.yml b/source/data_dictionaries/linux/osquery/events/docker_containers.yml new file mode 100644 index 000000000..f23e6a151 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_containers.yml @@ -0,0 +1,156 @@ +title: Docker_containers Table +description: Docker containers information. +platform: linux +log_source: osquery +event_code: docker_containers +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Container name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: image + type: TEXT + description: Docker image (name) used to launch this container + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: image_id + type: TEXT + description: Docker image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command + type: TEXT + description: Command with arguments + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: BIGINT + description: Time of creation as UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: Container state (created, restarting, running, removing, paused, exited, + dead) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Container status information + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Identifier of the initial process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Container path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_entrypoint + type: TEXT + description: Container entrypoint(s) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: started_at + type: TEXT + description: Container start time as string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: finished_at + type: TEXT + description: Container finish time as string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: privileged + type: INTEGER + description: Is the container privileged + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: security_options + type: TEXT + description: List of container security options + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env_variables + type: TEXT + description: Container environmental variables + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: readonly_rootfs + type: INTEGER + description: Is the root filesystem mounted as read only + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cgroup_namespace + type: TEXT + description: cgroup namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipc_namespace + type: TEXT + description: IPC namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mnt_namespace + type: TEXT + description: Mount namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: Network namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid_namespace + type: TEXT + description: PID namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_namespace + type: TEXT + description: User namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uts_namespace + type: TEXT + description: UTS namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_containers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_image_labels.yml b/source/data_dictionaries/linux/osquery/events/docker_image_labels.yml new file mode 100644 index 000000000..474df9c06 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_image_labels.yml @@ -0,0 +1,29 @@ +title: Docker_image_labels Table +description: Docker image labels. +platform: linux +log_source: osquery +event_code: docker_image_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_image_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_image_layers.yml b/source/data_dictionaries/linux/osquery/events/docker_image_layers.yml new file mode 100644 index 000000000..44d1a0f64 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_image_layers.yml @@ -0,0 +1,29 @@ +title: Docker_image_layers Table +description: Docker image layers information. +platform: linux +log_source: osquery +event_code: docker_image_layers +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: layer_id + type: TEXT + description: Layer ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: layer_order + type: INTEGER + description: Layer Order (1 = base layer) + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_image_layers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_images.yml b/source/data_dictionaries/linux/osquery/events/docker_images.yml new file mode 100644 index 000000000..2f257d24e --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_images.yml @@ -0,0 +1,35 @@ +title: Docker_images Table +description: Docker images information. +platform: linux +log_source: osquery +event_code: docker_images +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: BIGINT + description: Time of creation as UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size_bytes + type: BIGINT + description: Size of image in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tags + type: TEXT + description: Comma-separated list of repository tags + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_images +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_info.yml b/source/data_dictionaries/linux/osquery/events/docker_info.yml new file mode 100644 index 000000000..b4a413e43 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_info.yml @@ -0,0 +1,206 @@ +title: Docker_info Table +description: Docker system information. +platform: linux +log_source: osquery +event_code: docker_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Docker system ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers + type: INTEGER + description: Total number of containers + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers_running + type: INTEGER + description: Number of containers currently running + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers_paused + type: INTEGER + description: Number of containers in paused state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers_stopped + type: INTEGER + description: Number of containers in stopped state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: images + type: INTEGER + description: Number of images + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: storage_driver + type: TEXT + description: Storage driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_limit + type: INTEGER + description: 1 if memory limit support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: swap_limit + type: INTEGER + description: 1 if swap limit support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kernel_memory + type: INTEGER + description: 1 if kernel memory limit support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_cfs_period + type: INTEGER + description: 1 if CPU Completely Fair Scheduler (CFS) period support is enabled. + 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_cfs_quota + type: INTEGER + description: 1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. + 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_shares + type: INTEGER + description: 1 if CPU share weighting support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_set + type: INTEGER + description: 1 if CPU set selection support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv4_forwarding + type: INTEGER + description: 1 if IPv4 forwarding is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bridge_nf_iptables + type: INTEGER + description: 1 if bridge netfilter iptables is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bridge_nf_ip6tables + type: INTEGER + description: 1 if bridge netfilter ip6tables is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: oom_kill_disable + type: INTEGER + description: 1 if Out-of-memory kill is disabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logging_driver + type: TEXT + description: Logging driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cgroup_driver + type: TEXT + description: Control groups driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kernel_version + type: TEXT + description: Kernel version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os + type: TEXT + description: Operating system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os_type + type: TEXT + description: Operating system type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: architecture + type: TEXT + description: Hardware architecture + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpus + type: INTEGER + description: Number of CPUs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory + type: BIGINT + description: Total memory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: http_proxy + type: TEXT + description: HTTP proxy + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: https_proxy + type: TEXT + description: HTTPS proxy + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: no_proxy + type: TEXT + description: Comma-separated list of domain extensions proxy should not be used + for + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the docker host + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: server_version + type: TEXT + description: Server version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: root_dir + type: TEXT + description: Docker root directory + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_network_labels.yml b/source/data_dictionaries/linux/osquery/events/docker_network_labels.yml new file mode 100644 index 000000000..eb95b8148 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_network_labels.yml @@ -0,0 +1,29 @@ +title: Docker_network_labels Table +description: Docker network labels. +platform: linux +log_source: osquery +event_code: docker_network_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Network ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_network_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_networks.yml b/source/data_dictionaries/linux/osquery/events/docker_networks.yml new file mode 100644 index 000000000..28752838c --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_networks.yml @@ -0,0 +1,53 @@ +title: Docker_networks Table +description: Docker networks information. +platform: linux +log_source: osquery +event_code: docker_networks +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Network ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Network name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Network driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: BIGINT + description: Time of creation as UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enable_ipv6 + type: INTEGER + description: 1 if IPv6 is enabled on this network. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subnet + type: TEXT + description: Network subnet + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gateway + type: TEXT + description: Network gateway + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_networks +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_version.yml b/source/data_dictionaries/linux/osquery/events/docker_version.yml new file mode 100644 index 000000000..4b6e0eeac --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_version.yml @@ -0,0 +1,65 @@ +title: Docker_version Table +description: Docker version information. +platform: linux +log_source: osquery +event_code: docker_version +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Docker version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: api_version + type: TEXT + description: API version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: min_api_version + type: TEXT + description: Minimum API version supported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: git_commit + type: TEXT + description: Docker build git commit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: go_version + type: TEXT + description: Go version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os + type: TEXT + description: Operating system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: arch + type: TEXT + description: Hardware architecture + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kernel_version + type: TEXT + description: Kernel version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_time + type: TEXT + description: Build time + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_version +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_volume_labels.yml b/source/data_dictionaries/linux/osquery/events/docker_volume_labels.yml new file mode 100644 index 000000000..6b355f9f1 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_volume_labels.yml @@ -0,0 +1,29 @@ +title: Docker_volume_labels Table +description: Docker volume labels. +platform: linux +log_source: osquery +event_code: docker_volume_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Volume name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_volume_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/docker_volumes.yml b/source/data_dictionaries/linux/osquery/events/docker_volumes.yml new file mode 100644 index 000000000..0f2db996e --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/docker_volumes.yml @@ -0,0 +1,35 @@ +title: Docker_volumes Table +description: Docker volumes information. +platform: linux +log_source: osquery +event_code: docker_volumes +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Volume name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Volume driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mount_point + type: TEXT + description: Mount point + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Volume type + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_volumes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/ec2_instance_metadata.yml b/source/data_dictionaries/linux/osquery/events/ec2_instance_metadata.yml new file mode 100644 index 000000000..18239adcf --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/ec2_instance_metadata.yml @@ -0,0 +1,96 @@ +title: Ec2_instance_metadata Table +description: EC2 instance metadata. +platform: linux +log_source: osquery +event_code: ec2_instance_metadata +event_fields: +- standard_name: TBD + standard_type: TBD + name: instance_id + type: TEXT + description: EC2 instance ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: instance_type + type: TEXT + description: EC2 instance type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: architecture + type: TEXT + description: Hardware architecture of this EC2 instance + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: region + type: TEXT + description: AWS region in which this instance launched + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: availability_zone + type: TEXT + description: Availability zone in which this instance launched + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_hostname + type: TEXT + description: Private IPv4 DNS hostname of the first interface of this instance + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_ipv4 + type: TEXT + description: Private IPv4 address of the first interface of this instance + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac + type: TEXT + description: MAC address for the first network interface of this EC2 instance + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: security_groups + type: TEXT + description: Comma separated list of security group names + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: iam_arn + type: TEXT + description: If there is an IAM role associated with the instance, contains instance + profile ARN + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ami_id + type: TEXT + description: AMI ID used to launch this EC2 instance + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: reservation_id + type: TEXT + description: ID of the reservation + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: account_id + type: TEXT + description: AWS account ID which owns this EC2 instance + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssh_public_key + type: TEXT + description: SSH public key. Only available if supplied at instance launch time + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ec2_instance_metadata +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/ec2_instance_tags.yml b/source/data_dictionaries/linux/osquery/events/ec2_instance_tags.yml new file mode 100644 index 000000000..7dfb3035e --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/ec2_instance_tags.yml @@ -0,0 +1,29 @@ +title: Ec2_instance_tags Table +description: EC2 instance tag key value pairs. +platform: linux +log_source: osquery +event_code: ec2_instance_tags +event_fields: +- standard_name: TBD + standard_type: TBD + name: instance_id + type: TEXT + description: EC2 instance ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Tag key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Tag value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ec2_instance_tags +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/elf_dynamic.yml b/source/data_dictionaries/linux/osquery/events/elf_dynamic.yml new file mode 100644 index 000000000..d8521ce6e --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/elf_dynamic.yml @@ -0,0 +1,35 @@ +title: Elf_dynamic Table +description: ELF dynamic section information. +platform: linux +log_source: osquery +event_code: elf_dynamic +event_fields: +- standard_name: TBD + standard_type: TBD + name: tag + type: INTEGER + description: Tag ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: INTEGER + description: Tag value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: INTEGER + description: Class (32 or 64) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to ELF file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#elf_dynamic +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/elf_info.yml b/source/data_dictionaries/linux/osquery/events/elf_info.yml new file mode 100644 index 000000000..b33a64870 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/elf_info.yml @@ -0,0 +1,65 @@ +title: Elf_info Table +description: ELF file information. +platform: linux +log_source: osquery +event_code: elf_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: Class type, 32 or 64bit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: abi + type: TEXT + description: Section type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: abi_version + type: INTEGER + description: Section virtual address in memory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Offset of section in file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: machine + type: INTEGER + description: Machine type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: INTEGER + description: Object file version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: entry + type: BIGINT + description: Entry point address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: ELF header flags + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to ELF file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#elf_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/elf_sections.yml b/source/data_dictionaries/linux/osquery/events/elf_sections.yml new file mode 100644 index 000000000..6601916a1 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/elf_sections.yml @@ -0,0 +1,65 @@ +title: Elf_sections Table +description: ELF section information. +platform: linux +log_source: osquery +event_code: elf_sections +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Section name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: Section type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vaddr + type: INTEGER + description: Section virtual address in memory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offset + type: INTEGER + description: Offset of section in file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of section + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: TEXT + description: Section attributes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: link + type: TEXT + description: Link to other section + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: align + type: INTEGER + description: Segment alignment + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to ELF file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#elf_sections +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/elf_segments.yml b/source/data_dictionaries/linux/osquery/events/elf_segments.yml new file mode 100644 index 000000000..4e39741e7 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/elf_segments.yml @@ -0,0 +1,59 @@ +title: Elf_segments Table +description: ELF segment information. +platform: linux +log_source: osquery +event_code: elf_segments +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Segment type/name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offset + type: INTEGER + description: Segment offset in file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vaddr + type: INTEGER + description: Segment virtual address in memory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: psize + type: INTEGER + description: Size of segment in file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: msize + type: INTEGER + description: Segment offset in memory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: TEXT + description: Segment attributes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: align + type: INTEGER + description: Segment alignment + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to ELF file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#elf_segments +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/elf_symbols.yml b/source/data_dictionaries/linux/osquery/events/elf_symbols.yml new file mode 100644 index 000000000..690dc608e --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/elf_symbols.yml @@ -0,0 +1,59 @@ +title: Elf_symbols Table +description: ELF symbol list. +platform: linux +log_source: osquery +event_code: elf_symbols +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Symbol name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: addr + type: INTEGER + description: Symbol address (value) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of object + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Symbol type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: binding + type: TEXT + description: Binding type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offset + type: INTEGER + description: Section table index + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: table + type: TEXT + description: Table name containing symbol + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to ELF file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#elf_symbols +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/etc_hosts.yml b/source/data_dictionaries/linux/osquery/events/etc_hosts.yml new file mode 100644 index 000000000..c38e29645 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/etc_hosts.yml @@ -0,0 +1,23 @@ +title: Etc_hosts Table +description: Line-parsed /etc/hosts. +platform: linux +log_source: osquery +event_code: etc_hosts +event_fields: +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: IP address mapping + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hostnames + type: TEXT + description: Raw hosts mapping + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_hosts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/etc_protocols.yml b/source/data_dictionaries/linux/osquery/events/etc_protocols.yml new file mode 100644 index 000000000..d09a172ff --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/etc_protocols.yml @@ -0,0 +1,35 @@ +title: Etc_protocols Table +description: Line-parsed /etc/protocols. +platform: linux +log_source: osquery +event_code: etc_protocols +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Protocol name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: number + type: INTEGER + description: Protocol number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: alias + type: TEXT + description: Protocol alias + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Comment with protocol description + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_protocols +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/etc_services.yml b/source/data_dictionaries/linux/osquery/events/etc_services.yml new file mode 100644 index 000000000..9cb6e3172 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/etc_services.yml @@ -0,0 +1,41 @@ +title: Etc_services Table +description: Line-parsed /etc/services. +platform: linux +log_source: osquery +event_code: etc_services +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Service name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Service port number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: TEXT + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: aliases + type: TEXT + description: Optional space separated list of other names for a service + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Optional comment for a service. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_services +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/example.yml b/source/data_dictionaries/linux/osquery/events/example.yml new file mode 100644 index 000000000..c8272ba23 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/example.yml @@ -0,0 +1,47 @@ +title: Example Table +description: This is an example table spec. +platform: linux +log_source: osquery +event_code: example +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Description for name column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: points + type: INTEGER + description: This is a signed SQLite int column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: This is a signed SQLite bigint column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Action performed in generation + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: id + type: INTEGER + description: An index of some sort + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of example + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#example +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/file.yml b/source/data_dictionaries/linux/osquery/events/file.yml index 1bd39ab2b..83be91833 100644 --- a/source/data_dictionaries/linux/osquery/events/file.yml +++ b/source/data_dictionaries/linux/osquery/events/file.yml @@ -4,109 +4,110 @@ platform: linux log_source: osquery event_code: file event_fields: -- standard_name: file _path +- standard_name: file_path standard_type: TBD name: path type: TEXT description: Absolute file path - sample_value: '' -- standard_name: file_directory + sample_value: file_directory +- standard_name: TBD standard_type: TBD name: directory type: TEXT description: Directory of file(s) - sample_value: '' + sample_value: TBD - standard_name: file_name standard_type: TBD name: filename type: TEXT description: Name portion of file path - sample_value: '' + sample_value: TBD - standard_name: file_inode standard_type: TBD name: inode type: BIGINT description: Filesystem inode number - sample_value: '' + sample_value: TBD - standard_name: user_uid standard_type: TBD name: uid type: BIGINT description: Owning user ID - sample_value: '' + sample_value: TBD - standard_name: user_gid standard_type: TBD name: gid type: BIGINT description: Owning group ID - sample_value: '' + sample_value: TBD - standard_name: user_permissions standard_type: TBD name: mode type: TEXT description: Permission bits - sample_value: '' + sample_value: TBD - standard_name: device_id standard_type: TBD name: device type: BIGINT description: Device ID (optional) - sample_value: '' + sample_value: TBD - standard_name: file_size standard_type: TBD name: size type: BIGINT description: Size of file in bytes - sample_value: '' + sample_value: TBD - standard_name: file_system_block_size standard_type: TBD name: block_size type: INTEGER description: Block size of filesystem - sample_value: '' + sample_value: TBD - standard_name: date_last_access standard_type: TBD name: atime type: BIGINT description: Last access time - sample_value: '' + sample_value: TBD - standard_name: date_last_modification standard_type: TBD name: mtime type: BIGINT description: Last modification time - sample_value: '' + sample_value: TBD - standard_name: date_last_status_change standard_type: TBD name: ctime type: BIGINT description: Last status change time - sample_value: '' + sample_value: TBD - standard_name: date_creation_time standard_type: TBD name: btime type: BIGINT description: (B)irth or (cr)eate time - sample_value: '' + sample_value: TBD - standard_name: file_hard_links standard_type: TBD name: hard_links type: INTEGER description: Number of hard links - sample_value: '' + sample_value: TBD - standard_name: file_symlink standard_type: TBD name: symlink type: INTEGER description: 1 if the path is a symlink, otherwise 0 - sample_value: '' + sample_value: TBD - standard_name: file_type standard_type: TBD name: type type: TEXT description: File status - sample_value: '' + sample_value: TBD references: -- text: osquery GitHub - link: https://github.com/facebook/osquery/blob/master/specs/utility/file.table -tags: [] +- text: OSQuery table documentation + link: https://osquery.io/schema/current#file +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/file_events.yml b/source/data_dictionaries/linux/osquery/events/file_events.yml new file mode 100644 index 000000000..1608eda03 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/file_events.yml @@ -0,0 +1,113 @@ +title: File_events Table +description: Track time/action changes to files specified in configuration data. +platform: linux +log_source: osquery +event_code: file_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: target_path + type: TEXT + description: The path associated with the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: category + type: TEXT + description: The category of the file defined in the config + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Change action (UPDATE, REMOVE, etc) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: transaction_id + type: BIGINT + description: ID used during bulk update + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: BIGINT + description: Filesystem inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Owning user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Owning group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: Permission bits + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Size of file in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: atime + type: BIGINT + description: Last access time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: BIGINT + description: Last modification time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ctime + type: BIGINT + description: Last status change time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: The MD5 of the file after change + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: The SHA1 of the file after change + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: The SHA256 of the file after change + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of file event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#file_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/firefox_addons.yml b/source/data_dictionaries/linux/osquery/events/firefox_addons.yml new file mode 100644 index 000000000..052d35e79 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/firefox_addons.yml @@ -0,0 +1,83 @@ +title: Firefox_addons Table +description: Firefox browser extensions, webapps, and addons. +platform: linux +log_source: osquery +event_code: firefox_addons +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the addon + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Addon display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Addon identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: creator + type: TEXT + description: Addon-supported creator string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Extension, addon, webapp + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Addon-supplied version string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Addon-supplied description string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source_url + type: TEXT + description: URL that installed the addon + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: visible + type: INTEGER + description: 1 If the addon is shown in browser else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: 1 If the addon is active else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: location + type: TEXT + description: Global, profile location + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to plugin bundle + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#firefox_addons +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/groups.yml b/source/data_dictionaries/linux/osquery/events/groups.yml new file mode 100644 index 000000000..c2a28ef76 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/groups.yml @@ -0,0 +1,47 @@ +title: Groups Table +description: Local system groups. +platform: linux +log_source: osquery +event_code: groups +event_fields: +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Unsigned int64 group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid_signed + type: BIGINT + description: A signed int64 version of gid + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: groupname + type: TEXT + description: Canonical local group name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: group_sid + type: TEXT + description: Unique group ID [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Remarks or comments associated with the group [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_hidden + type: INTEGER + description: IsHidden attribute set in OpenDirectory [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#groups +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/hardware_events.yml b/source/data_dictionaries/linux/osquery/events/hardware_events.yml new file mode 100644 index 000000000..1e1cb2acc --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/hardware_events.yml @@ -0,0 +1,83 @@ +title: Hardware_events Table +description: Hardware (PCI/USB/HID) events from UDEV or IOKit. +platform: linux +log_source: osquery +event_code: hardware_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Remove, insert, change properties, etc + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Local device path assigned (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of hardware and hardware event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Driver claiming the device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: Hardware device vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor_id + type: TEXT + description: Hex encoded Hardware vendor identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: Hardware device model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model_id + type: TEXT + description: Hex encoded Hardware model identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial + type: TEXT + description: Device serial (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: revision + type: TEXT + description: Device revision (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of hardware event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#hardware_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/hash.yml b/source/data_dictionaries/linux/osquery/events/hash.yml new file mode 100644 index 000000000..be2626d5e --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/hash.yml @@ -0,0 +1,47 @@ +title: Hash Table +description: Filesystem hash data. +platform: linux +log_source: osquery +event_code: hash +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Must provide a path or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: Must provide a path or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: MD5 hash of provided filesystem data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: SHA1 hash of provided filesystem data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: SHA256 hash of provided filesystem data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssdeep + type: TEXT + description: ssdeep hash of provided filesystem data [POSIX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#hash +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/hvci_status.yml b/source/data_dictionaries/linux/osquery/events/hvci_status.yml new file mode 100644 index 000000000..c3755f2d9 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/hvci_status.yml @@ -0,0 +1,44 @@ +title: Hvci_status Table +description: Retrieve HVCI info of the machine. +platform: linux +log_source: osquery +event_code: hvci_status +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: The version number of the Device Guard build. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: instance_identifier + type: TEXT + description: The instance ID of Device Guard. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vbs_status + type: TEXT + description: The status of the virtualization based security settings. Returns UNKNOWN + if an error is encountered. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: code_integrity_policy_enforcement_status + type: TEXT + description: The status of the code integrity policy enforcement settings. Returns + UNKNOWN if an error is encountered. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: umci_policy_status + type: TEXT + description: The status of the User Mode Code Integrity security settings. Returns + UNKNOWN if an error is encountered. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#hvci_status +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/intel_me_info.yml b/source/data_dictionaries/linux/osquery/events/intel_me_info.yml new file mode 100644 index 000000000..f5b16ba20 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/intel_me_info.yml @@ -0,0 +1,17 @@ +title: Intel_me_info Table +description: Intel ME/CSE Info. +platform: linux +log_source: osquery +event_code: intel_me_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: ' TEXT' + description: Intel ME version + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#intel_me_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/interface_addresses.yml b/source/data_dictionaries/linux/osquery/events/interface_addresses.yml new file mode 100644 index 000000000..b2cf676df --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/interface_addresses.yml @@ -0,0 +1,53 @@ +title: Interface_addresses Table +description: Network interfaces and relevant metadata. +platform: linux +log_source: osquery +event_code: interface_addresses +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Specific address for interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mask + type: TEXT + description: Interface netmask + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: broadcast + type: TEXT + description: Broadcast address for the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: point_to_point + type: TEXT + description: PtP address for the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of address. One of dhcp, manual, auto, other, unknown + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: friendly_name + type: TEXT + description: The friendly display name of the interface. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_addresses +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/interface_details.yml b/source/data_dictionaries/linux/osquery/events/interface_details.yml new file mode 100644 index 000000000..f7f0d5d34 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/interface_details.yml @@ -0,0 +1,231 @@ +title: Interface_details Table +description: Detailed information and stats of network interfaces. +platform: linux +log_source: osquery +event_code: interface_details +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac + type: TEXT + description: MAC of interface (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: Interface type (includes virtual) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtu + type: INTEGER + description: Network MTU + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric + type: INTEGER + description: Metric based on the speed of the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: Flags (netdevice) for the device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipackets + type: BIGINT + description: Input packets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: opackets + type: BIGINT + description: Output packets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ibytes + type: BIGINT + description: Input bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: obytes + type: BIGINT + description: Output bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ierrors + type: BIGINT + description: Input errors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: oerrors + type: BIGINT + description: Output errors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: idrops + type: BIGINT + description: Input drops + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: odrops + type: BIGINT + description: Output drops + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collisions + type: BIGINT + description: Packet Collisions detected + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_change + type: BIGINT + description: Time of last device modification (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: link_speed + type: BIGINT + description: Interface speed in Mb/s [POSIX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_slot + type: TEXT + description: PCI slot number [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: friendly_name + type: TEXT + description: The friendly display name of the interface. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Short description of the object a one-line string. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: Name of the network adapter's manufacturer. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: connection_id + type: TEXT + description: Name of the network connection as it appears in the Network Connections + Control Panel program. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: connection_status + type: TEXT + description: State of the network adapter connection to the network. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: INTEGER + description: Indicates whether the adapter is enabled or not. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: physical_adapter + type: INTEGER + description: Indicates whether the adapter is a physical or a logical adapter. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: speed + type: INTEGER + description: Estimate of the current bandwidth in bits per second. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: service + type: TEXT + description: The name of the service the network adapter uses. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_enabled + type: INTEGER + description: If TRUE, the dynamic host configuration protocol (DHCP) server automatically + assigns an IP address to the computer system when establishing a network connection. + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_lease_expires + type: TEXT + description: Expiration date and time for a leased IP address that was assigned + to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_lease_obtained + type: TEXT + description: Date and time the lease was obtained for the IP address assigned to + the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_server + type: TEXT + description: IP address of the dynamic host configuration protocol (DHCP) server. + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_domain + type: TEXT + description: Organization name followed by a period and an extension that indicates + the type of organization, such as 'microsoft.com'. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_domain_suffix_search_order + type: TEXT + description: Array of DNS domain suffixes to be appended to the end of host names + during name resolution. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_host_name + type: TEXT + description: Host name used to identify the local computer for authentication by + some utilities. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_server_search_order + type: TEXT + description: Array of server IP addresses to be used in querying for DNS servers. + [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_details +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/interface_ipv6.yml b/source/data_dictionaries/linux/osquery/events/interface_ipv6.yml new file mode 100644 index 000000000..823e1d2eb --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/interface_ipv6.yml @@ -0,0 +1,41 @@ +title: Interface_ipv6 Table +description: IPv6 configuration and stats of network interfaces. +platform: linux +log_source: osquery +event_code: interface_ipv6 +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hop_limit + type: INTEGER + description: Current Hop Limit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: forwarding_enabled + type: INTEGER + description: Enable IP forwarding + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: redirect_accept + type: INTEGER + description: Accept ICMP redirect messages + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rtadv_accept + type: INTEGER + description: Accept ICMP Router Advertisement + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_ipv6 +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/iptables.yml b/source/data_dictionaries/linux/osquery/events/iptables.yml new file mode 100644 index 000000000..3827d2881 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/iptables.yml @@ -0,0 +1,119 @@ +title: Iptables Table +description: Linux IP packet filtering and NAT tool. +platform: linux +log_source: osquery +event_code: iptables +event_fields: +- standard_name: TBD + standard_type: TBD + name: filter_name + type: TEXT + description: Packet matching filter table name. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chain + type: TEXT + description: Size of module content. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: policy + type: TEXT + description: Policy that applies for this rule. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: target + type: TEXT + description: Target that applies for this rule. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: INTEGER + description: Protocol number identification. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: src_port + type: TEXT + description: Protocol source port(s). + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dst_port + type: TEXT + description: Protocol destination port(s). + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: src_ip + type: TEXT + description: Source IP address. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: src_mask + type: TEXT + description: Source IP address mask. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: iniface + type: TEXT + description: Input interface for the rule. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: iniface_mask + type: TEXT + description: Input interface mask for the rule. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dst_ip + type: TEXT + description: Destination IP address. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dst_mask + type: TEXT + description: Destination IP address mask. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: outiface + type: TEXT + description: Output interface for the rule. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: outiface_mask + type: TEXT + description: Output interface mask for the rule. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: match + type: TEXT + description: Matching rule that applies. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: packets + type: INTEGER + description: Number of matching packets for this rule. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bytes + type: INTEGER + description: Number of matching bytes for this rule. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#iptables +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/kernel_info.yml b/source/data_dictionaries/linux/osquery/events/kernel_info.yml new file mode 100644 index 000000000..6d117eb3a --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/kernel_info.yml @@ -0,0 +1,35 @@ +title: Kernel_info Table +description: Basic active kernel information. +platform: linux +log_source: osquery +event_code: kernel_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Kernel version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: arguments + type: TEXT + description: Kernel arguments + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Kernel path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Kernel device identifier + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#kernel_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/kernel_modules.yml b/source/data_dictionaries/linux/osquery/events/kernel_modules.yml new file mode 100644 index 000000000..a44a13b8d --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/kernel_modules.yml @@ -0,0 +1,41 @@ +title: Kernel_modules Table +description: Linux kernel modules both loaded and within the load search path. +platform: linux +log_source: osquery +event_code: kernel_modules +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Module name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: TEXT + description: Size of module content + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: used_by + type: TEXT + description: Module reverse dependencies + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Kernel module status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Kernel module address + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#kernel_modules +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/known_hosts.yml b/source/data_dictionaries/linux/osquery/events/known_hosts.yml new file mode 100644 index 000000000..5135cc210 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/known_hosts.yml @@ -0,0 +1,29 @@ +title: Known_hosts Table +description: A line-delimited known_hosts table. +platform: linux +log_source: osquery +event_code: known_hosts +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the known_hosts file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: parsed authorized keys line + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_file + type: TEXT + description: Path to known_hosts file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#known_hosts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/last.yml b/source/data_dictionaries/linux/osquery/events/last.yml new file mode 100644 index 000000000..955c7054f --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/last.yml @@ -0,0 +1,47 @@ +title: Last Table +description: System logins and logouts. +platform: linux +log_source: osquery +event_code: last +event_fields: +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Entry username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tty + type: TEXT + description: Entry terminal + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: Entry type, according to ut_type types (utmp.h) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Entry timestamp + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host + type: TEXT + description: Entry hostname + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#last +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/listening_ports.yml b/source/data_dictionaries/linux/osquery/events/listening_ports.yml new file mode 100644 index 000000000..00b464d4c --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/listening_ports.yml @@ -0,0 +1,65 @@ +title: Listening_ports Table +description: Processes with listening (bound) network sockets/ports. +platform: linux +log_source: osquery +event_code: listening_ports +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Transport layer port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: INTEGER + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: family + type: INTEGER + description: Network protocol (IPv4, IPv6) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Specific address for bind + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Socket file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: socket + type: BIGINT + description: Socket handle or inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path for UNIX domain sockets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: The inode number of the network namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#listening_ports +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/lldp_neighbors.yml b/source/data_dictionaries/linux/osquery/events/lldp_neighbors.yml new file mode 100644 index 000000000..141bf7629 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/lldp_neighbors.yml @@ -0,0 +1,425 @@ +title: Lldp_neighbors Table +description: LLDP neighbors of interfaces. +platform: linux +log_source: osquery +event_code: lldp_neighbors +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rid + type: INTEGER + description: Neighbor chassis index + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_id_type + type: TEXT + description: Neighbor chassis ID type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_id + type: TEXT + description: Neighbor chassis ID value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_sysname + type: TEXT + description: CPU brand string, contains vendor and model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_sys_description + type: INTEGER + description: Max number of CPU physical cores + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_bridge_capability_available + type: INTEGER + description: Chassis bridge capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_bridge_capability_enabled + type: INTEGER + description: Is chassis bridge capability enabled. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_router_capability_available + type: INTEGER + description: Chassis router capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_router_capability_enabled + type: INTEGER + description: Chassis router capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_repeater_capability_available + type: INTEGER + description: Chassis repeater capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_repeater_capability_enabled + type: INTEGER + description: Chassis repeater capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_wlan_capability_available + type: INTEGER + description: Chassis wlan capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_wlan_capability_enabled + type: INTEGER + description: Chassis wlan capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_tel_capability_available + type: INTEGER + description: Chassis telephone capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_tel_capability_enabled + type: INTEGER + description: Chassis telephone capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_docsis_capability_available + type: INTEGER + description: Chassis DOCSIS capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_docsis_capability_enabled + type: INTEGER + description: Chassis DOCSIS capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_station_capability_available + type: INTEGER + description: Chassis station capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_station_capability_enabled + type: INTEGER + description: Chassis station capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_other_capability_available + type: INTEGER + description: Chassis other capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_other_capability_enabled + type: INTEGER + description: Chassis other capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_mgmt_ips + type: TEXT + description: Comma delimited list of chassis management IPS + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_id_type + type: TEXT + description: Port ID type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_id + type: TEXT + description: Port ID value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_description + type: TEXT + description: Port description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_ttl + type: BIGINT + description: Age of neighbor port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_mfs + type: BIGINT + description: Port max frame size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_aggregation_id + type: TEXT + description: Port aggregation ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_supported + type: INTEGER + description: Auto negotiation supported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_enabled + type: INTEGER + description: Is auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_mau_type + type: TEXT + description: MAU type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_10baset_hd_enabled + type: INTEGER + description: 10Base-T HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_10baset_fd_enabled + type: INTEGER + description: 10Base-T FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100basetx_hd_enabled + type: INTEGER + description: 100Base-TX HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100basetx_fd_enabled + type: INTEGER + description: 100Base-TX FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset2_hd_enabled + type: INTEGER + description: 100Base-T2 HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset2_fd_enabled + type: INTEGER + description: 100Base-T2 FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset4_hd_enabled + type: INTEGER + description: 100Base-T4 HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset4_fd_enabled + type: INTEGER + description: 100Base-T4 FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000basex_hd_enabled + type: INTEGER + description: 1000Base-X HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000basex_fd_enabled + type: INTEGER + description: 1000Base-X FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000baset_hd_enabled + type: INTEGER + description: 1000Base-T HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000baset_fd_enabled + type: INTEGER + description: 1000Base-T FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_device_type + type: TEXT + description: Dot3 power device type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_mdi_supported + type: INTEGER + description: MDI power supported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_mdi_enabled + type: INTEGER + description: Is MDI power enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_paircontrol_enabled + type: INTEGER + description: Is power pair control enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_pairs + type: TEXT + description: Dot3 power pairs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_class + type: TEXT + description: Power class + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_enabled + type: INTEGER + description: Is 802.3at enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_type + type: TEXT + description: 802.3at power type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_source + type: TEXT + description: 802.3at power source + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_priority + type: TEXT + description: 802.3at power priority + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_allocated + type: TEXT + description: 802.3at power allocated + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_requested + type: TEXT + description: 802.3at power requested + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_device_type + type: TEXT + description: Chassis MED type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_capabilities + type: INTEGER + description: Is MED capabilities enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_policy + type: INTEGER + description: Is MED policy capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_location + type: INTEGER + description: Is MED location capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_mdi_pse + type: INTEGER + description: Is MED MDI PSE capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_mdi_pd + type: INTEGER + description: Is MED MDI PD capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_inventory + type: INTEGER + description: Is MED inventory capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_policies + type: TEXT + description: Comma delimited list of MED policies + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vlans + type: TEXT + description: Comma delimited list of vlan ids + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pvid + type: TEXT + description: Primary VLAN id + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ppvids_supported + type: TEXT + description: Comma delimited list of supported PPVIDs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ppvids_enabled + type: TEXT + description: Comma delimited list of enabled PPVIDs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pids + type: TEXT + description: Comma delimited list of PIDs + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#lldp_neighbors +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/load_average.yml b/source/data_dictionaries/linux/osquery/events/load_average.yml new file mode 100644 index 000000000..f7c7d295a --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/load_average.yml @@ -0,0 +1,23 @@ +title: Load_average Table +description: Displays information about the system wide load averages. +platform: linux +log_source: osquery +event_code: load_average +event_fields: +- standard_name: TBD + standard_type: TBD + name: period + type: TEXT + description: Period over which the average is calculated. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: average + type: TEXT + description: Load average over the specified period. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#load_average +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/logged_in_users.yml b/source/data_dictionaries/linux/osquery/events/logged_in_users.yml new file mode 100644 index 000000000..146037542 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/logged_in_users.yml @@ -0,0 +1,59 @@ +title: Logged_in_users Table +description: Users with an active shell on the system. +platform: linux +log_source: osquery +event_code: logged_in_users +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Login type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: TEXT + description: User login name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tty + type: TEXT + description: Device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host + type: TEXT + description: Remote hostname + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Time entry was made + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sid + type: TEXT + description: The user's unique security identifier [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: registry_hive + type: TEXT + description: HKEY_USERS registry hive [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#logged_in_users +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/magic.yml b/source/data_dictionaries/linux/osquery/events/magic.yml new file mode 100644 index 000000000..6b340a9a5 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/magic.yml @@ -0,0 +1,43 @@ +title: Magic Table +description: Magic number recognition library table. +platform: linux +log_source: osquery +event_code: magic +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Absolute path to target file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: magic_db_files + type: TEXT + description: 'Colon(:) separated list of files where the magic db file can be found. + By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic + or /usr/share/misc/magic.mgc' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: data + type: TEXT + description: Magic number data from libmagic + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mime_type + type: TEXT + description: MIME type data from libmagic + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mime_encoding + type: TEXT + description: MIME encoding data from libmagic + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#magic +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/md_devices.yml b/source/data_dictionaries/linux/osquery/events/md_devices.yml new file mode 100644 index 000000000..26d701974 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/md_devices.yml @@ -0,0 +1,179 @@ +title: Md_devices Table +description: Software RAID array settings. +platform: linux +log_source: osquery +event_code: md_devices +event_fields: +- standard_name: TBD + standard_type: TBD + name: device_name + type: TEXT + description: md device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Current state of the array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: raid_level + type: INTEGER + description: Current raid level of the array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: size of the array in blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chunk_size + type: BIGINT + description: chunk size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: raid_disks + type: INTEGER + description: Number of configured RAID disks in array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: working_disks + type: INTEGER + description: Number of working disks in array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active_disks + type: INTEGER + description: Number of active disks in array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: failed_disks + type: INTEGER + description: Number of active disks in array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: spare_disks + type: INTEGER + description: Number of active disks in array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: superblock_state + type: TEXT + description: State of the superblock + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: superblock_version + type: TEXT + description: Version of the superblock + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: superblock_update_time + type: BIGINT + description: Unix timestamp of last update + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bitmap_chunk_size + type: TEXT + description: Bitmap chunk size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bitmap_external_file + type: TEXT + description: External referenced bitmap file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: recovery_progress + type: TEXT + description: Progress of the recovery activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: recovery_finish + type: TEXT + description: Estimated duration of recovery activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: recovery_speed + type: TEXT + description: Speed of recovery activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resync_progress + type: TEXT + description: Progress of the resync activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resync_finish + type: TEXT + description: Estimated duration of resync activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resync_speed + type: TEXT + description: Speed of resync activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: reshape_progress + type: TEXT + description: Progress of the reshape activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: reshape_finish + type: TEXT + description: Estimated duration of reshape activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: reshape_speed + type: TEXT + description: Speed of reshape activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: check_array_progress + type: TEXT + description: Progress of the resync activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: check_array_finish + type: TEXT + description: Estimated duration of resync activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: check_array_speed + type: TEXT + description: Speed of resync activity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: unused_devices + type: TEXT + description: Unused devices + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#md_devices +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/md_drives.yml b/source/data_dictionaries/linux/osquery/events/md_drives.yml new file mode 100644 index 000000000..f4ee5e000 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/md_drives.yml @@ -0,0 +1,35 @@ +title: Md_drives Table +description: Drive devices used for Software RAID. +platform: linux +log_source: osquery +event_code: md_drives +event_fields: +- standard_name: TBD + standard_type: TBD + name: md_device_name + type: TEXT + description: md device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: drive_name + type: TEXT + description: Drive device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: slot + type: INTEGER + description: Slot position of disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: State of the drive + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#md_drives +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/md_personalities.yml b/source/data_dictionaries/linux/osquery/events/md_personalities.yml new file mode 100644 index 000000000..8accfbbdc --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/md_personalities.yml @@ -0,0 +1,17 @@ +title: Md_personalities Table +description: Software RAID setting supported by the kernel. +platform: linux +log_source: osquery +event_code: md_personalities +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of personality supported by kernel + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#md_personalities +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/memory_array_mapped_addresses.yml b/source/data_dictionaries/linux/osquery/events/memory_array_mapped_addresses.yml new file mode 100644 index 000000000..1331a3ec0 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/memory_array_mapped_addresses.yml @@ -0,0 +1,17 @@ +title: Memory_array_mapped_addresses Table +description: Data associated for address mapping of physical memory arrays. +platform: linux +log_source: osquery +event_code: memory_array_mapped_addresses +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: ' TEXT' + description: Handle, or instance number, associated with the structure + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_array_mapped_addresses +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/memory_arrays.yml b/source/data_dictionaries/linux/osquery/events/memory_arrays.yml new file mode 100644 index 000000000..8b1345ce4 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/memory_arrays.yml @@ -0,0 +1,42 @@ +title: Memory_arrays Table +description: Data associated with collection of memory devices that operate to form + a memory address. +platform: linux +log_source: osquery +event_code: memory_arrays +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: ' TEXT' + description: Handle, or instance number, associated with the array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: location + type: ' TEXT' + description: Physical location of the memory array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: use + type: TEXT + description: Function for which the array is used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: max_capacity + type: INTEGER + description: Maximum capacity of array in gigabytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: number_memory_devices + type: INTEGER + description: Number of memory devices on array + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_arrays +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/memory_device_mapped_addresses.yml b/source/data_dictionaries/linux/osquery/events/memory_device_mapped_addresses.yml new file mode 100644 index 000000000..7ec3a1479 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/memory_device_mapped_addresses.yml @@ -0,0 +1,17 @@ +title: Memory_device_mapped_addresses Table +description: Data associated for address mapping of physical memory devices. +platform: linux +log_source: osquery +event_code: memory_device_mapped_addresses +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: ' TEXT' + description: Handle, or instance number, associated with the structure + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_device_mapped_addresses +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/memory_devices.yml b/source/data_dictionaries/linux/osquery/events/memory_devices.yml new file mode 100644 index 000000000..bf06fe001 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/memory_devices.yml @@ -0,0 +1,135 @@ +title: Memory_devices Table +description: Physical memory device (type 17) information retrieved from SMBIOS. +platform: linux +log_source: osquery +event_code: memory_devices +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: ' TEXT' + description: Handle, or instance number, associated with the structure in SMBIOS + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: array_handle + type: ' TEXT' + description: The memory array that the device is attached to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: form_factor + type: TEXT + description: Implementation form factor for this memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_width + type: INTEGER + description: Total width, in bits, of this memory device, including any check or + error-correction bits + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: data_width + type: INTEGER + description: Data width, in bits, of this memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of memory device in Megabyte + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: set + type: INTEGER + description: Identifies if memory device is one of a set of devices. A value of + 0 indicates no set affiliation. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device_locator + type: TEXT + description: String number of the string that identifies the physically-labeled + socket or board position where the memory device is located + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bank_locator + type: TEXT + description: String number of the string that identifies the physically-labeled + bank where the memory device is located + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_type + type: TEXT + description: Type of memory used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_type_details + type: TEXT + description: Additional details for memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: max_speed + type: INTEGER + description: Max speed of memory device in megatransfers per second (MT/s) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: configured_clock_speed + type: INTEGER + description: Configured speed of memory device in megatransfers per second (MT/s) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: Manufacturer ID string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial_number + type: TEXT + description: Serial number of memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: asset_tag + type: TEXT + description: Manufacturer specific asset tag of memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: part_number + type: TEXT + description: Manufacturer specific serial number of memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: min_voltage + type: INTEGER + description: Minimum operating voltage of device in millivolts + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: max_voltage + type: INTEGER + description: Maximum operating voltage of device in millivolts + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: configured_voltage + type: INTEGER + description: Configured operating voltage of device in millivolts + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_devices +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/memory_error_info.yml b/source/data_dictionaries/linux/osquery/events/memory_error_info.yml new file mode 100644 index 000000000..10ccf8d20 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/memory_error_info.yml @@ -0,0 +1,17 @@ +title: Memory_error_info Table +description: Data associated with errors of a physical memory array. +platform: linux +log_source: osquery +event_code: memory_error_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: ' TEXT' + description: Handle, or instance number, associated with the structure + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_error_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/memory_info.yml b/source/data_dictionaries/linux/osquery/events/memory_info.yml new file mode 100644 index 000000000..36af094a3 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/memory_info.yml @@ -0,0 +1,67 @@ +title: Memory_info Table +description: Main memory information in bytes. +platform: linux +log_source: osquery +event_code: memory_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: memory_total + type: ' BIGINT' + description: Total amount of physical RAM, in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_free + type: BIGINT + description: The amount of physical RAM, in bytes, left unused by the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: buffers + type: BIGINT + description: The amount of physical RAM, in bytes, used for file buffers + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cached + type: BIGINT + description: The amount of physical RAM, in bytes, used as cache memory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: swap_cached + type: BIGINT + description: The amount of swap, in bytes, used as cache memory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: BIGINT + description: The total amount of buffer or page cache memory, in bytes, that is + in active use + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inactive + type: BIGINT + description: The total amount of buffer or page cache memory, in bytes, that are + free and available + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: swap_total + type: BIGINT + description: The total amount of swap available, in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: swap_free + type: BIGINT + description: The total amount of swap free, in bytes + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/memory_map.yml b/source/data_dictionaries/linux/osquery/events/memory_map.yml new file mode 100644 index 000000000..f58e8dfc9 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/memory_map.yml @@ -0,0 +1,29 @@ +title: Memory_map Table +description: OS memory region map. +platform: linux +log_source: osquery +event_code: memory_map +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Region name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start + type: TEXT + description: Start address of memory region + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: end + type: TEXT + description: End address of memory region + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_map +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/mounts.yml b/source/data_dictionaries/linux/osquery/events/mounts.yml new file mode 100644 index 000000000..90756af67 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/mounts.yml @@ -0,0 +1,77 @@ +title: Mounts Table +description: System mounted devices and filesystems (not process specific). +platform: linux +log_source: osquery +event_code: mounts +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Mounted device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device_alias + type: TEXT + description: Mounted device alias + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Mounted device path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Mounted device type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_size + type: BIGINT + description: Block size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks + type: BIGINT + description: Mounted device used blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_free + type: BIGINT + description: Mounted device free blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_available + type: BIGINT + description: Mounted device available blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inodes + type: BIGINT + description: Mounted device used inodes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inodes_free + type: BIGINT + description: Mounted device free inodes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: TEXT + description: Mounted device flags + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#mounts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/msr.yml b/source/data_dictionaries/linux/osquery/events/msr.yml new file mode 100644 index 000000000..0e0732c95 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/msr.yml @@ -0,0 +1,47 @@ +title: Msr Table +description: 'Various pieces of data stored in the model specific register per ' +platform: linux +log_source: osquery +event_code: msr +event_fields: +- standard_name: TBD + standard_type: TBD + name: turbo_disabled + type: BIGINT + description: Whether the turbo feature is disabled. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: turbo_ratio_limit + type: BIGINT + description: The turbo feature ratio limit. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_info + type: BIGINT + description: Platform information. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: perf_ctl + type: BIGINT + description: Performance setting for the processor. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: perf_status + type: BIGINT + description: Performance status for the processor. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: feature_control + type: BIGINT + description: Bitfield controlling enabled features. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#msr +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/npm_packages.yml b/source/data_dictionaries/linux/osquery/events/npm_packages.yml new file mode 100644 index 000000000..2483a2ea3 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/npm_packages.yml @@ -0,0 +1,53 @@ +title: Npm_packages Table +description: Lists all npm packages in a directory or globally installed in a system. +platform: linux +log_source: osquery +event_code: npm_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Package supplied description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Package author name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: license + type: TEXT + description: License for package + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Module's package.json path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: Node module's directory where this package is located + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#npm_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/oem_strings.yml b/source/data_dictionaries/linux/osquery/events/oem_strings.yml new file mode 100644 index 000000000..09d64495c --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/oem_strings.yml @@ -0,0 +1,29 @@ +title: Oem_strings Table +description: OEM defined strings retrieved from SMBIOS. +platform: linux +log_source: osquery +event_code: oem_strings +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: TEXT + description: Handle, or instance number, associated with the Type 11 structure + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: number + type: INTEGER + description: The string index of the structure + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: The value of the OEM string + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#oem_strings +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/opera_extensions.yml b/source/data_dictionaries/linux/osquery/events/opera_extensions.yml new file mode 100644 index 000000000..c06da3b12 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/opera_extensions.yml @@ -0,0 +1,65 @@ +title: Opera_extensions Table +description: Opera browser extensions. +platform: linux +log_source: osquery +event_code: opera_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Extension identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Extension-optional description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: locale + type: TEXT + description: Default locale supported by extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: update_url + type: TEXT + description: Extension-supplied update URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional extension author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to extension folder + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#opera_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/os_version.yml b/source/data_dictionaries/linux/osquery/events/os_version.yml new file mode 100644 index 000000000..fc53523c6 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/os_version.yml @@ -0,0 +1,71 @@ +title: Os_version Table +description: A single row containing the operating system name and version. +platform: linux +log_source: osquery +event_code: os_version +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Distribution or product name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Pretty, suitable for presentation, OS version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: major + type: INTEGER + description: Major release version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minor + type: INTEGER + description: Minor release version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: patch + type: INTEGER + description: Optional patch release + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build + type: TEXT + description: Optional build-specific or variant string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform + type: TEXT + description: OS Platform or ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_like + type: TEXT + description: Closely related platforms + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: codename + type: TEXT + description: OS version codename + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_date + type: TEXT + description: The install date of the OS. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#os_version +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/osquery_events.yml b/source/data_dictionaries/linux/osquery/events/osquery_events.yml new file mode 100644 index 000000000..c1fc26685 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/osquery_events.yml @@ -0,0 +1,35 @@ +title: Osquery_events Table +description: Information about the event publishers and subscribers. +platform: linux +log_source: osquery +event_code: osquery_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Event publisher or subscriber name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: publisher + type: TEXT + description: Name of the associated publisher + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Either publisher or subscriber + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: refreshes + type: INTEGER + description: 'Publisher only: number of runloop restarts' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/osquery_extensions.yml b/source/data_dictionaries/linux/osquery/events/osquery_extensions.yml new file mode 100644 index 000000000..b001a435f --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/osquery_extensions.yml @@ -0,0 +1,47 @@ +title: Osquery_extensions Table +description: List of active osquery extensions. +platform: linux +log_source: osquery +event_code: osquery_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uuid + type: BIGINT + description: The transient ID assigned for communication + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension's name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension's version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sdk_version + type: TEXT + description: osquery SDK version used to build the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of the extenion's domain socket or library path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: 'SDK extension type: extension or module' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/osquery_flags.yml b/source/data_dictionaries/linux/osquery/events/osquery_flags.yml new file mode 100644 index 000000000..4adea5ff8 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/osquery_flags.yml @@ -0,0 +1,47 @@ +title: Osquery_flags Table +description: Configurable flags that modify osquery's behavior. +platform: linux +log_source: osquery +event_code: osquery_flags +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Flag name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Flag type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Flag description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: default_value + type: TEXT + description: Flag default value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Flag value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shell_only + type: INTEGER + description: Is the flag shell only? + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_flags +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/osquery_info.yml b/source/data_dictionaries/linux/osquery/events/osquery_info.yml new file mode 100644 index 000000000..8b011bd32 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/osquery_info.yml @@ -0,0 +1,83 @@ +title: Osquery_info Table +description: Top level information about the running version of osquery. +platform: linux +log_source: osquery +event_code: osquery_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread/handle) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Unique ID provided by the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: instance_id + type: TEXT + description: Unique, long-lived ID per instance of osquery + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: osquery toolkit version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_hash + type: TEXT + description: Hash of the working configuration state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_valid + type: INTEGER + description: 1 if the config was loaded and considered valid, else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: extensions + type: TEXT + description: osquery extensions status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_platform + type: TEXT + description: osquery toolkit build platform + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_distro + type: TEXT + description: osquery toolkit platform distribution name (os version) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start_time + type: INTEGER + description: UNIX time in seconds when the process started + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: watcher + type: INTEGER + description: Process (or thread/handle) ID of optional watcher process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_mask + type: INTEGER + description: The osquery platform bitmask + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/osquery_packs.yml b/source/data_dictionaries/linux/osquery/events/osquery_packs.yml new file mode 100644 index 000000000..68f44ae1e --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/osquery_packs.yml @@ -0,0 +1,56 @@ +title: Osquery_packs Table +description: Information about the current query packs that are loaded in osquery. +platform: linux +log_source: osquery +event_code: osquery_packs +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The given name for this query pack + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform + type: TEXT + description: Platforms this query is supported on + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Minimum osquery version that this query will run on + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shard + type: INTEGER + description: Shard restriction limit, 1-100, 0 meaning no restriction + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: discovery_cache_hits + type: INTEGER + description: The number of times that the discovery query used cached values since + the last time the config was reloaded + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: discovery_executions + type: INTEGER + description: The number of times that the discovery queries have been executed since + the last time the config was reloaded + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: Whether this pack is active (the version, platform and discovery queries + match) yes=1, no=0. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_packs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/osquery_registry.yml b/source/data_dictionaries/linux/osquery/events/osquery_registry.yml new file mode 100644 index 000000000..8335f6f79 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/osquery_registry.yml @@ -0,0 +1,41 @@ +title: Osquery_registry Table +description: List the osquery registry plugins. +platform: linux +log_source: osquery +event_code: osquery_registry +event_fields: +- standard_name: TBD + standard_type: TBD + name: registry + type: TEXT + description: Name of the osquery registry + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the plugin item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_uuid + type: INTEGER + description: Extension route UUID (0 for core) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: internal + type: INTEGER + description: 1 If the plugin is internal else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: 1 If this plugin is active else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_registry +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/osquery_schedule.yml b/source/data_dictionaries/linux/osquery/events/osquery_schedule.yml new file mode 100644 index 000000000..6c214cb3e --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/osquery_schedule.yml @@ -0,0 +1,53 @@ +title: Osquery_schedule Table +description: Information about the current queries that are scheduled in osquery. +platform: linux +log_source: osquery +event_code: osquery_schedule +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The given name for this query + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: query + type: TEXT + description: The exact query to run + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: executions + type: BIGINT + description: Number of times the query was executed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blacklisted + type: INTEGER + description: 1 if the query is blacklisted else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wall_time + type: BIGINT + description: Total wall time spent executing + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_time + type: BIGINT + description: Total user time spent executing + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_time + type: BIGINT + description: Total system time spent executing + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_schedule +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/pci_devices.yml b/source/data_dictionaries/linux/osquery/events/pci_devices.yml new file mode 100644 index 000000000..525539f38 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/pci_devices.yml @@ -0,0 +1,119 @@ +title: Pci_devices Table +description: PCI devices active on the host system. +platform: linux +log_source: osquery +event_code: pci_devices +event_fields: +- standard_name: TBD + standard_type: TBD + name: pci_slot + type: TEXT + description: PCI Device used slot + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_class + type: TEXT + description: PCI Device class + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: PCI Device used driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: PCI Device vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor_id + type: TEXT + description: Hex encoded PCI Device vendor identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: PCI Device model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model_id + type: TEXT + description: Hex encoded PCI Device model identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem + type: TEXT + description: PCI Device subsystem + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: express + type: INTEGER + description: 1 If PCI device is express else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: thunderbolt + type: INTEGER + description: 1 If PCI device is thunderbolt else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: removable + type: INTEGER + description: 1 If PCI device is removable else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_class_id + type: TEXT + description: PCI Device class ID in hex format [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_subclass_id + type: TEXT + description: PCI Device subclass in hex format [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_subclass + type: TEXT + description: PCI Device subclass [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem_vendor_id + type: TEXT + description: Vendor ID of PCI device subsystem [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem_vendor + type: TEXT + description: Vendor of PCI device subsystem [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem_model_id + type: TEXT + description: Model ID of PCI device subsystem [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem_model + type: TEXT + description: Device description of PCI device subsystem [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#pci_devices +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/platform_info.yml b/source/data_dictionaries/linux/osquery/events/platform_info.yml new file mode 100644 index 000000000..ffe94f132 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/platform_info.yml @@ -0,0 +1,59 @@ +title: Platform_info Table +description: Information about EFI/UEFI/ROM and platform/boot. +platform: linux +log_source: osquery +event_code: platform_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: Platform code vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Platform code version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: date + type: TEXT + description: Self-reported platform code update date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: revision + type: TEXT + description: BIOS major and minor revision + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Relative address of firmware mapping + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: TEXT + description: Size in bytes of firmware + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: volume_size + type: INTEGER + description: (Optional) size of firmware volume + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: extra + type: TEXT + description: Platform-specific additional information + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#platform_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/portage_keywords.yml b/source/data_dictionaries/linux/osquery/events/portage_keywords.yml new file mode 100644 index 000000000..e06ead5e8 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/portage_keywords.yml @@ -0,0 +1,41 @@ +title: Portage_keywords Table +description: A summary about portage configurations like keywords, mask and unmask. +platform: linux +log_source: osquery +event_code: portage_keywords +event_fields: +- standard_name: TBD + standard_type: TBD + name: package + type: TEXT + description: Package name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: The version which are affected by the use flags, empty means all + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: keyword + type: TEXT + description: The keyword applied to the package + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mask + type: INTEGER + description: If the package is masked + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: unmask + type: INTEGER + description: If the package is unmasked + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#portage_keywords +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/portage_packages.yml b/source/data_dictionaries/linux/osquery/events/portage_packages.yml new file mode 100644 index 000000000..9047fdf82 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/portage_packages.yml @@ -0,0 +1,59 @@ +title: Portage_packages Table +description: List of currently installed packages. +platform: linux +log_source: osquery +event_code: portage_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: package + type: TEXT + description: Package name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: The version which are affected by the use flags, empty means all + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: slot + type: TEXT + description: The slot used by package + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_time + type: BIGINT + description: Unix time when package was built + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: repository + type: TEXT + description: From which repository the ebuild was used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eapi + type: BIGINT + description: The eapi for the ebuild + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: The size of the package + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: world + type: INTEGER + description: If package is in the world file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#portage_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/portage_use.yml b/source/data_dictionaries/linux/osquery/events/portage_use.yml new file mode 100644 index 000000000..82a072bf6 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/portage_use.yml @@ -0,0 +1,29 @@ +title: Portage_use Table +description: List of enabled portage USE values for specific package. +platform: linux +log_source: osquery +event_code: portage_use +event_fields: +- standard_name: TBD + standard_type: TBD + name: package + type: TEXT + description: Package name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: The version of the installed package + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: use + type: TEXT + description: USE flag which has been enabled for package + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#portage_use +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/process_envs.yml b/source/data_dictionaries/linux/osquery/events/process_envs.yml new file mode 100644 index 000000000..2e675c510 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/process_envs.yml @@ -0,0 +1,29 @@ +title: Process_envs Table +description: A key/value table of environment variables for each process. +platform: linux +log_source: osquery +event_code: process_envs +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Environment variable name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Environment variable value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_envs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/process_events.yml b/source/data_dictionaries/linux/osquery/events/process_events.yml new file mode 100644 index 000000000..60371051f --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/process_events.yml @@ -0,0 +1,173 @@ +title: Process_events Table +description: Track time/action process executions. +platform: linux +log_source: osquery +event_code: process_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of executed file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: File mode permissions + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline + type: TEXT + description: Command line arguments (argv) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline_size + type: BIGINT + description: Actual size (bytes) of command line arguments + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env + type: TEXT + description: Environment variables delimited by spaces + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env_count + type: BIGINT + description: Number of environment variables + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env_size + type: BIGINT + description: Actual size (bytes) of environment list + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cwd + type: TEXT + description: The process current working directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: auid + type: BIGINT + description: Audit User ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: BIGINT + description: Effective user ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: BIGINT + description: Effective group ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_uid + type: BIGINT + description: File owner user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_gid + type: BIGINT + description: File owner group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: atime + type: BIGINT + description: File last access in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: BIGINT + description: File modification in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ctime + type: BIGINT + description: File last metadata change in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: btime + type: BIGINT + description: File creation in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: overflows + type: TEXT + description: List of structures that overflowed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Process parent's PID, or -1 if cannot be determined. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of execution in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uptime + type: BIGINT + description: Time of execution in system uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: BIGINT + description: 'OpenBSM Attribute: Status of the process [DARWIN]' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: syscall + type: TEXT + description: 'Syscall name: fork, vfork, clone, execve, execveat [LINUX]' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/process_file_events.yml b/source/data_dictionaries/linux/osquery/events/process_file_events.yml new file mode 100644 index 000000000..912a6c284 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/process_file_events.yml @@ -0,0 +1,102 @@ +title: Process_file_events Table +description: A File Integrity Monitor implementation using the audit service. +platform: linux +log_source: osquery +event_code: process_file_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: operation + type: TEXT + description: Operation type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ppid + type: BIGINT + description: Parent process ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of execution in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: executable + type: TEXT + description: The executable path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partial + type: TEXT + description: 'True if this is a partial event (i.e.: this process existed before + we started osquery)' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cwd + type: TEXT + description: The current working directory of the process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path associated with the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dest_path + type: TEXT + description: The canonical path associated with the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: TEXT + description: The uid of the process performing the action + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: TEXT + description: The gid of the process performing the action + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: TEXT + description: Effective user ID of the process using the file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: TEXT + description: Effective group ID of the process using the file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uptime + type: BIGINT + description: Time of execution in system uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_file_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/process_memory_map.yml b/source/data_dictionaries/linux/osquery/events/process_memory_map.yml new file mode 100644 index 000000000..9bb6c1a17 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/process_memory_map.yml @@ -0,0 +1,65 @@ +title: Process_memory_map Table +description: Process memory mapped files and pseudo device/regions. +platform: linux +log_source: osquery +event_code: process_memory_map +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start + type: TEXT + description: Virtual start address (hex) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: end + type: TEXT + description: Virtual end address (hex) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: r=read, w=write, x=execute, p=private (cow) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offset + type: BIGINT + description: Offset into mapped path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: MA:MI Major/minor device ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: INTEGER + description: Mapped path inode, 0 means uninitialized (BSS) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to mapped file or mapped type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pseudo + type: INTEGER + description: 1 If path is a pseudo path, else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_memory_map +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/process_namespaces.yml b/source/data_dictionaries/linux/osquery/events/process_namespaces.yml new file mode 100644 index 000000000..846fc46c7 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/process_namespaces.yml @@ -0,0 +1,59 @@ +title: Process_namespaces Table +description: Linux namespaces for processes running on the host system. +platform: linux +log_source: osquery +event_code: process_namespaces +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cgroup_namespace + type: TEXT + description: cgroup namespace inode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipc_namespace + type: TEXT + description: ipc namespace inode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mnt_namespace + type: TEXT + description: mnt namespace inode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: net namespace inode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid_namespace + type: TEXT + description: pid namespace inode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_namespace + type: TEXT + description: user namespace inode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uts_namespace + type: TEXT + description: uts namespace inode + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_namespaces +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/process_open_files.yml b/source/data_dictionaries/linux/osquery/events/process_open_files.yml new file mode 100644 index 000000000..42128104b --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/process_open_files.yml @@ -0,0 +1,29 @@ +title: Process_open_files Table +description: File descriptors for each process. +platform: linux +log_source: osquery +event_code: process_open_files +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Process-specific file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Filesystem path of descriptor + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_open_files +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/process_open_pipes.yml b/source/data_dictionaries/linux/osquery/events/process_open_pipes.yml new file mode 100644 index 000000000..99001437b --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/process_open_pipes.yml @@ -0,0 +1,59 @@ +title: Process_open_pipes Table +description: Pipes and partner processes for each process. +platform: linux +log_source: osquery +event_code: process_open_pipes +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: File descriptor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: Pipe open mode (r/w) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: BIGINT + description: Pipe inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: 'Pipe Type: named vs unnamed/anonymous' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partner_pid + type: BIGINT + description: Process ID of partner process sharing a particular pipe + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partner_fd + type: BIGINT + description: File descriptor of shared pipe at partner's end + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partner_mode + type: TEXT + description: Mode of shared pipe at partner's end + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_open_pipes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/process_open_sockets.yml b/source/data_dictionaries/linux/osquery/events/process_open_sockets.yml new file mode 100644 index 000000000..1d395e302 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/process_open_sockets.yml @@ -0,0 +1,83 @@ +title: Process_open_sockets Table +description: Processes which have open network sockets on the system. +platform: linux +log_source: osquery +event_code: process_open_sockets +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Socket file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: socket + type: BIGINT + description: Socket handle or inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: family + type: INTEGER + description: Network protocol (IPv4, IPv6) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: INTEGER + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_address + type: TEXT + description: Socket local address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_address + type: TEXT + description: Socket remote address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_port + type: INTEGER + description: Socket local port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_port + type: INTEGER + description: Socket remote port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: For UNIX sockets (family=AF_UNIX), the domain path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: 'TCP socket state [lambda: LINUX() or DARWIN() or WINDOWS()]' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: The inode number of the network namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_open_sockets +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/processes.yml b/source/data_dictionaries/linux/osquery/events/processes.yml new file mode 100644 index 000000000..9c06835d5 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/processes.yml @@ -0,0 +1,215 @@ +title: Processes Table +description: All running processes on the host system. +platform: linux +log_source: osquery +event_code: processes +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The process path or shorthand argv[0] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to executed binary + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline + type: TEXT + description: Complete argv + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: Process state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cwd + type: TEXT + description: Process current working directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: root + type: TEXT + description: Process virtual root directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Unsigned user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Unsigned group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: BIGINT + description: Unsigned effective user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: BIGINT + description: Unsigned effective group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: suid + type: BIGINT + description: Unsigned saved user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sgid + type: BIGINT + description: Unsigned saved group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wired_size + type: BIGINT + description: Bytes of unpagable memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resident_size + type: BIGINT + description: Bytes of private memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_size + type: BIGINT + description: Total virtual memory size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_time + type: BIGINT + description: CPU time in milliseconds spent in user space + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_time + type: BIGINT + description: CPU time in milliseconds spent in kernel space + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_bytes_read + type: BIGINT + description: Bytes read from disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_bytes_written + type: BIGINT + description: Bytes written to disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start_time + type: BIGINT + description: Process start time in seconds since Epoch, in case of error -1 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Process parent's PID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pgroup + type: BIGINT + description: Process group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: threads + type: INTEGER + description: Number of threads used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: nice + type: INTEGER + description: Process nice level (-20 to 20, default 0) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_elevated_token + type: INTEGER + description: Process uses elevated token yes=1, no=0 [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: elapsed_time + type: BIGINT + description: Elapsed time in seconds this process has been running. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: handle_count + type: BIGINT + description: Total number of handles that the process has open. This number is the + sum of the handles currently opened by each thread in the process. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: percent_processor_time + type: BIGINT + description: Returns elapsed time that all of the threads of this process used the + processor to execute instructions in 100 nanoseconds ticks. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: upid + type: BIGINT + description: A 64bit pid that is never reused. Returns -1 if we couldn't gather + them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uppid + type: BIGINT + description: The 64bit parent pid that is never reused. Returns -1 if we couldn't + gather them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_type + type: INTEGER + description: A 64bit pid that is never reused. Returns -1 if we couldn't gather + them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_subtype + type: INTEGER + description: The 64bit parent pid that is never reused. Returns -1 if we couldn't + gather them from the system. [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#processes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/prometheus_metrics.yml b/source/data_dictionaries/linux/osquery/events/prometheus_metrics.yml new file mode 100644 index 000000000..0bb4c67cf --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/prometheus_metrics.yml @@ -0,0 +1,35 @@ +title: Prometheus_metrics Table +description: Retrieve metrics from a Prometheus server. +platform: linux +log_source: osquery +event_code: prometheus_metrics +event_fields: +- standard_name: TBD + standard_type: TBD + name: target_name + type: TEXT + description: Address of prometheus target + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric_name + type: TEXT + description: Name of collected Prometheus metric + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric_value + type: DOUBLE + description: Value of collected Prometheus metric + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timestamp_ms + type: BIGINT + description: Unix timestamp of collected data in MS + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#prometheus_metrics +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/python_packages.yml b/source/data_dictionaries/linux/osquery/events/python_packages.yml new file mode 100644 index 000000000..c47b5117a --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/python_packages.yml @@ -0,0 +1,53 @@ +title: Python_packages Table +description: Python packages installed in a system. +platform: linux +log_source: osquery +event_code: python_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: summary + type: TEXT + description: Package-supplied summary + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional package author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: license + type: TEXT + description: License under which package is launched + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path at which this module resides + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: Directory where Python modules are located + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#python_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/routes.yml b/source/data_dictionaries/linux/osquery/events/routes.yml new file mode 100644 index 000000000..e4895e56f --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/routes.yml @@ -0,0 +1,71 @@ +title: Routes Table +description: The active route table for the host system. +platform: linux +log_source: osquery +event_code: routes +event_fields: +- standard_name: TBD + standard_type: TBD + name: destination + type: TEXT + description: Destination IP address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: netmask + type: INTEGER + description: Netmask length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gateway + type: TEXT + description: Route gateway + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Route source + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: Flags to describe route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Route local interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtu + type: INTEGER + description: Maximum Transmission Unit for the route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric + type: INTEGER + description: Cost of route. Lowest is preferred + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hopcount + type: INTEGER + description: Max hops expected [POSIX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#routes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/rpm_package_files.yml b/source/data_dictionaries/linux/osquery/events/rpm_package_files.yml new file mode 100644 index 000000000..6bceab787 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/rpm_package_files.yml @@ -0,0 +1,53 @@ +title: Rpm_package_files Table +description: RPM packages that are currently installed on the host system. +platform: linux +log_source: osquery +event_code: rpm_package_files +event_fields: +- standard_name: TBD + standard_type: TBD + name: package + type: TEXT + description: RPM package name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: File path within the package + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: File default username from info DB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: groupname + type: TEXT + description: File default groupname from info DB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: File permissions mode from info DB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Expected file size in bytes from RPM info DB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: SHA256 file digest from RPM info DB + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#rpm_package_files +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/rpm_packages.yml b/source/data_dictionaries/linux/osquery/events/rpm_packages.yml new file mode 100644 index 000000000..b8de9e6af --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/rpm_packages.yml @@ -0,0 +1,65 @@ +title: Rpm_packages Table +description: RPM packages that are currently installed on the host system. +platform: linux +log_source: osquery +event_code: rpm_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: RPM package name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: release + type: TEXT + description: Package release + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source RPM package name (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Package size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: SHA1 hash of the package contents + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: arch + type: TEXT + description: Architecture(s) supported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: epoch + type: INTEGER + description: Package epoch value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_time + type: INTEGER + description: When the package was installed + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#rpm_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/selinux_events.yml b/source/data_dictionaries/linux/osquery/events/selinux_events.yml new file mode 100644 index 000000000..17db2a777 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/selinux_events.yml @@ -0,0 +1,41 @@ +title: Selinux_events Table +description: Track SELinux events. +platform: linux +log_source: osquery +event_code: selinux_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Event type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: message + type: TEXT + description: Message + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of execution in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uptime + type: BIGINT + description: Time of execution in system uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#selinux_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/selinux_settings.yml b/source/data_dictionaries/linux/osquery/events/selinux_settings.yml new file mode 100644 index 000000000..5054f5341 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/selinux_settings.yml @@ -0,0 +1,29 @@ +title: Selinux_settings Table +description: Track active SELinux settings. +platform: linux +log_source: osquery +event_code: selinux_settings +event_fields: +- standard_name: TBD + standard_type: TBD + name: scope + type: TEXT + description: Where the key is located inside the SELinuxFS mount point. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Key or class name. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Active value. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#selinux_settings +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/shadow.yml b/source/data_dictionaries/linux/osquery/events/shadow.yml new file mode 100644 index 000000000..72ace573c --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/shadow.yml @@ -0,0 +1,72 @@ +title: Shadow Table +description: Local system users encrypted passwords and related information. Please + note, that you usually need superuser rights to access `/etc/shadow`. +platform: linux +log_source: osquery +event_code: shadow +event_fields: +- standard_name: TBD + standard_type: TBD + name: password_status + type: TEXT + description: Password status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hash_alg + type: TEXT + description: Password hashing algorithm + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_change + type: BIGINT + description: Date of last password change (starting from UNIX epoch date) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: min + type: BIGINT + description: Minimal number of days between password changes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: max + type: BIGINT + description: Maximum number of days between password changes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: warning + type: BIGINT + description: Number of days before password expires to warn user about it + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inactive + type: BIGINT + description: Number of days after password expires until account is blocked + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: expire + type: BIGINT + description: Number of days since UNIX epoch date until account is disabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flag + type: BIGINT + description: Reserved + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Username + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#shadow +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/shared_memory.yml b/source/data_dictionaries/linux/osquery/events/shared_memory.yml new file mode 100644 index 000000000..8fdcbbac4 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/shared_memory.yml @@ -0,0 +1,89 @@ +title: Shared_memory Table +description: OS shared memory regions. +platform: linux +log_source: osquery +event_code: shared_memory +event_fields: +- standard_name: TBD + standard_type: TBD + name: shmid + type: INTEGER + description: Shared memory segment ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_uid + type: BIGINT + description: User ID of owning process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: creator_uid + type: BIGINT + description: User ID of creator process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process ID to last use the segment + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: creator_pid + type: BIGINT + description: Process ID that created the segment + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: atime + type: BIGINT + description: Attached time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dtime + type: BIGINT + description: Detached time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ctime + type: BIGINT + description: Changed time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: Memory segment permissions + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: attached + type: INTEGER + description: Number of attached processes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Destination/attach status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: locked + type: INTEGER + description: 1 if segment is locked else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#shared_memory +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/shell_history.yml b/source/data_dictionaries/linux/osquery/events/shell_history.yml new file mode 100644 index 000000000..237545fc0 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/shell_history.yml @@ -0,0 +1,35 @@ +title: Shell_history Table +description: A line-delimited (command) table of per-user .*_history data. +platform: linux +log_source: osquery +event_code: shell_history +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Shell history owner + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Entry timestamp. It could be absent, default value is 0. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command + type: TEXT + description: Unparsed date/line/command history line + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: history_file + type: TEXT + description: Path to the .*_history for this user + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#shell_history +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/smart_drive_info.yml b/source/data_dictionaries/linux/osquery/events/smart_drive_info.yml new file mode 100644 index 000000000..6eed45cc4 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/smart_drive_info.yml @@ -0,0 +1,119 @@ +title: Smart_drive_info Table +description: Drive information read by SMART controller utilizing autodetect. +platform: linux +log_source: osquery +event_code: smart_drive_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: device_name + type: TEXT + description: Name of block device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model_family + type: TEXT + description: Drive model family + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device_model + type: TEXT + description: Device Model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial_number + type: TEXT + description: Device serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: lu_wwn_device_id + type: TEXT + description: Device Identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: firmware_version + type: TEXT + description: Drive firmware version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_capacity + type: TEXT + description: Bytes of drive capacity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sector_sizes + type: TEXT + description: Bytes of drive sector sizes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rotation_rate + type: TEXT + description: Drive RPM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: form_factor + type: TEXT + description: Form factor if reported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ata_version + type: TEXT + description: ATA version of drive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: transport_type + type: TEXT + description: Drive transport type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sata_version + type: TEXT + description: SATA version, if any + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: smart_supported + type: TEXT + description: SMART support status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: smart_enabled + type: TEXT + description: SMART enabled status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: packet_device_type + type: TEXT + description: Packet device type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_mode + type: TEXT + description: Device power mode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: warnings + type: TEXT + description: Warning messages from SMART controller + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#smart_drive_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/smbios_tables.yml b/source/data_dictionaries/linux/osquery/events/smbios_tables.yml new file mode 100644 index 000000000..ac7f89a43 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/smbios_tables.yml @@ -0,0 +1,53 @@ +title: Smbios_tables Table +description: BIOS (DMI) structure common details and content. +platform: linux +log_source: osquery +event_code: smbios_tables +event_fields: +- standard_name: TBD + standard_type: TBD + name: number + type: INTEGER + description: Table entry number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: Table entry type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Table entry description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: handle + type: INTEGER + description: Table entry handle + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: header_size + type: INTEGER + description: Header size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Table entry size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: MD5 hash of table entry + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#smbios_tables +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/socket_events.yml b/source/data_dictionaries/linux/osquery/events/socket_events.yml new file mode 100644 index 000000000..887c7b03f --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/socket_events.yml @@ -0,0 +1,107 @@ +title: Socket_events Table +description: Track network socket opens and closes. +platform: linux +log_source: osquery +event_code: socket_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: The socket action (bind, listen, close) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of executed file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: TEXT + description: The file description for the process socket + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: auid + type: BIGINT + description: Audit User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: success + type: INTEGER + description: The socket open attempt status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: family + type: INTEGER + description: The Internet protocol family ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: INTEGER + description: The network protocol ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_address + type: TEXT + description: Local address associated with socket + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_address + type: TEXT + description: Remote address associated with socket + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_port + type: INTEGER + description: Local network protocol port number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_port + type: INTEGER + description: Remote network protocol port number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: socket + type: TEXT + description: The local path (UNIX domain socket only) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of execution in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uptime + type: BIGINT + description: Time of execution in system uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#socket_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/ssh_configs.yml b/source/data_dictionaries/linux/osquery/events/ssh_configs.yml new file mode 100644 index 000000000..ebd672a16 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/ssh_configs.yml @@ -0,0 +1,29 @@ +title: Ssh_configs Table +description: A table of parsed ssh_configs. +platform: linux +log_source: osquery +event_code: ssh_configs +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local owner of the ssh_config file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: option + type: TEXT + description: The option and value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssh_config_file + type: TEXT + description: Path to the ssh_config file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ssh_configs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/sudoers.yml b/source/data_dictionaries/linux/osquery/events/sudoers.yml new file mode 100644 index 000000000..47180a500 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/sudoers.yml @@ -0,0 +1,29 @@ +title: Sudoers Table +description: Rules for running commands as other users via sudo. +platform: linux +log_source: osquery +event_code: sudoers +event_fields: +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source file containing the given rule + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: header + type: TEXT + description: Symbol for given rule + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rule_details + type: TEXT + description: Rule definition + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#sudoers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/suid_bin.yml b/source/data_dictionaries/linux/osquery/events/suid_bin.yml new file mode 100644 index 000000000..6934daa43 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/suid_bin.yml @@ -0,0 +1,35 @@ +title: Suid_bin Table +description: suid binaries in common locations. +platform: linux +log_source: osquery +event_code: suid_bin +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Binary path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Binary owner username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: groupname + type: TEXT + description: Binary owner group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: Binary permissions + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#suid_bin +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/syslog_events.yml b/source/data_dictionaries/linux/osquery/events/syslog_events.yml new file mode 100644 index 000000000..3afd4fd37 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/syslog_events.yml @@ -0,0 +1,59 @@ +title: Syslog_events Table +description: '' +platform: linux +log_source: osquery +event_code: syslog_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Current unix epoch time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: datetime + type: TEXT + description: Time known to syslog + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host + type: TEXT + description: Hostname configured for syslog + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: severity + type: INTEGER + description: Syslog severity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: facility + type: TEXT + description: Syslog facility + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tag + type: TEXT + description: The syslog tag + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: message + type: TEXT + description: The syslog message + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#syslog_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/system_controls.yml b/source/data_dictionaries/linux/osquery/events/system_controls.yml new file mode 100644 index 000000000..28fc89a40 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/system_controls.yml @@ -0,0 +1,53 @@ +title: System_controls Table +description: sysctl names, values, and settings information. +platform: linux +log_source: osquery +event_code: system_controls +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Full sysctl MIB name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: oid + type: TEXT + description: Control MIB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem + type: TEXT + description: Subsystem ID, control type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: current_value + type: TEXT + description: Value of setting + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_value + type: TEXT + description: The MIB value set in /etc/sysctl.conf + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Data type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: field_name + type: TEXT + description: Specific attribute of opaque type [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#system_controls +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/system_info.yml b/source/data_dictionaries/linux/osquery/events/system_info.yml new file mode 100644 index 000000000..2538c2699 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/system_info.yml @@ -0,0 +1,101 @@ +title: System_info Table +description: System information for identification. +platform: linux +log_source: osquery +event_code: system_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: hostname + type: TEXT + description: Network hostname including domain + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Unique ID provided by the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_type + type: TEXT + description: CPU type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_subtype + type: TEXT + description: CPU subtype + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_brand + type: TEXT + description: CPU brand string, contains vendor and model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_physical_cores + type: INTEGER + description: Number of physical CPU cores in to the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_logical_cores + type: INTEGER + description: Number of logical CPU cores available to the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_microcode + type: TEXT + description: Microcode version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: physical_memory + type: BIGINT + description: Total physical memory in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_vendor + type: TEXT + description: Hardware or board vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_model + type: TEXT + description: Hardware or board model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_version + type: TEXT + description: Hardware or board version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_serial + type: TEXT + description: Device or board serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: computer_name + type: TEXT + description: Friendly computer name (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_hostname + type: TEXT + description: Local hostname (optional) + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#system_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/time.yml b/source/data_dictionaries/linux/osquery/events/time.yml new file mode 100644 index 000000000..967a5b370 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/time.yml @@ -0,0 +1,95 @@ +title: Time Table +description: Track current date and time in the system. +platform: linux +log_source: osquery +event_code: time +event_fields: +- standard_name: TBD + standard_type: TBD + name: weekday + type: TEXT + description: Current weekday in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: year + type: INTEGER + description: Current year in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: month + type: INTEGER + description: Current month in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: day + type: INTEGER + description: Current day in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hour + type: INTEGER + description: Current hour in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minutes + type: INTEGER + description: Current minutes in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: seconds + type: INTEGER + description: Current seconds in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timezone + type: TEXT + description: Current timezone in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_time + type: INTEGER + description: Current local UNIX time in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_timezone + type: TEXT + description: Current local timezone in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timestamp + type: TEXT + description: Current timestamp (log format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: datetime + type: TEXT + description: Current date and time (ISO format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: iso_8601 + type: TEXT + description: Current time (ISO format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: win_timestamp + type: BIGINT + description: Timestamp value in 100 nanosecond units. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#time +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/ulimit_info.yml b/source/data_dictionaries/linux/osquery/events/ulimit_info.yml new file mode 100644 index 000000000..e09d0cd99 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/ulimit_info.yml @@ -0,0 +1,29 @@ +title: Ulimit_info Table +description: System resource usage limits. +platform: linux +log_source: osquery +event_code: ulimit_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: System resource to be limited + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: soft_limit + type: TEXT + description: Current limit value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hard_limit + type: TEXT + description: Maximum limit value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ulimit_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/uptime.yml b/source/data_dictionaries/linux/osquery/events/uptime.yml new file mode 100644 index 000000000..0372e692f --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/uptime.yml @@ -0,0 +1,41 @@ +title: Uptime Table +description: Track time passed since last boot. +platform: linux +log_source: osquery +event_code: uptime +event_fields: +- standard_name: TBD + standard_type: TBD + name: days + type: INTEGER + description: Days of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hours + type: INTEGER + description: Hours of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minutes + type: INTEGER + description: Minutes of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: seconds + type: INTEGER + description: Seconds of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_seconds + type: BIGINT + description: Total uptime seconds + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#uptime +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/usb_devices.yml b/source/data_dictionaries/linux/osquery/events/usb_devices.yml new file mode 100644 index 000000000..b68c1a9ae --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/usb_devices.yml @@ -0,0 +1,83 @@ +title: Usb_devices Table +description: USB devices that are actively plugged into the host system. +platform: linux +log_source: osquery +event_code: usb_devices +event_fields: +- standard_name: TBD + standard_type: TBD + name: usb_address + type: INTEGER + description: USB Device used address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: usb_port + type: INTEGER + description: USB Device used port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: USB Device vendor string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor_id + type: TEXT + description: Hex encoded USB Device vendor identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: USB Device version number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: USB Device model string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model_id + type: TEXT + description: Hex encoded USB Device model identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial + type: TEXT + description: USB Device serial connection + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: USB Device class + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subclass + type: TEXT + description: USB Device subclass + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: TEXT + description: USB Device protocol + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: removable + type: INTEGER + description: 1 If USB device is removable else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#usb_devices +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/user_events.yml b/source/data_dictionaries/linux/osquery/events/user_events.yml new file mode 100644 index 000000000..c7e6c50c9 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/user_events.yml @@ -0,0 +1,77 @@ +title: User_events Table +description: Track user events from the audit framework. +platform: linux +log_source: osquery +event_code: user_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: auid + type: BIGINT + description: Audit User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: message + type: TEXT + description: Message from the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: The file description for the process socket + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Supplied path from event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: The Internet protocol address or family ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: terminal + type: TEXT + description: The network protocol ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of execution in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uptime + type: BIGINT + description: Time of execution in system uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/user_groups.yml b/source/data_dictionaries/linux/osquery/events/user_groups.yml new file mode 100644 index 000000000..cdf4f2d17 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/user_groups.yml @@ -0,0 +1,23 @@ +title: User_groups Table +description: Local system user group relationships. +platform: linux +log_source: osquery +event_code: user_groups +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_groups +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/user_ssh_keys.yml b/source/data_dictionaries/linux/osquery/events/user_ssh_keys.yml new file mode 100644 index 000000000..1c66ea2f2 --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/user_ssh_keys.yml @@ -0,0 +1,30 @@ +title: User_ssh_keys Table +description: Returns the private keys in the users ~/.ssh directory and whether or + not they are encrypted. +platform: linux +log_source: osquery +event_code: user_ssh_keys +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the key file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to key file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: encrypted + type: INTEGER + description: 1 if key is encrypted, 0 otherwise + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_ssh_keys +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/users.yml b/source/data_dictionaries/linux/osquery/events/users.yml new file mode 100644 index 000000000..a6e5c9c6b --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/users.yml @@ -0,0 +1,79 @@ +title: Users Table +description: Local user accounts (including domain accounts that have logged on locally + (Windows)). +platform: linux +log_source: osquery +event_code: users +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID (unsigned) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid_signed + type: BIGINT + description: User ID as int64 signed (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid_signed + type: BIGINT + description: Default group ID as int64 signed (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Optional user description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: User's home directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shell + type: TEXT + description: User's configured default shell + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: User's UUID (Apple) or SID (Windows) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Whether the account is roaming (domain), local, or a system profile + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_hidden + type: INTEGER + description: IsHidden attribute set in OpenDirectory [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#users +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/yara.yml b/source/data_dictionaries/linux/osquery/events/yara.yml new file mode 100644 index 000000000..2f274048d --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/yara.yml @@ -0,0 +1,53 @@ +title: Yara Table +description: Track YARA matches for files or PIDs. +platform: linux +log_source: osquery +event_code: yara +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path scanned + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: matches + type: TEXT + description: List of YARA matches + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: count + type: INTEGER + description: Number of YARA matches + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sig_group + type: TEXT + description: Signature group used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sigfile + type: TEXT + description: Signature file used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: strings + type: TEXT + description: Matching strings + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tags + type: TEXT + description: Matching tags + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#yara +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/yara_events.yml b/source/data_dictionaries/linux/osquery/events/yara_events.yml new file mode 100644 index 000000000..e441187ed --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/yara_events.yml @@ -0,0 +1,71 @@ +title: Yara_events Table +description: Track YARA matches for files specified in configuration data. +platform: linux +log_source: osquery +event_code: yara_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: target_path + type: TEXT + description: The path scanned + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: category + type: TEXT + description: The category of the file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Change action (UPDATE, REMOVE, etc) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: transaction_id + type: BIGINT + description: ID used during bulk update + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: matches + type: TEXT + description: List of YARA matches + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: count + type: INTEGER + description: Number of YARA matches + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: strings + type: TEXT + description: Matching strings + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tags + type: TEXT + description: Matching tags + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of the scan + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#yara_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/linux/osquery/events/yum_sources.yml b/source/data_dictionaries/linux/osquery/events/yum_sources.yml new file mode 100644 index 000000000..a7331c30a --- /dev/null +++ b/source/data_dictionaries/linux/osquery/events/yum_sources.yml @@ -0,0 +1,41 @@ +title: Yum_sources Table +description: Current list of Yum repositories or software channels. +platform: linux +log_source: osquery +event_code: yum_sources +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Repository name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: baseurl + type: TEXT + description: Repository base URL + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: TEXT + description: Whether the repository is used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gpgcheck + type: TEXT + description: Whether packages are GPG checked + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gpgkey + type: TEXT + description: URL to GPG key + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#yum_sources +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/README.yml b/source/data_dictionaries/macos/osquery/README.yml index 928c0c056..767bbf8a3 100644 --- a/source/data_dictionaries/macos/osquery/README.yml +++ b/source/data_dictionaries/macos/osquery/README.yml @@ -2,7 +2,7 @@ title: macOS Osquery Event Logs description: Osquery schema is defined in tables by osquery engineers. images: [] references: -- text: osquery schema 3.2.4 (website) - link: https://osquery.io/schema/3.2.4 +- text: osquery schema 4.1.2 (website) + link: https://osquery.io/schema/4.1.2 - text: osquery schema linux specs (GitHub) link: https://github.com/facebook/osquery/tree/master/specs/darwin diff --git a/source/data_dictionaries/macos/osquery/events/account_policy_data.yml b/source/data_dictionaries/macos/osquery/events/account_policy_data.yml new file mode 100644 index 000000000..8b9e4b00d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/account_policy_data.yml @@ -0,0 +1,43 @@ +title: Account_policy_data Table +description: Additional OS X user account data from the AccountPolicy section of OpenDirectory. +platform: macos +log_source: osquery +event_code: account_policy_data +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: creation_time + type: DOUBLE + description: When the account was first created + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: failed_login_count + type: BIGINT + description: The number of times the user failed to login with the correct password. + Resets after a correct password is entered + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: failed_login_timestamp + type: DOUBLE + description: The time of the last failed login attempt. Resets after a correct password + is entered + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: password_last_set_time + type: DOUBLE + description: The time the password was last changed + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#account_policy_data +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/acpi_tables.yml b/source/data_dictionaries/macos/osquery/events/acpi_tables.yml new file mode 100644 index 000000000..53d787a52 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/acpi_tables.yml @@ -0,0 +1,29 @@ +title: Acpi_tables Table +description: Firmware ACPI functional table common metadata and content. +platform: macos +log_source: osquery +event_code: acpi_tables +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: ACPI table name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of compiled table data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: MD5 hash of table content + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#acpi_tables +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/ad_config.yml b/source/data_dictionaries/macos/osquery/events/ad_config.yml new file mode 100644 index 000000000..d28b8e8a8 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/ad_config.yml @@ -0,0 +1,35 @@ +title: Ad_config Table +description: OS X Active Directory configuration. +platform: macos +log_source: osquery +event_code: ad_config +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The OS X-specific configuration name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: domain + type: TEXT + description: Active Directory trust domain + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: option + type: TEXT + description: Canonical name of option + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Variable typed option value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ad_config +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/alf.yml b/source/data_dictionaries/macos/osquery/events/alf.yml new file mode 100644 index 000000000..d0fd747ea --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/alf.yml @@ -0,0 +1,54 @@ +title: Alf Table +description: OS X application layer firewall (ALF) service details. +platform: macos +log_source: osquery +event_code: alf +event_fields: +- standard_name: TBD + standard_type: TBD + name: allow_signed_enabled + type: INTEGER + description: 1 If allow signed mode is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: firewall_unload + type: INTEGER + description: 1 If firewall unloading enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: global_state + type: INTEGER + description: 1 If the firewall is enabled with exceptions, 2 if the firewall is + configured to block all incoming connections, else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logging_enabled + type: INTEGER + description: 1 If logging mode is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logging_option + type: INTEGER + description: Firewall logging option + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: stealth_enabled + type: INTEGER + description: 1 If stealth mode is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Application Layer Firewall version + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#alf +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/alf_exceptions.yml b/source/data_dictionaries/macos/osquery/events/alf_exceptions.yml new file mode 100644 index 000000000..a6bdbcc22 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/alf_exceptions.yml @@ -0,0 +1,23 @@ +title: Alf_exceptions Table +description: OS X application layer firewall (ALF) service exceptions. +platform: macos +log_source: osquery +event_code: alf_exceptions +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to the executable that is excepted + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: INTEGER + description: Firewall exception state + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#alf_exceptions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/alf_explicit_auths.yml b/source/data_dictionaries/macos/osquery/events/alf_explicit_auths.yml new file mode 100644 index 000000000..119503ba8 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/alf_explicit_auths.yml @@ -0,0 +1,17 @@ +title: Alf_explicit_auths Table +description: ALF services explicitly allowed to perform networking. +platform: macos +log_source: osquery +event_code: alf_explicit_auths +event_fields: +- standard_name: TBD + standard_type: TBD + name: process + type: TEXT + description: Process name explicitly allowed + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#alf_explicit_auths +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/app_schemes.yml b/source/data_dictionaries/macos/osquery/events/app_schemes.yml new file mode 100644 index 000000000..fc5c6d593 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/app_schemes.yml @@ -0,0 +1,29 @@ +title: App_schemes Table +description: OS X application schemes and handlers (e.g., http, file, mailto). +platform: macos +log_source: osquery +event_code: app_schemes +event_fields: +- standard_name: TBD + standard_type: TBD + name: scheme + type: TEXT + description: Name of the scheme/protocol + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: handler + type: TEXT + description: Application label for the handler + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: INTEGER + description: 1 if this handler is the OS default, else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#app_schemes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/apps.yml b/source/data_dictionaries/macos/osquery/events/apps.yml new file mode 100644 index 000000000..997478a40 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/apps.yml @@ -0,0 +1,77 @@ +title: Apps Table +description: OS X applications installed in known search paths (e.g., /Applications). +platform: macos +log_source: osquery +event_code: apps +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the Name.app folder + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Absolute and full Name.app path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bundle_name + type: TEXT + description: Info properties CFBundleName label + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bundle_version + type: TEXT + description: Info properties CFBundleVersion label + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: environment + type: TEXT + description: Application-set environment variables + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: element + type: TEXT + description: Does the app identify as a background agent + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: compiler + type: TEXT + description: Info properties DTCompiler label + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: display_name + type: TEXT + description: Info properties CFBundleDisplayName label + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: info_string + type: TEXT + description: Info properties CFBundleGetInfoString label + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: copyright + type: TEXT + description: Info properties NSHumanReadableCopyright label + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_opened_time + type: DOUBLE + description: The time that the app was last used + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#apps +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/apt_sources.yml b/source/data_dictionaries/macos/osquery/events/apt_sources.yml new file mode 100644 index 000000000..0042cd377 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/apt_sources.yml @@ -0,0 +1,59 @@ +title: Apt_sources Table +description: Current list of APT repositories or software channels. +platform: macos +log_source: osquery +event_code: apt_sources +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Repository name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: base_uri + type: TEXT + description: Repository base URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: release + type: TEXT + description: Release name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Repository source version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: maintainer + type: TEXT + description: Repository maintainer + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: components + type: TEXT + description: Repository components + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: architectures + type: TEXT + description: Repository architectures + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#apt_sources +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/arp_cache.yml b/source/data_dictionaries/macos/osquery/events/arp_cache.yml new file mode 100644 index 000000000..acee168f2 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/arp_cache.yml @@ -0,0 +1,35 @@ +title: Arp_cache Table +description: Address resolution cache, both static and dynamic (from ARP, NDP). +platform: macos +log_source: osquery +event_code: arp_cache +event_fields: +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: IPv4 address target + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac + type: TEXT + description: MAC address of broadcasted address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface of the network for the MAC + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permanent + type: TEXT + description: 1 for true, 0 for false + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#arp_cache +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/asl.yml b/source/data_dictionaries/macos/osquery/events/asl.yml new file mode 100644 index 000000000..2cd56a53a --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/asl.yml @@ -0,0 +1,90 @@ +title: Asl Table +description: Queries the Apple System Log data structure for system events. +platform: macos +log_source: osquery +event_code: asl +event_fields: +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Unix timestamp. Set automatically + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time_nano_sec + type: INTEGER + description: Nanosecond time. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host + type: TEXT + description: Sender's address (set by the server). + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sender + type: TEXT + description: Sender's identification string. Default is process name. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: facility + type: TEXT + description: Sender's facility. Default is 'user'. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Sending process ID encoded as a string. Set automatically. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: GID that sent the log message (set by the server). + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: UID that sent the log message (set by the server). + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: level + type: INTEGER + description: Log level number. See levels in asl.h. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: message + type: TEXT + description: Message text. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ref_pid + type: INTEGER + description: Reference PID for messages proxied by launchd + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ref_proc + type: TEXT + description: Reference process for messages proxied by launchd + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: extra + type: TEXT + description: Extra columns, in JSON format. Queries against this column are performed + entirely in SQLite, so do not benefit from efficient querying via asl.h. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#asl +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/atom_packages.yml b/source/data_dictionaries/macos/osquery/events/atom_packages.yml new file mode 100644 index 000000000..1dd797c92 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/atom_packages.yml @@ -0,0 +1,53 @@ +title: Atom_packages Table +description: Lists all atom packages in a directory or globally installed in a system. +platform: macos +log_source: osquery +event_code: atom_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Package supplied description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Package's package.json path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: license + type: TEXT + description: License for package + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: homepage + type: TEXT + description: Package supplied homepage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the plugin + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#atom_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/augeas.yml b/source/data_dictionaries/macos/osquery/events/augeas.yml new file mode 100644 index 000000000..7d52befa2 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/augeas.yml @@ -0,0 +1,35 @@ +title: Augeas Table +description: Configuration files parsed by augeas. +platform: macos +log_source: osquery +event_code: augeas +event_fields: +- standard_name: TBD + standard_type: TBD + name: node + type: TEXT + description: The node path of the configuration item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: The value of the configuration item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: The label of the configuration item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path to the configuration file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#augeas +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/authorization_mechanisms.yml b/source/data_dictionaries/macos/osquery/events/authorization_mechanisms.yml new file mode 100644 index 000000000..0f1e3c910 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/authorization_mechanisms.yml @@ -0,0 +1,41 @@ +title: Authorization_mechanisms Table +description: OS X Authorization mechanisms database. +platform: macos +log_source: osquery +event_code: authorization_mechanisms +event_fields: +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: Label of the authorization right + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: plugin + type: TEXT + description: Authorization plugin name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mechanism + type: TEXT + description: Name of the mechanism that will be called + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: privileged + type: TEXT + description: If privileged it will run as root, else as an anonymous user + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: entry + type: TEXT + description: The whole string entry + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#authorization_mechanisms +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/authorizations.yml b/source/data_dictionaries/macos/osquery/events/authorizations.yml new file mode 100644 index 000000000..e3905eba1 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/authorizations.yml @@ -0,0 +1,83 @@ +title: Authorizations Table +description: OS X Authorization rights database. +platform: macos +log_source: osquery +event_code: authorizations +event_fields: +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: Item name, usually in reverse domain format + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: modified + type: TEXT + description: Label top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: allow_root + type: TEXT + description: Label top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timeout + type: TEXT + description: Label top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Label top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tries + type: TEXT + description: Label top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: authenticate_user + type: TEXT + description: Label top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shared + type: TEXT + description: Label top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Label top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: TEXT + description: Label top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: Label top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: session_owner + type: TEXT + description: Label top-level key + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#authorizations +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/authorized_keys.yml b/source/data_dictionaries/macos/osquery/events/authorized_keys.yml new file mode 100644 index 000000000..3e3513a33 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/authorized_keys.yml @@ -0,0 +1,29 @@ +title: Authorized_keys Table +description: A line-delimited authorized_keys table. +platform: macos +log_source: osquery +event_code: authorized_keys +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local owner of authorized_keys file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: parsed authorized keys line + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_file + type: TEXT + description: Path to the authorized_keys file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#authorized_keys +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/azure_instance_metadata.yml b/source/data_dictionaries/macos/osquery/events/azure_instance_metadata.yml new file mode 100644 index 000000000..584e27367 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/azure_instance_metadata.yml @@ -0,0 +1,107 @@ +title: Azure_instance_metadata Table +description: Azure instance metadata. +platform: macos +log_source: osquery +event_code: azure_instance_metadata +event_fields: +- standard_name: TBD + standard_type: TBD + name: location + type: TEXT + description: Azure Region the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offer + type: TEXT + description: Offer information for the VM image (Azure image gallery VMs only) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: publisher + type: TEXT + description: Publisher of the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sku + type: TEXT + description: SKU for the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Version of the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os_type + type: TEXT + description: Linux or Windows + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_update_domain + type: TEXT + description: Update domain the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_fault_domain + type: TEXT + description: Fault domain the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_id + type: TEXT + description: Unique identifier for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_size + type: TEXT + description: VM size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subscription_id + type: TEXT + description: Azure subscription for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resource_group_name + type: TEXT + description: Resource group for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: placement_group_id + type: TEXT + description: Placement group for the VM scale set + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_scale_set_name + type: TEXT + description: VM scale set name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: zone + type: TEXT + description: Availability zone of the VM + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#azure_instance_metadata +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/azure_instance_tags.yml b/source/data_dictionaries/macos/osquery/events/azure_instance_tags.yml new file mode 100644 index 000000000..6ff1fdd9c --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/azure_instance_tags.yml @@ -0,0 +1,29 @@ +title: Azure_instance_tags Table +description: Azure instance tags. +platform: macos +log_source: osquery +event_code: azure_instance_tags +event_fields: +- standard_name: TBD + standard_type: TBD + name: vm_id + type: TEXT + description: Unique identifier for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: The tag key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: The tag value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#azure_instance_tags +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/battery.yml b/source/data_dictionaries/macos/osquery/events/battery.yml new file mode 100644 index 000000000..6c7b25fcd --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/battery.yml @@ -0,0 +1,121 @@ +title: Battery Table +description: Provides information about the internal battery of a Macbook. +platform: macos +log_source: osquery +event_code: battery +event_fields: +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: The battery manufacturer's name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacture_date + type: INTEGER + description: The date the battery was manufactured UNIX Epoch + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: The battery's model number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial_number + type: TEXT + description: The battery's unique serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cycle_count + type: INTEGER + description: The number of charge/discharge cycles + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: health + type: TEXT + description: 'One of the following: \' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: condition + type: TEXT + description: 'One of the following: \' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: 'One of the following: \' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: charging + type: INTEGER + description: 1 if the battery is currently being charged by a power source. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: charged + type: INTEGER + description: 1 if the battery is currently completely charged. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: designed_capacity + type: INTEGER + description: The battery's designed capacity in mAh + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: max_capacity + type: INTEGER + description: The battery's actual capacity when it is fully charged in mAh + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: current_capacity + type: INTEGER + description: The battery's current charged capacity in mAh + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: percent_remaining + type: INTEGER + description: The percentage of battery remaining before it is drained + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: amperage + type: INTEGER + description: The battery's current amperage in mA + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: voltage + type: INTEGER + description: The battery's current voltage in mV + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minutes_until_empty + type: INTEGER + description: The number of minutes until the battery is fully depleted. This value + is -1 if this time is still being calculated + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minutes_to_full_charge + type: INTEGER + description: The number of minutes until the battery is fully charged. This value + is -1 if this time is still being calculated + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#battery +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/block_devices.yml b/source/data_dictionaries/macos/osquery/events/block_devices.yml new file mode 100644 index 000000000..0b443b1dd --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/block_devices.yml @@ -0,0 +1,66 @@ +title: Block_devices Table +description: 'Block (buffered access) device file nodes: disks, ramdisks, and DMG + containers.' +platform: macos +log_source: osquery +event_code: block_devices +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Block device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: TEXT + description: Block device parent name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: Block device vendor string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: Block device model string identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Block device size in blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: block_size + type: INTEGER + description: Block size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Block device Universally Unique Identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Block device type string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: Block device label string + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#block_devices +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/browser_plugins.yml b/source/data_dictionaries/macos/osquery/events/browser_plugins.yml new file mode 100644 index 000000000..549939e24 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/browser_plugins.yml @@ -0,0 +1,71 @@ +title: Browser_plugins Table +description: All C/NPAPI browser plugin details for all users. +platform: macos +log_source: osquery +event_code: browser_plugins +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the plugin + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Plugin display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Plugin identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Plugin short version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sdk + type: TEXT + description: Build SDK used to compile plugin + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Plugin description text + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: development_region + type: TEXT + description: Plugin language-localization + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: native + type: INTEGER + description: Plugin requires native execution + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to plugin bundle + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disabled + type: INTEGER + description: Is the plugin disabled. 1 = Disabled + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#browser_plugins +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/carbon_black_info.yml b/source/data_dictionaries/macos/osquery/events/carbon_black_info.yml new file mode 100644 index 000000000..ac05454d4 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/carbon_black_info.yml @@ -0,0 +1,138 @@ +title: Carbon_black_info Table +description: Returns info about a Carbon Black sensor install. +platform: macos +log_source: osquery +event_code: carbon_black_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: sensor_id + type: INTEGER + description: Sensor ID of the Carbon Black sensor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_name + type: TEXT + description: Sensor group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_store_files + type: INTEGER + description: If the sensor is configured to send back binaries to the Carbon Black + server + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_module_loads + type: INTEGER + description: If the sensor is configured to capture module loads + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_module_info + type: INTEGER + description: If the sensor is configured to collect metadata of binaries + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_file_mods + type: INTEGER + description: If the sensor is configured to collect file modification events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_reg_mods + type: INTEGER + description: If the sensor is configured to collect registry modification events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_net_conns + type: INTEGER + description: If the sensor is configured to collect network connections + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_processes + type: INTEGER + description: If the sensor is configured to process events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_cross_processes + type: INTEGER + description: If the sensor is configured to cross process events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_emet_events + type: INTEGER + description: If the sensor is configured to EMET events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_data_file_writes + type: INTEGER + description: If the sensor is configured to collect non binary file writes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_process_user_context + type: INTEGER + description: If the sensor is configured to collect the user running a process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_sensor_operations + type: INTEGER + description: Unknown + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: log_file_disk_quota_mb + type: INTEGER + description: Event file disk quota in MB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: log_file_disk_quota_percentage + type: INTEGER + description: Event file disk quota in a percentage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protection_disabled + type: INTEGER + description: If the sensor is configured to report tamper events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sensor_ip_addr + type: TEXT + description: IP address of the sensor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sensor_backend_server + type: TEXT + description: Carbon Black server + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: event_queue + type: INTEGER + description: Size in bytes of Carbon Black event files on disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: binary_queue + type: INTEGER + description: Size in bytes of binaries waiting to be sent to Carbon Black server + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#carbon_black_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/carves.yml b/source/data_dictionaries/macos/osquery/events/carves.yml new file mode 100644 index 000000000..642fbcc93 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/carves.yml @@ -0,0 +1,53 @@ +title: Carves Table +description: Forensic Carves. +platform: macos +log_source: osquery +event_code: carves +event_fields: +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time at which the carve was kicked off + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: A SHA256 sum of the carved archive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of the carved archive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path of the requested carve + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: carve_guid + type: TEXT + description: Identifying value of the carve session + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: carve + type: INTEGER + description: Set this value to '1' to start a file carve + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#carves +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/certificates.yml b/source/data_dictionaries/macos/osquery/events/certificates.yml new file mode 100644 index 000000000..3feed8cd8 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/certificates.yml @@ -0,0 +1,138 @@ +title: Certificates Table +description: Certificate Authorities installed in Keychains/ca-bundles. +platform: macos +log_source: osquery +event_code: certificates +event_fields: +- standard_name: TBD + standard_type: TBD + name: common_name + type: TEXT + description: Certificate CommonName + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subject + type: TEXT + description: Certificate distinguished name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer + type: TEXT + description: Certificate issuer distinguished name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ca + type: INTEGER + description: '1 if CA: true (certificate is an authority) else 0' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: self_signed + type: INTEGER + description: 1 if self-signed, else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: not_valid_before + type: DATETIME + description: Lower bound of valid date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: not_valid_after + type: DATETIME + description: Certificate expiration data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: signing_algorithm + type: TEXT + description: Signing algorithm used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_algorithm + type: TEXT + description: Key algorithm used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_strength + type: TEXT + description: Key size used for RSA/DSA, or curve name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_usage + type: TEXT + description: Certificate key usage and extended key usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subject_key_id + type: TEXT + description: SKID an optionally included SHA1 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: authority_key_id + type: TEXT + description: AKID an optionally included SHA1 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: SHA1 hash of the raw certificate contents + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to Keychain or PEM bundle + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial + type: TEXT + description: Certificate serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sid + type: TEXT + description: SID [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: store_location + type: TEXT + description: Certificate system store location [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: store + type: TEXT + description: Certificate system store [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Username [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: store_id + type: TEXT + description: Exists for service/user stores. Contains raw store id provided by WinAPI. + [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#certificates +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/chrome_extensions.yml b/source/data_dictionaries/macos/osquery/events/chrome_extensions.yml new file mode 100644 index 000000000..a34f0d7be --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/chrome_extensions.yml @@ -0,0 +1,83 @@ +title: Chrome_extensions Table +description: Chrome browser extensions. +platform: macos +log_source: osquery +event_code: chrome_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: profile + type: TEXT + description: The Chrome profile that contains this extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Extension identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Extension-optional description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: locale + type: TEXT + description: Default locale supported by extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: update_url + type: TEXT + description: Extension-supplied update URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional extension author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to extension folder + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: The permissions required by the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: optional_permissions + type: TEXT + description: The permissions optionally required by the extensions + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#chrome_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/cpu_time.yml b/source/data_dictionaries/macos/osquery/events/cpu_time.yml new file mode 100644 index 000000000..bb68fe450 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/cpu_time.yml @@ -0,0 +1,80 @@ +title: Cpu_time Table +description: Displays information from /proc/stat file about the time the cpu cores + spent in different parts of the system. +platform: macos +log_source: osquery +event_code: cpu_time +event_fields: +- standard_name: TBD + standard_type: TBD + name: core + type: INTEGER + description: Name of the cpu (core) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: BIGINT + description: Time spent in user mode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: nice + type: BIGINT + description: Time spent in user mode with low priority (nice) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system + type: BIGINT + description: Time spent in system mode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: idle + type: BIGINT + description: Time spent in the idle task + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: iowait + type: BIGINT + description: Time spent waiting for I/O to complete + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: irq + type: BIGINT + description: Time spent servicing interrupts + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: softirq + type: BIGINT + description: Time spent servicing softirqs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: steal + type: BIGINT + description: Time spent in other operating systems when running in a virtualized + environment + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: guest + type: BIGINT + description: Time spent running a virtual CPU for a guest OS under the control of + the Linux kernel + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: guest_nice + type: BIGINT + description: 'Time spent running a niced guest ' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#cpu_time +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/cpuid.yml b/source/data_dictionaries/macos/osquery/events/cpuid.yml new file mode 100644 index 000000000..30be05fef --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/cpuid.yml @@ -0,0 +1,41 @@ +title: Cpuid Table +description: Useful CPU features from the cpuid ASM call. +platform: macos +log_source: osquery +event_code: cpuid +event_fields: +- standard_name: TBD + standard_type: TBD + name: feature + type: TEXT + description: Present feature flags + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Bit value or string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: output_register + type: TEXT + description: Register used to for feature value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: output_bit + type: INTEGER + description: Bit in register value for feature value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: input_eax + type: TEXT + description: Value of EAX used + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#cpuid +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/crashes.yml b/source/data_dictionaries/macos/osquery/events/crashes.yml new file mode 100644 index 000000000..c6899a971 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/crashes.yml @@ -0,0 +1,107 @@ +title: Crashes Table +description: Application, System, and Mobile App crash logs. +platform: macos +log_source: osquery +event_code: crashes +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of crash log + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID of the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: crash_path + type: TEXT + description: Location of log file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Identifier of the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Version info of the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Parent PID of the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: responsible + type: TEXT + description: Process responsible for the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: INTEGER + description: User ID of the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: datetime + type: TEXT + description: Date/Time at which the crash occurred + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: crashed_thread + type: BIGINT + description: Thread ID which crashed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: stack_trace + type: TEXT + description: Most recent frame from the stack trace + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: exception_type + type: TEXT + description: Exception type of the crash + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: exception_codes + type: TEXT + description: Exception codes from the crash + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: exception_notes + type: TEXT + description: Exception notes from the crash + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: registers + type: TEXT + description: The value of the system registers + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#crashes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/crontab.yml b/source/data_dictionaries/macos/osquery/events/crontab.yml new file mode 100644 index 000000000..a8e01063a --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/crontab.yml @@ -0,0 +1,59 @@ +title: Crontab Table +description: Line parsed values from system and user cron/tab. +platform: macos +log_source: osquery +event_code: crontab +event_fields: +- standard_name: TBD + standard_type: TBD + name: event + type: TEXT + description: The job @event name (rare) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minute + type: TEXT + description: The exact minute for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hour + type: TEXT + description: The hour of the day for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: day_of_month + type: TEXT + description: The day of the month for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: month + type: TEXT + description: The month of the year for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: day_of_week + type: TEXT + description: The day of the week for the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command + type: TEXT + description: Raw command string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: File parsed + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#crontab +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/cups_destinations.yml b/source/data_dictionaries/macos/osquery/events/cups_destinations.yml new file mode 100644 index 000000000..f0fb3ef5c --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/cups_destinations.yml @@ -0,0 +1,29 @@ +title: Cups_destinations Table +description: Returns all configured printers. +platform: macos +log_source: osquery +event_code: cups_destinations +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the printer + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: option_name + type: TEXT + description: Option name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: option_value + type: TEXT + description: Option value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#cups_destinations +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/cups_jobs.yml b/source/data_dictionaries/macos/osquery/events/cups_jobs.yml new file mode 100644 index 000000000..b029004a6 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/cups_jobs.yml @@ -0,0 +1,59 @@ +title: Cups_jobs Table +description: Returns all completed print jobs from cups. +platform: macos +log_source: osquery +event_code: cups_jobs +event_fields: +- standard_name: TBD + standard_type: TBD + name: title + type: TEXT + description: Title of the printed job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: destination + type: TEXT + description: The printer the job was sent to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: TEXT + description: The user who printed the job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: format + type: TEXT + description: The format of the print job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: The size of the print job + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: completed_time + type: INTEGER + description: When the job completed printing + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: processing_time + type: INTEGER + description: How long the job took to process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: creation_time + type: INTEGER + description: When the print request was initiated + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#cups_jobs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/curl.yml b/source/data_dictionaries/macos/osquery/events/curl.yml new file mode 100644 index 000000000..4ced09388 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/curl.yml @@ -0,0 +1,53 @@ +title: Curl Table +description: Perform an http request and return stats about it. +platform: macos +log_source: osquery +event_code: curl +event_fields: +- standard_name: TBD + standard_type: TBD + name: url + type: TEXT + description: The url for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: method + type: TEXT + description: The HTTP method for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_agent + type: TEXT + description: The user-agent string to use for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: response_code + type: INTEGER + description: The HTTP status code for the response + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: round_trip_time + type: BIGINT + description: Time taken to complete the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bytes + type: BIGINT + description: Number of bytes in the response + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: result + type: TEXT + description: The HTTP response body + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#curl +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/curl_certificate.yml b/source/data_dictionaries/macos/osquery/events/curl_certificate.yml new file mode 100644 index 000000000..171d4eddd --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/curl_certificate.yml @@ -0,0 +1,83 @@ +title: Curl_certificate Table +description: Inspect TLS certificates by connecting to input hostnames. +platform: macos +log_source: osquery +event_code: curl_certificate +event_fields: +- standard_name: TBD + standard_type: TBD + name: hostname + type: TEXT + description: Hostname (domain[:port]) to CURL + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: common_name + type: TEXT + description: Common name of company issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: organization + type: TEXT + description: Organization issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: organization_unit + type: TEXT + description: Organization unit issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial_number + type: TEXT + description: Certificate serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_common_name + type: TEXT + description: Issuer common name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_organization + type: TEXT + description: Issuer organization + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_organization_unit + type: TEXT + description: Issuer organization unit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: valid_from + type: TEXT + description: Period of validity start date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: valid_to + type: TEXT + description: Period of validity end date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256_fingerprint + type: TEXT + description: SHA-256 fingerprint + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1_fingerprint + type: TEXT + description: SHA1 fingerprint + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#curl_certificate +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/device_file.yml b/source/data_dictionaries/macos/osquery/events/device_file.yml new file mode 100644 index 000000000..0a29af4aa --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/device_file.yml @@ -0,0 +1,101 @@ +title: Device_file Table +description: Similar to the file table, but use TSK and allow block address access. +platform: macos +log_source: osquery +event_code: device_file +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Absolute file path to device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partition + type: TEXT + description: A partition number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: A logical path within the device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: filename + type: TEXT + description: Name portion of file path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: BIGINT + description: Filesystem inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Owning user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Owning group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: Permission bits + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Size of file in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: block_size + type: INTEGER + description: Block size of filesystem + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: atime + type: BIGINT + description: Last access time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: BIGINT + description: Last modification time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ctime + type: BIGINT + description: Creation time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hard_links + type: INTEGER + description: Number of hard links + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: File status + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#device_file +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/device_firmware.yml b/source/data_dictionaries/macos/osquery/events/device_firmware.yml new file mode 100644 index 000000000..989a52f2a --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/device_firmware.yml @@ -0,0 +1,29 @@ +title: Device_firmware Table +description: A best-effort list of discovered firmware versions. +platform: macos +log_source: osquery +event_code: device_firmware +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: The device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Firmware version + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#device_firmware +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/device_hash.yml b/source/data_dictionaries/macos/osquery/events/device_hash.yml new file mode 100644 index 000000000..08583ebee --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/device_hash.yml @@ -0,0 +1,47 @@ +title: Device_hash Table +description: Similar to the hash table, but use TSK and allow block address access. +platform: macos +log_source: osquery +event_code: device_hash +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Absolute file path to device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partition + type: TEXT + description: A partition number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: BIGINT + description: Filesystem inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: MD5 hash of provided inode data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: SHA1 hash of provided inode data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: SHA256 hash of provided inode data + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#device_hash +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/device_partitions.yml b/source/data_dictionaries/macos/osquery/events/device_partitions.yml new file mode 100644 index 000000000..715130521 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/device_partitions.yml @@ -0,0 +1,65 @@ +title: Device_partitions Table +description: Use TSK to enumerate details about partitions on a disk device. +platform: macos +log_source: osquery +event_code: device_partitions +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Absolute file path to device node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partition + type: INTEGER + description: A partition number or description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offset + type: BIGINT + description: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_size + type: BIGINT + description: Byte size of each block + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks + type: BIGINT + description: Number of blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inodes + type: BIGINT + description: Number of meta nodes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: '' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#device_partitions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/disk_encryption.yml b/source/data_dictionaries/macos/osquery/events/disk_encryption.yml new file mode 100644 index 000000000..6b07f5482 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/disk_encryption.yml @@ -0,0 +1,54 @@ +title: Disk_encryption Table +description: Disk encryption status and information. +platform: macos +log_source: osquery +event_code: disk_encryption +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Disk name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Disk Universally Unique Identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: encrypted + type: INTEGER + description: '1 If encrypted: true (disk is encrypted), else 0' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Description of cipher type and mode if available + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: TEXT + description: Currently authenticated user if available (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_uuid + type: TEXT + description: UUID of authenticated user if available (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: encryption_status + type: TEXT + description: 'Disk encryption status with one of following values: encrypted | not + encrypted | undefined' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#disk_encryption +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/disk_events.yml b/source/data_dictionaries/macos/osquery/events/disk_events.yml new file mode 100644 index 000000000..de9285e42 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/disk_events.yml @@ -0,0 +1,107 @@ +title: Disk_events Table +description: Track DMG disk image events (appearance/disappearance) when opened. +platform: macos +log_source: osquery +event_code: disk_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Appear or disappear + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of the DMG file accessed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Disk event name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Disk event BSD name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: UUID of the volume inside DMG if available + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Size of partition in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ejectable + type: INTEGER + description: 1 if ejectable, 0 if not + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mountable + type: INTEGER + description: 1 if mountable, 0 if not + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: writable + type: INTEGER + description: 1 if writable, 0 if not + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: content + type: TEXT + description: Disk event content + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: media_name + type: TEXT + description: Disk event media name string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: Disk event vendor string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: filesystem + type: TEXT + description: Filesystem if available + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: checksum + type: TEXT + description: UDIF Master checksum if available (CRC32) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of appearance/disappearance in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#disk_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/dns_resolvers.yml b/source/data_dictionaries/macos/osquery/events/dns_resolvers.yml new file mode 100644 index 000000000..96e255173 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/dns_resolvers.yml @@ -0,0 +1,41 @@ +title: Dns_resolvers Table +description: Resolvers used by this host. +platform: macos +log_source: osquery +event_code: dns_resolvers +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: INTEGER + description: Address type index or order + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: 'Address type: sortlist, nameserver, search' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Resolver IP/IPv6 address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: netmask + type: TEXT + description: Address (sortlist) netmask length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: options + type: BIGINT + description: Resolver options + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#dns_resolvers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_container_labels.yml b/source/data_dictionaries/macos/osquery/events/docker_container_labels.yml new file mode 100644 index 000000000..e79a7ee53 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_container_labels.yml @@ -0,0 +1,29 @@ +title: Docker_container_labels Table +description: Docker container labels. +platform: macos +log_source: osquery +event_code: docker_container_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_container_mounts.yml b/source/data_dictionaries/macos/osquery/events/docker_container_mounts.yml new file mode 100644 index 000000000..b73b50251 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_container_mounts.yml @@ -0,0 +1,65 @@ +title: Docker_container_mounts Table +description: Docker container mounts. +platform: macos +log_source: osquery +event_code: docker_container_mounts +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of mount (bind, volume) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Optional mount name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source path on host + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: destination + type: TEXT + description: Destination path inside container + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Driver providing the mount + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: Mount options (rw, ro) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rw + type: INTEGER + description: 1 if read/write. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: propagation + type: TEXT + description: Mount propagation + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_mounts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_container_networks.yml b/source/data_dictionaries/macos/osquery/events/docker_container_networks.yml new file mode 100644 index 000000000..e08e0aed0 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_container_networks.yml @@ -0,0 +1,77 @@ +title: Docker_container_networks Table +description: Docker container networks. +platform: macos +log_source: osquery +event_code: docker_container_networks +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Network name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_id + type: TEXT + description: Network ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: endpoint_id + type: TEXT + description: Endpoint ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gateway + type: TEXT + description: Gateway + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ip_address + type: TEXT + description: IP address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ip_prefix_len + type: INTEGER + description: IP subnet prefix length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_gateway + type: TEXT + description: IPv6 gateway + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_address + type: TEXT + description: IPv6 address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_prefix_len + type: INTEGER + description: IPv6 subnet prefix length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac_address + type: TEXT + description: MAC address + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_networks +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_container_ports.yml b/source/data_dictionaries/macos/osquery/events/docker_container_ports.yml new file mode 100644 index 000000000..f06bbe0b5 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_container_ports.yml @@ -0,0 +1,41 @@ +title: Docker_container_ports Table +description: Docker container ports. +platform: macos +log_source: osquery +event_code: docker_container_ports +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Protocol (tcp, udp) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Port inside the container + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host_ip + type: TEXT + description: Host IP address on which public port is listening + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host_port + type: INTEGER + description: Host port + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_ports +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_container_processes.yml b/source/data_dictionaries/macos/osquery/events/docker_container_processes.yml new file mode 100644 index 000000000..f1ee34619 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_container_processes.yml @@ -0,0 +1,143 @@ +title: Docker_container_processes Table +description: Docker container processes. +platform: macos +log_source: osquery +event_code: docker_container_processes +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The process path or shorthand argv[0] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline + type: TEXT + description: Complete argv + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: Process state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: BIGINT + description: Effective user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: BIGINT + description: Effective group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: suid + type: BIGINT + description: Saved user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sgid + type: BIGINT + description: Saved group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wired_size + type: BIGINT + description: Bytes of unpagable memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resident_size + type: BIGINT + description: Bytes of private memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_size + type: BIGINT + description: Total virtual memory size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Process parent's PID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pgroup + type: BIGINT + description: Process group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: threads + type: INTEGER + description: Number of threads used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: nice + type: INTEGER + description: Process nice level (-20 to 20, default 0) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: TEXT + description: User name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: TEXT + description: Cumulative CPU time. [DD-]HH:MM:SS format + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu + type: DOUBLE + description: CPU utilization as percentage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mem + type: DOUBLE + description: Memory utilization as percentage + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_processes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_container_stats.yml b/source/data_dictionaries/macos/osquery/events/docker_container_stats.yml new file mode 100644 index 000000000..a7999993d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_container_stats.yml @@ -0,0 +1,156 @@ +title: Docker_container_stats Table +description: Docker container statistics. Queries on this table take at least one + second. +platform: macos +log_source: osquery +event_code: docker_container_stats +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Container name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pids + type: INTEGER + description: Number of processes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: read + type: BIGINT + description: UNIX time when stats were read + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: preread + type: BIGINT + description: UNIX time when stats were last read + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: interval + type: BIGINT + description: Difference between read and preread in nano-seconds + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_read + type: BIGINT + description: Total disk read bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_write + type: BIGINT + description: Total disk write bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: num_procs + type: INTEGER + description: Number of processors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_total_usage + type: BIGINT + description: Total CPU usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_kernelmode_usage + type: BIGINT + description: CPU kernel mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_usermode_usage + type: BIGINT + description: CPU user mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_cpu_usage + type: BIGINT + description: CPU system usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: online_cpus + type: INTEGER + description: Online CPUs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_cpu_total_usage + type: BIGINT + description: Last read total CPU usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_cpu_kernelmode_usage + type: BIGINT + description: Last read CPU kernel mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_cpu_usermode_usage + type: BIGINT + description: Last read CPU user mode usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_system_cpu_usage + type: BIGINT + description: Last read CPU system usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pre_online_cpus + type: INTEGER + description: Last read online CPUs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_usage + type: BIGINT + description: Memory usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_max_usage + type: BIGINT + description: Memory maximum usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_limit + type: BIGINT + description: Memory limit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_rx_bytes + type: BIGINT + description: Total network bytes read + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_tx_bytes + type: BIGINT + description: Total network bytes transmitted + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_container_stats +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_containers.yml b/source/data_dictionaries/macos/osquery/events/docker_containers.yml new file mode 100644 index 000000000..230bb3117 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_containers.yml @@ -0,0 +1,156 @@ +title: Docker_containers Table +description: Docker containers information. +platform: macos +log_source: osquery +event_code: docker_containers +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Container ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Container name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: image + type: TEXT + description: Docker image (name) used to launch this container + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: image_id + type: TEXT + description: Docker image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command + type: TEXT + description: Command with arguments + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: BIGINT + description: Time of creation as UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: Container state (created, restarting, running, removing, paused, exited, + dead) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Container status information + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Identifier of the initial process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Container path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_entrypoint + type: TEXT + description: Container entrypoint(s) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: started_at + type: TEXT + description: Container start time as string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: finished_at + type: TEXT + description: Container finish time as string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: privileged + type: INTEGER + description: Is the container privileged + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: security_options + type: TEXT + description: List of container security options + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env_variables + type: TEXT + description: Container environmental variables + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: readonly_rootfs + type: INTEGER + description: Is the root filesystem mounted as read only + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cgroup_namespace + type: TEXT + description: cgroup namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipc_namespace + type: TEXT + description: IPC namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mnt_namespace + type: TEXT + description: Mount namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: Network namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid_namespace + type: TEXT + description: PID namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_namespace + type: TEXT + description: User namespace [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uts_namespace + type: TEXT + description: UTS namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_containers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_image_labels.yml b/source/data_dictionaries/macos/osquery/events/docker_image_labels.yml new file mode 100644 index 000000000..b9145a8ff --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_image_labels.yml @@ -0,0 +1,29 @@ +title: Docker_image_labels Table +description: Docker image labels. +platform: macos +log_source: osquery +event_code: docker_image_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_image_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_image_layers.yml b/source/data_dictionaries/macos/osquery/events/docker_image_layers.yml new file mode 100644 index 000000000..5a2d3d47d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_image_layers.yml @@ -0,0 +1,29 @@ +title: Docker_image_layers Table +description: Docker image layers information. +platform: macos +log_source: osquery +event_code: docker_image_layers +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: layer_id + type: TEXT + description: Layer ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: layer_order + type: INTEGER + description: Layer Order (1 = base layer) + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_image_layers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_images.yml b/source/data_dictionaries/macos/osquery/events/docker_images.yml new file mode 100644 index 000000000..a618f4a21 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_images.yml @@ -0,0 +1,35 @@ +title: Docker_images Table +description: Docker images information. +platform: macos +log_source: osquery +event_code: docker_images +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Image ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: BIGINT + description: Time of creation as UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size_bytes + type: BIGINT + description: Size of image in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tags + type: TEXT + description: Comma-separated list of repository tags + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_images +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_info.yml b/source/data_dictionaries/macos/osquery/events/docker_info.yml new file mode 100644 index 000000000..c87a2b4ab --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_info.yml @@ -0,0 +1,206 @@ +title: Docker_info Table +description: Docker system information. +platform: macos +log_source: osquery +event_code: docker_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Docker system ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers + type: INTEGER + description: Total number of containers + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers_running + type: INTEGER + description: Number of containers currently running + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers_paused + type: INTEGER + description: Number of containers in paused state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: containers_stopped + type: INTEGER + description: Number of containers in stopped state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: images + type: INTEGER + description: Number of images + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: storage_driver + type: TEXT + description: Storage driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_limit + type: INTEGER + description: 1 if memory limit support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: swap_limit + type: INTEGER + description: 1 if swap limit support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kernel_memory + type: INTEGER + description: 1 if kernel memory limit support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_cfs_period + type: INTEGER + description: 1 if CPU Completely Fair Scheduler (CFS) period support is enabled. + 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_cfs_quota + type: INTEGER + description: 1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. + 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_shares + type: INTEGER + description: 1 if CPU share weighting support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_set + type: INTEGER + description: 1 if CPU set selection support is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv4_forwarding + type: INTEGER + description: 1 if IPv4 forwarding is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bridge_nf_iptables + type: INTEGER + description: 1 if bridge netfilter iptables is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bridge_nf_ip6tables + type: INTEGER + description: 1 if bridge netfilter ip6tables is enabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: oom_kill_disable + type: INTEGER + description: 1 if Out-of-memory kill is disabled. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logging_driver + type: TEXT + description: Logging driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cgroup_driver + type: TEXT + description: Control groups driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kernel_version + type: TEXT + description: Kernel version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os + type: TEXT + description: Operating system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os_type + type: TEXT + description: Operating system type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: architecture + type: TEXT + description: Hardware architecture + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpus + type: INTEGER + description: Number of CPUs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory + type: BIGINT + description: Total memory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: http_proxy + type: TEXT + description: HTTP proxy + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: https_proxy + type: TEXT + description: HTTPS proxy + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: no_proxy + type: TEXT + description: Comma-separated list of domain extensions proxy should not be used + for + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the docker host + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: server_version + type: TEXT + description: Server version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: root_dir + type: TEXT + description: Docker root directory + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_network_labels.yml b/source/data_dictionaries/macos/osquery/events/docker_network_labels.yml new file mode 100644 index 000000000..9b49dafb1 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_network_labels.yml @@ -0,0 +1,29 @@ +title: Docker_network_labels Table +description: Docker network labels. +platform: macos +log_source: osquery +event_code: docker_network_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Network ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_network_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_networks.yml b/source/data_dictionaries/macos/osquery/events/docker_networks.yml new file mode 100644 index 000000000..59b4dd782 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_networks.yml @@ -0,0 +1,53 @@ +title: Docker_networks Table +description: Docker networks information. +platform: macos +log_source: osquery +event_code: docker_networks +event_fields: +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: Network ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Network name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Network driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: BIGINT + description: Time of creation as UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enable_ipv6 + type: INTEGER + description: 1 if IPv6 is enabled on this network. 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subnet + type: TEXT + description: Network subnet + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gateway + type: TEXT + description: Network gateway + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_networks +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_version.yml b/source/data_dictionaries/macos/osquery/events/docker_version.yml new file mode 100644 index 000000000..d96d0ad2b --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_version.yml @@ -0,0 +1,65 @@ +title: Docker_version Table +description: Docker version information. +platform: macos +log_source: osquery +event_code: docker_version +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Docker version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: api_version + type: TEXT + description: API version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: min_api_version + type: TEXT + description: Minimum API version supported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: git_commit + type: TEXT + description: Docker build git commit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: go_version + type: TEXT + description: Go version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os + type: TEXT + description: Operating system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: arch + type: TEXT + description: Hardware architecture + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kernel_version + type: TEXT + description: Kernel version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_time + type: TEXT + description: Build time + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_version +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_volume_labels.yml b/source/data_dictionaries/macos/osquery/events/docker_volume_labels.yml new file mode 100644 index 000000000..cc24b47f7 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_volume_labels.yml @@ -0,0 +1,29 @@ +title: Docker_volume_labels Table +description: Docker volume labels. +platform: macos +log_source: osquery +event_code: docker_volume_labels +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Volume name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Label key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Optional label value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_volume_labels +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/docker_volumes.yml b/source/data_dictionaries/macos/osquery/events/docker_volumes.yml new file mode 100644 index 000000000..05d4d646d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/docker_volumes.yml @@ -0,0 +1,35 @@ +title: Docker_volumes Table +description: Docker volumes information. +platform: macos +log_source: osquery +event_code: docker_volumes +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Volume name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Volume driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mount_point + type: TEXT + description: Mount point + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Volume type + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#docker_volumes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/etc_hosts.yml b/source/data_dictionaries/macos/osquery/events/etc_hosts.yml new file mode 100644 index 000000000..9a9984755 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/etc_hosts.yml @@ -0,0 +1,23 @@ +title: Etc_hosts Table +description: Line-parsed /etc/hosts. +platform: macos +log_source: osquery +event_code: etc_hosts +event_fields: +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: IP address mapping + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hostnames + type: TEXT + description: Raw hosts mapping + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_hosts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/etc_protocols.yml b/source/data_dictionaries/macos/osquery/events/etc_protocols.yml new file mode 100644 index 000000000..54f97834a --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/etc_protocols.yml @@ -0,0 +1,35 @@ +title: Etc_protocols Table +description: Line-parsed /etc/protocols. +platform: macos +log_source: osquery +event_code: etc_protocols +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Protocol name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: number + type: INTEGER + description: Protocol number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: alias + type: TEXT + description: Protocol alias + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Comment with protocol description + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_protocols +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/etc_services.yml b/source/data_dictionaries/macos/osquery/events/etc_services.yml new file mode 100644 index 000000000..4ed0aa34c --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/etc_services.yml @@ -0,0 +1,41 @@ +title: Etc_services Table +description: Line-parsed /etc/services. +platform: macos +log_source: osquery +event_code: etc_services +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Service name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Service port number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: TEXT + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: aliases + type: TEXT + description: Optional space separated list of other names for a service + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Optional comment for a service. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_services +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/event_taps.yml b/source/data_dictionaries/macos/osquery/events/event_taps.yml new file mode 100644 index 000000000..743dc4075 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/event_taps.yml @@ -0,0 +1,41 @@ +title: Event_taps Table +description: Returns information about installed event taps. +platform: macos +log_source: osquery +event_code: event_taps +event_fields: +- standard_name: TBD + standard_type: TBD + name: enabled + type: INTEGER + description: Is the Event Tap enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: event_tap_id + type: INTEGER + description: Unique ID for the Tap + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: event_tapped + type: TEXT + description: The mask that identifies the set of events to be observed. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: process_being_tapped + type: INTEGER + description: The process ID of the target application + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tapping_process + type: INTEGER + description: The process ID of the application that created the event tap. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#event_taps +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/example.yml b/source/data_dictionaries/macos/osquery/events/example.yml new file mode 100644 index 000000000..faef15036 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/example.yml @@ -0,0 +1,47 @@ +title: Example Table +description: This is an example table spec. +platform: macos +log_source: osquery +event_code: example +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Description for name column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: points + type: INTEGER + description: This is a signed SQLite int column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: This is a signed SQLite bigint column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Action performed in generation + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: id + type: INTEGER + description: An index of some sort + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of example + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#example +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/extended_attributes.yml b/source/data_dictionaries/macos/osquery/events/extended_attributes.yml new file mode 100644 index 000000000..d5e76c771 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/extended_attributes.yml @@ -0,0 +1,41 @@ +title: Extended_attributes Table +description: Returns the extended attributes for files (similar to Windows ADS). +platform: macos +log_source: osquery +event_code: extended_attributes +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Absolute file path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: Directory of file(s) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Name of the value generated from the extended attribute + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: The parsed information from the attribute + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: base64 + type: INTEGER + description: 1 if the value is base64 encoded else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#extended_attributes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/fan_speed_sensors.yml b/source/data_dictionaries/macos/osquery/events/fan_speed_sensors.yml new file mode 100644 index 000000000..705855dde --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/fan_speed_sensors.yml @@ -0,0 +1,47 @@ +title: Fan_speed_sensors Table +description: Fan speeds. +platform: macos +log_source: osquery +event_code: fan_speed_sensors +event_fields: +- standard_name: TBD + standard_type: TBD + name: fan + type: TEXT + description: Fan number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Fan name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: actual + type: INTEGER + description: Actual speed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: min + type: INTEGER + description: Minimum speed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: max + type: INTEGER + description: Maximum speed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: target + type: INTEGER + description: Target speed + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#fan_speed_sensors +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/file.yml b/source/data_dictionaries/macos/osquery/events/file.yml index 3bcbfa6a0..ab0213e7e 100644 --- a/source/data_dictionaries/macos/osquery/events/file.yml +++ b/source/data_dictionaries/macos/osquery/events/file.yml @@ -4,109 +4,117 @@ platform: macos log_source: osquery event_code: file event_fields: -- standard_name: file _path +- standard_name: file_path standard_type: TBD name: path type: TEXT description: Absolute file path - sample_value: '' -- standard_name: file_directory + sample_value: file_directory +- standard_name: TBD standard_type: TBD name: directory type: TEXT description: Directory of file(s) - sample_value: '' + sample_value: TBD - standard_name: file_name standard_type: TBD name: filename type: TEXT description: Name portion of file path - sample_value: '' + sample_value: TBD - standard_name: file_inode standard_type: TBD name: inode type: BIGINT description: Filesystem inode number - sample_value: '' + sample_value: TBD - standard_name: user_uid standard_type: TBD name: uid type: BIGINT description: Owning user ID - sample_value: '' + sample_value: TBD - standard_name: user_gid standard_type: TBD name: gid type: BIGINT description: Owning group ID - sample_value: '' + sample_value: TBD - standard_name: user_permissions standard_type: TBD name: mode type: TEXT description: Permission bits - sample_value: '' + sample_value: TBD - standard_name: device_id standard_type: TBD name: device type: BIGINT description: Device ID (optional) - sample_value: '' + sample_value: TBD - standard_name: file_size standard_type: TBD name: size type: BIGINT description: Size of file in bytes - sample_value: '' -- standard_name: file_block_size + sample_value: TBD +- standard_name: file_system_block_size standard_type: TBD name: block_size type: INTEGER description: Block size of filesystem - sample_value: '' + sample_value: TBD - standard_name: date_last_access standard_type: TBD name: atime type: BIGINT description: Last access time - sample_value: '' + sample_value: TBD - standard_name: date_last_modification standard_type: TBD name: mtime type: BIGINT description: Last modification time - sample_value: '' + sample_value: TBD - standard_name: date_last_status_change standard_type: TBD name: ctime type: BIGINT description: Last status change time - sample_value: '' + sample_value: TBD - standard_name: date_creation_time standard_type: TBD name: btime type: BIGINT description: (B)irth or (cr)eate time - sample_value: '' + sample_value: TBD - standard_name: file_hard_links standard_type: TBD name: hard_links type: INTEGER description: Number of hard links - sample_value: '' + sample_value: TBD - standard_name: file_symlink standard_type: TBD name: symlink type: INTEGER description: 1 if the path is a symlink, otherwise 0 - sample_value: '' + sample_value: TBD - standard_name: file_type standard_type: TBD name: type type: TEXT description: File status - sample_value: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bsd_flags + type: TEXT + description: 'The BSD file flags (chflags). Possible values: NODUMP, UF_IMMUTABLE, + UF_APPEND, OPAQUE, HIDDEN, ARCHIVED, SF_IMMUTABLE, SF_APPEND [DARWIN]' + sample_value: TBD references: -- text: osquery GitHub - link: https://github.com/facebook/osquery/blob/master/specs/utility/file.table -tags: [] +- text: OSQuery table documentation + link: https://osquery.io/schema/current#file +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/file_events.yml b/source/data_dictionaries/macos/osquery/events/file_events.yml new file mode 100644 index 000000000..154dfb75a --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/file_events.yml @@ -0,0 +1,113 @@ +title: File_events Table +description: Track time/action changes to files specified in configuration data. +platform: macos +log_source: osquery +event_code: file_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: target_path + type: TEXT + description: The path associated with the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: category + type: TEXT + description: The category of the file defined in the config + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Change action (UPDATE, REMOVE, etc) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: transaction_id + type: BIGINT + description: ID used during bulk update + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: BIGINT + description: Filesystem inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Owning user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Owning group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: Permission bits + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Size of file in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: atime + type: BIGINT + description: Last access time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: BIGINT + description: Last modification time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ctime + type: BIGINT + description: Last status change time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: The MD5 of the file after change + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: The SHA1 of the file after change + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: The SHA256 of the file after change + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of file event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#file_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/firefox_addons.yml b/source/data_dictionaries/macos/osquery/events/firefox_addons.yml new file mode 100644 index 000000000..5def551db --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/firefox_addons.yml @@ -0,0 +1,83 @@ +title: Firefox_addons Table +description: Firefox browser extensions, webapps, and addons. +platform: macos +log_source: osquery +event_code: firefox_addons +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the addon + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Addon display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Addon identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: creator + type: TEXT + description: Addon-supported creator string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Extension, addon, webapp + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Addon-supplied version string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Addon-supplied description string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source_url + type: TEXT + description: URL that installed the addon + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: visible + type: INTEGER + description: 1 If the addon is shown in browser else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: 1 If the addon is active else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: location + type: TEXT + description: Global, profile location + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to plugin bundle + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#firefox_addons +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/gatekeeper.yml b/source/data_dictionaries/macos/osquery/events/gatekeeper.yml new file mode 100644 index 000000000..c7f68a20d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/gatekeeper.yml @@ -0,0 +1,36 @@ +title: Gatekeeper Table +description: OS X Gatekeeper Details. +platform: macos +log_source: osquery +event_code: gatekeeper +event_fields: +- standard_name: TBD + standard_type: TBD + name: assessments_enabled + type: INTEGER + description: 1 If a Gatekeeper is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dev_id_enabled + type: INTEGER + description: 1 If a Gatekeeper allows execution from identified developers else + 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Version of Gatekeeper's gke.bundle + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: opaque_version + type: TEXT + description: Version of Gatekeeper's gkopaque.bundle + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#gatekeeper +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/gatekeeper_approved_apps.yml b/source/data_dictionaries/macos/osquery/events/gatekeeper_approved_apps.yml new file mode 100644 index 000000000..9d026643c --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/gatekeeper_approved_apps.yml @@ -0,0 +1,35 @@ +title: Gatekeeper_approved_apps Table +description: Gatekeeper apps a user has allowed to run. +platform: macos +log_source: osquery +event_code: gatekeeper_approved_apps +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of executable allowed to run + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: requirement + type: TEXT + description: Code signing requirement language + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ctime + type: DOUBLE + description: Last change time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: DOUBLE + description: Last modification time + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#gatekeeper_approved_apps +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/groups.yml b/source/data_dictionaries/macos/osquery/events/groups.yml new file mode 100644 index 000000000..ac1f1893a --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/groups.yml @@ -0,0 +1,47 @@ +title: Groups Table +description: Local system groups. +platform: macos +log_source: osquery +event_code: groups +event_fields: +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Unsigned int64 group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid_signed + type: BIGINT + description: A signed int64 version of gid + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: groupname + type: TEXT + description: Canonical local group name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: group_sid + type: TEXT + description: Unique group ID [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Remarks or comments associated with the group [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_hidden + type: INTEGER + description: IsHidden attribute set in OpenDirectory [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#groups +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/hardware_events.yml b/source/data_dictionaries/macos/osquery/events/hardware_events.yml new file mode 100644 index 000000000..35d423cd2 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/hardware_events.yml @@ -0,0 +1,83 @@ +title: Hardware_events Table +description: Hardware (PCI/USB/HID) events from UDEV or IOKit. +platform: macos +log_source: osquery +event_code: hardware_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Remove, insert, change properties, etc + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Local device path assigned (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of hardware and hardware event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: Driver claiming the device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: Hardware device vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor_id + type: TEXT + description: Hex encoded Hardware vendor identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: Hardware device model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model_id + type: TEXT + description: Hex encoded Hardware model identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial + type: TEXT + description: Device serial (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: revision + type: TEXT + description: Device revision (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of hardware event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#hardware_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/hash.yml b/source/data_dictionaries/macos/osquery/events/hash.yml new file mode 100644 index 000000000..5ee0d3f9a --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/hash.yml @@ -0,0 +1,47 @@ +title: Hash Table +description: Filesystem hash data. +platform: macos +log_source: osquery +event_code: hash +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Must provide a path or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: Must provide a path or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: MD5 hash of provided filesystem data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: SHA1 hash of provided filesystem data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: SHA256 hash of provided filesystem data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssdeep + type: TEXT + description: ssdeep hash of provided filesystem data [POSIX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#hash +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/homebrew_packages.yml b/source/data_dictionaries/macos/osquery/events/homebrew_packages.yml new file mode 100644 index 000000000..f42ea7863 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/homebrew_packages.yml @@ -0,0 +1,29 @@ +title: Homebrew_packages Table +description: The installed homebrew package database. +platform: macos +log_source: osquery +event_code: homebrew_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Package install path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Current 'linked' version + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#homebrew_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/hvci_status.yml b/source/data_dictionaries/macos/osquery/events/hvci_status.yml new file mode 100644 index 000000000..191eb4c74 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/hvci_status.yml @@ -0,0 +1,44 @@ +title: Hvci_status Table +description: Retrieve HVCI info of the machine. +platform: macos +log_source: osquery +event_code: hvci_status +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: The version number of the Device Guard build. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: instance_identifier + type: TEXT + description: The instance ID of Device Guard. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vbs_status + type: TEXT + description: The status of the virtualization based security settings. Returns UNKNOWN + if an error is encountered. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: code_integrity_policy_enforcement_status + type: TEXT + description: The status of the code integrity policy enforcement settings. Returns + UNKNOWN if an error is encountered. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: umci_policy_status + type: TEXT + description: The status of the User Mode Code Integrity security settings. Returns + UNKNOWN if an error is encountered. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#hvci_status +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/ibridge_info.yml b/source/data_dictionaries/macos/osquery/events/ibridge_info.yml new file mode 100644 index 000000000..42bfb7443 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/ibridge_info.yml @@ -0,0 +1,35 @@ +title: Ibridge_info Table +description: Information about the Apple iBridge hardware controller. +platform: macos +log_source: osquery +event_code: ibridge_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: boot_uuid + type: TEXT + description: Boot UUID of the iBridge controller + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: coprocessor_version + type: TEXT + description: The manufacturer and chip version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: firmware_version + type: TEXT + description: The build version of the firmware + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: unique_chip_id + type: TEXT + description: Unique id of the iBridge controller + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ibridge_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/interface_addresses.yml b/source/data_dictionaries/macos/osquery/events/interface_addresses.yml new file mode 100644 index 000000000..70860ca11 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/interface_addresses.yml @@ -0,0 +1,53 @@ +title: Interface_addresses Table +description: Network interfaces and relevant metadata. +platform: macos +log_source: osquery +event_code: interface_addresses +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Specific address for interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mask + type: TEXT + description: Interface netmask + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: broadcast + type: TEXT + description: Broadcast address for the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: point_to_point + type: TEXT + description: PtP address for the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of address. One of dhcp, manual, auto, other, unknown + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: friendly_name + type: TEXT + description: The friendly display name of the interface. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_addresses +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/interface_details.yml b/source/data_dictionaries/macos/osquery/events/interface_details.yml new file mode 100644 index 000000000..793507f70 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/interface_details.yml @@ -0,0 +1,231 @@ +title: Interface_details Table +description: Detailed information and stats of network interfaces. +platform: macos +log_source: osquery +event_code: interface_details +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac + type: TEXT + description: MAC of interface (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: Interface type (includes virtual) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtu + type: INTEGER + description: Network MTU + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric + type: INTEGER + description: Metric based on the speed of the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: Flags (netdevice) for the device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipackets + type: BIGINT + description: Input packets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: opackets + type: BIGINT + description: Output packets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ibytes + type: BIGINT + description: Input bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: obytes + type: BIGINT + description: Output bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ierrors + type: BIGINT + description: Input errors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: oerrors + type: BIGINT + description: Output errors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: idrops + type: BIGINT + description: Input drops + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: odrops + type: BIGINT + description: Output drops + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collisions + type: BIGINT + description: Packet Collisions detected + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_change + type: BIGINT + description: Time of last device modification (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: link_speed + type: BIGINT + description: Interface speed in Mb/s [POSIX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_slot + type: TEXT + description: PCI slot number [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: friendly_name + type: TEXT + description: The friendly display name of the interface. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Short description of the object a one-line string. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: Name of the network adapter's manufacturer. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: connection_id + type: TEXT + description: Name of the network connection as it appears in the Network Connections + Control Panel program. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: connection_status + type: TEXT + description: State of the network adapter connection to the network. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: INTEGER + description: Indicates whether the adapter is enabled or not. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: physical_adapter + type: INTEGER + description: Indicates whether the adapter is a physical or a logical adapter. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: speed + type: INTEGER + description: Estimate of the current bandwidth in bits per second. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: service + type: TEXT + description: The name of the service the network adapter uses. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_enabled + type: INTEGER + description: If TRUE, the dynamic host configuration protocol (DHCP) server automatically + assigns an IP address to the computer system when establishing a network connection. + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_lease_expires + type: TEXT + description: Expiration date and time for a leased IP address that was assigned + to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_lease_obtained + type: TEXT + description: Date and time the lease was obtained for the IP address assigned to + the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_server + type: TEXT + description: IP address of the dynamic host configuration protocol (DHCP) server. + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_domain + type: TEXT + description: Organization name followed by a period and an extension that indicates + the type of organization, such as 'microsoft.com'. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_domain_suffix_search_order + type: TEXT + description: Array of DNS domain suffixes to be appended to the end of host names + during name resolution. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_host_name + type: TEXT + description: Host name used to identify the local computer for authentication by + some utilities. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_server_search_order + type: TEXT + description: Array of server IP addresses to be used in querying for DNS servers. + [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_details +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/interface_ipv6.yml b/source/data_dictionaries/macos/osquery/events/interface_ipv6.yml new file mode 100644 index 000000000..cd2b92c01 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/interface_ipv6.yml @@ -0,0 +1,41 @@ +title: Interface_ipv6 Table +description: IPv6 configuration and stats of network interfaces. +platform: macos +log_source: osquery +event_code: interface_ipv6 +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hop_limit + type: INTEGER + description: Current Hop Limit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: forwarding_enabled + type: INTEGER + description: Enable IP forwarding + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: redirect_accept + type: INTEGER + description: Accept ICMP redirect messages + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rtadv_accept + type: INTEGER + description: Accept ICMP Router Advertisement + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_ipv6 +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/iokit_devicetree.yml b/source/data_dictionaries/macos/osquery/events/iokit_devicetree.yml new file mode 100644 index 000000000..fe1e23f47 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/iokit_devicetree.yml @@ -0,0 +1,65 @@ +title: Iokit_devicetree Table +description: The IOKit registry matching the DeviceTree plane. +platform: macos +log_source: osquery +event_code: iokit_devicetree +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Device node name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: Best matching device class (most-specific category) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: id + type: BIGINT + description: IOKit internal registry ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Parent device registry ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device_path + type: TEXT + description: Device tree path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: service + type: INTEGER + description: 1 if the device conforms to IOService else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: busy_state + type: INTEGER + description: 1 if the device is in a busy state else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: retain_count + type: INTEGER + description: The device reference count + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: depth + type: INTEGER + description: Device nested depth + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#iokit_devicetree +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/iokit_registry.yml b/source/data_dictionaries/macos/osquery/events/iokit_registry.yml new file mode 100644 index 000000000..3af4cebee --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/iokit_registry.yml @@ -0,0 +1,53 @@ +title: Iokit_registry Table +description: The full IOKit registry without selecting a plane. +platform: macos +log_source: osquery +event_code: iokit_registry +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Default name of the node + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: Best matching device class (most-specific category) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: id + type: BIGINT + description: IOKit internal registry ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Parent registry ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: busy_state + type: INTEGER + description: 1 if the node is in a busy state else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: retain_count + type: INTEGER + description: The node reference count + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: depth + type: INTEGER + description: Node nested depth + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#iokit_registry +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/kernel_extensions.yml b/source/data_dictionaries/macos/osquery/events/kernel_extensions.yml new file mode 100644 index 000000000..091a9c4ba --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/kernel_extensions.yml @@ -0,0 +1,47 @@ +title: Kernel_extensions Table +description: OS X's kernel extensions, both loaded and within the load search path. +platform: macos +log_source: osquery +event_code: kernel_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: idx + type: INTEGER + description: Extension load tag or index + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: refs + type: INTEGER + description: Reference count + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Bytes of wired memory used by extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension label + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Optional path to extension bundle + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#kernel_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/kernel_info.yml b/source/data_dictionaries/macos/osquery/events/kernel_info.yml new file mode 100644 index 000000000..70bdfd82a --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/kernel_info.yml @@ -0,0 +1,35 @@ +title: Kernel_info Table +description: Basic active kernel information. +platform: macos +log_source: osquery +event_code: kernel_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Kernel version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: arguments + type: TEXT + description: Kernel arguments + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Kernel path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Kernel device identifier + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#kernel_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/kernel_panics.yml b/source/data_dictionaries/macos/osquery/events/kernel_panics.yml new file mode 100644 index 000000000..cb9427ece --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/kernel_panics.yml @@ -0,0 +1,89 @@ +title: Kernel_panics Table +description: System kernel panic logs. +platform: macos +log_source: osquery +event_code: kernel_panics +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Location of log file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: TEXT + description: Formatted time of the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: registers + type: TEXT + description: A space delimited line of register:value pairs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: frame_backtrace + type: TEXT + description: Backtrace of the crashed module + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: module_backtrace + type: TEXT + description: Modules appearing in the crashed module's backtrace + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dependencies + type: TEXT + description: Module dependencies existing in crashed module's backtrace + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Process name corresponding to crashed thread + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os_version + type: TEXT + description: Version of the operating system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kernel_version + type: TEXT + description: Version of the system kernel + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_model + type: TEXT + description: Physical system model, for example 'MacBookPro12,1 (Mac-E43C1C25D4880AD6)' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uptime + type: BIGINT + description: System uptime at kernel panic in nanoseconds + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_loaded + type: TEXT + description: Last loaded module before panic + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_unloaded + type: TEXT + description: Last unloaded module before panic + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#kernel_panics +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/keychain_acls.yml b/source/data_dictionaries/macos/osquery/events/keychain_acls.yml new file mode 100644 index 000000000..893049401 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/keychain_acls.yml @@ -0,0 +1,41 @@ +title: Keychain_acls Table +description: Applications that have ACL entries in the keychain. +platform: macos +log_source: osquery +event_code: keychain_acls +event_fields: +- standard_name: TBD + standard_type: TBD + name: keychain_path + type: TEXT + description: The path of the keychain + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: authorizations + type: TEXT + description: A space delimited set of authorization attributes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path of the authorized application + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: The description included with the ACL entry + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: An optional label tag that may be included with the keychain entry + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#keychain_acls +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/keychain_items.yml b/source/data_dictionaries/macos/osquery/events/keychain_items.yml new file mode 100644 index 000000000..5327243ec --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/keychain_items.yml @@ -0,0 +1,53 @@ +title: Keychain_items Table +description: Generic details about keychain items. +platform: macos +log_source: osquery +event_code: keychain_items +event_fields: +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: Generic item name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Optional item description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Optional keychain comment + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: created + type: TEXT + description: Data item was created + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: modified + type: TEXT + description: Date of last modification + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Keychain item type (class) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to keychain containing item + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#keychain_items +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/known_hosts.yml b/source/data_dictionaries/macos/osquery/events/known_hosts.yml new file mode 100644 index 000000000..f71040b16 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/known_hosts.yml @@ -0,0 +1,29 @@ +title: Known_hosts Table +description: A line-delimited known_hosts table. +platform: macos +log_source: osquery +event_code: known_hosts +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the known_hosts file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: parsed authorized keys line + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_file + type: TEXT + description: Path to known_hosts file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#known_hosts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/last.yml b/source/data_dictionaries/macos/osquery/events/last.yml new file mode 100644 index 000000000..64103eef0 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/last.yml @@ -0,0 +1,47 @@ +title: Last Table +description: System logins and logouts. +platform: macos +log_source: osquery +event_code: last +event_fields: +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Entry username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tty + type: TEXT + description: Entry terminal + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: Entry type, according to ut_type types (utmp.h) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Entry timestamp + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host + type: TEXT + description: Entry hostname + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#last +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/launchd.yml b/source/data_dictionaries/macos/osquery/events/launchd.yml new file mode 100644 index 000000000..60ba89c8e --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/launchd.yml @@ -0,0 +1,89 @@ +title: Launchd Table +description: LaunchAgents and LaunchDaemons from default search paths. +platform: macos +log_source: osquery +event_code: launchd +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to daemon or agent plist + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: File name of plist (used by launchd) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: Daemon or agent service name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: program + type: TEXT + description: Path to target program + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: run_at_load + type: TEXT + description: Should the program run on launch load + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: keep_alive + type: TEXT + description: Should the process be restarted if killed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: on_demand + type: TEXT + description: Deprecated key, replaced by keep_alive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disabled + type: TEXT + description: Skip loading this daemon or agent on boot + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Run this daemon or agent as this username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: groupname + type: TEXT + description: Run this daemon or agent as this group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: stdout_path + type: TEXT + description: Pipe stdout to a target path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: stderr_path + type: TEXT + description: Pipe stderr to a target path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start_interval + type: TEXT + description: Frequency to run in seconds + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#launchd +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/launchd_overrides.yml b/source/data_dictionaries/macos/osquery/events/launchd_overrides.yml new file mode 100644 index 000000000..ab55ffa45 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/launchd_overrides.yml @@ -0,0 +1,41 @@ +title: Launchd_overrides Table +description: Override keys, per user, for LaunchDaemons and Agents. +platform: macos +log_source: osquery +event_code: launchd_overrides +event_fields: +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: Daemon or agent service name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Name of the override key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Overridden value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID applied to the override, 0 applies to all + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to daemon or agent plist + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#launchd_overrides +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/listening_ports.yml b/source/data_dictionaries/macos/osquery/events/listening_ports.yml new file mode 100644 index 000000000..cb89fa207 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/listening_ports.yml @@ -0,0 +1,65 @@ +title: Listening_ports Table +description: Processes with listening (bound) network sockets/ports. +platform: macos +log_source: osquery +event_code: listening_ports +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Transport layer port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: INTEGER + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: family + type: INTEGER + description: Network protocol (IPv4, IPv6) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Specific address for bind + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Socket file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: socket + type: BIGINT + description: Socket handle or inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path for UNIX domain sockets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: The inode number of the network namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#listening_ports +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/lldp_neighbors.yml b/source/data_dictionaries/macos/osquery/events/lldp_neighbors.yml new file mode 100644 index 000000000..43e391721 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/lldp_neighbors.yml @@ -0,0 +1,425 @@ +title: Lldp_neighbors Table +description: LLDP neighbors of interfaces. +platform: macos +log_source: osquery +event_code: lldp_neighbors +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rid + type: INTEGER + description: Neighbor chassis index + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_id_type + type: TEXT + description: Neighbor chassis ID type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_id + type: TEXT + description: Neighbor chassis ID value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_sysname + type: TEXT + description: CPU brand string, contains vendor and model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_sys_description + type: INTEGER + description: Max number of CPU physical cores + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_bridge_capability_available + type: INTEGER + description: Chassis bridge capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_bridge_capability_enabled + type: INTEGER + description: Is chassis bridge capability enabled. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_router_capability_available + type: INTEGER + description: Chassis router capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_router_capability_enabled + type: INTEGER + description: Chassis router capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_repeater_capability_available + type: INTEGER + description: Chassis repeater capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_repeater_capability_enabled + type: INTEGER + description: Chassis repeater capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_wlan_capability_available + type: INTEGER + description: Chassis wlan capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_wlan_capability_enabled + type: INTEGER + description: Chassis wlan capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_tel_capability_available + type: INTEGER + description: Chassis telephone capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_tel_capability_enabled + type: INTEGER + description: Chassis telephone capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_docsis_capability_available + type: INTEGER + description: Chassis DOCSIS capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_docsis_capability_enabled + type: INTEGER + description: Chassis DOCSIS capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_station_capability_available + type: INTEGER + description: Chassis station capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_station_capability_enabled + type: INTEGER + description: Chassis station capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_other_capability_available + type: INTEGER + description: Chassis other capability availability + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_other_capability_enabled + type: INTEGER + description: Chassis other capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: chassis_mgmt_ips + type: TEXT + description: Comma delimited list of chassis management IPS + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_id_type + type: TEXT + description: Port ID type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_id + type: TEXT + description: Port ID value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_description + type: TEXT + description: Port description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_ttl + type: BIGINT + description: Age of neighbor port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_mfs + type: BIGINT + description: Port max frame size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_aggregation_id + type: TEXT + description: Port aggregation ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_supported + type: INTEGER + description: Auto negotiation supported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_enabled + type: INTEGER + description: Is auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_mau_type + type: TEXT + description: MAU type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_10baset_hd_enabled + type: INTEGER + description: 10Base-T HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_10baset_fd_enabled + type: INTEGER + description: 10Base-T FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100basetx_hd_enabled + type: INTEGER + description: 100Base-TX HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100basetx_fd_enabled + type: INTEGER + description: 100Base-TX FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset2_hd_enabled + type: INTEGER + description: 100Base-T2 HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset2_fd_enabled + type: INTEGER + description: 100Base-T2 FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset4_hd_enabled + type: INTEGER + description: 100Base-T4 HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_100baset4_fd_enabled + type: INTEGER + description: 100Base-T4 FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000basex_hd_enabled + type: INTEGER + description: 1000Base-X HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000basex_fd_enabled + type: INTEGER + description: 1000Base-X FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000baset_hd_enabled + type: INTEGER + description: 1000Base-T HD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port_autoneg_1000baset_fd_enabled + type: INTEGER + description: 1000Base-T FD auto negotiation enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_device_type + type: TEXT + description: Dot3 power device type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_mdi_supported + type: INTEGER + description: MDI power supported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_mdi_enabled + type: INTEGER + description: Is MDI power enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_paircontrol_enabled + type: INTEGER + description: Is power pair control enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_pairs + type: TEXT + description: Dot3 power pairs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_class + type: TEXT + description: Power class + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_enabled + type: INTEGER + description: Is 802.3at enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_type + type: TEXT + description: 802.3at power type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_source + type: TEXT + description: 802.3at power source + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_priority + type: TEXT + description: 802.3at power priority + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_allocated + type: TEXT + description: 802.3at power allocated + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_8023at_power_requested + type: TEXT + description: 802.3at power requested + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_device_type + type: TEXT + description: Chassis MED type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_capabilities + type: INTEGER + description: Is MED capabilities enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_policy + type: INTEGER + description: Is MED policy capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_location + type: INTEGER + description: Is MED location capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_mdi_pse + type: INTEGER + description: Is MED MDI PSE capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_mdi_pd + type: INTEGER + description: Is MED MDI PD capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_capability_inventory + type: INTEGER + description: Is MED inventory capability enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: med_policies + type: TEXT + description: Comma delimited list of MED policies + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vlans + type: TEXT + description: Comma delimited list of vlan ids + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pvid + type: TEXT + description: Primary VLAN id + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ppvids_supported + type: TEXT + description: Comma delimited list of supported PPVIDs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ppvids_enabled + type: TEXT + description: Comma delimited list of enabled PPVIDs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pids + type: TEXT + description: Comma delimited list of PIDs + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#lldp_neighbors +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/load_average.yml b/source/data_dictionaries/macos/osquery/events/load_average.yml new file mode 100644 index 000000000..7a002f50f --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/load_average.yml @@ -0,0 +1,23 @@ +title: Load_average Table +description: Displays information about the system wide load averages. +platform: macos +log_source: osquery +event_code: load_average +event_fields: +- standard_name: TBD + standard_type: TBD + name: period + type: TEXT + description: Period over which the average is calculated. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: average + type: TEXT + description: Load average over the specified period. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#load_average +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/logged_in_users.yml b/source/data_dictionaries/macos/osquery/events/logged_in_users.yml new file mode 100644 index 000000000..e0d3ac411 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/logged_in_users.yml @@ -0,0 +1,59 @@ +title: Logged_in_users Table +description: Users with an active shell on the system. +platform: macos +log_source: osquery +event_code: logged_in_users +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Login type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: TEXT + description: User login name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tty + type: TEXT + description: Device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host + type: TEXT + description: Remote hostname + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Time entry was made + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sid + type: TEXT + description: The user's unique security identifier [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: registry_hive + type: TEXT + description: HKEY_USERS registry hive [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#logged_in_users +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/magic.yml b/source/data_dictionaries/macos/osquery/events/magic.yml new file mode 100644 index 000000000..67dd71ee8 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/magic.yml @@ -0,0 +1,43 @@ +title: Magic Table +description: Magic number recognition library table. +platform: macos +log_source: osquery +event_code: magic +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Absolute path to target file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: magic_db_files + type: TEXT + description: 'Colon(:) separated list of files where the magic db file can be found. + By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic + or /usr/share/misc/magic.mgc' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: data + type: TEXT + description: Magic number data from libmagic + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mime_type + type: TEXT + description: MIME type data from libmagic + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mime_encoding + type: TEXT + description: MIME encoding data from libmagic + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#magic +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/managed_policies.yml b/source/data_dictionaries/macos/osquery/events/managed_policies.yml new file mode 100644 index 000000000..a3eed1f61 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/managed_policies.yml @@ -0,0 +1,47 @@ +title: Managed_policies Table +description: The managed configuration policies from AD, MDM, MCX, etc. +platform: macos +log_source: osquery +event_code: managed_policies +event_fields: +- standard_name: TBD + standard_type: TBD + name: domain + type: TEXT + description: System or manager-chosen domain key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Optional UUID assigned to policy set + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Policy key name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Policy value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Policy applies only this user + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manual + type: INTEGER + description: 1 if policy was loaded manually, otherwise 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#managed_policies +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/mdfind.yml b/source/data_dictionaries/macos/osquery/events/mdfind.yml new file mode 100644 index 000000000..489d267cb --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/mdfind.yml @@ -0,0 +1,23 @@ +title: Mdfind Table +description: Run searches against the spotlight database. +platform: macos +log_source: osquery +event_code: mdfind +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of the file returned from spotlight + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: query + type: TEXT + description: The query that was run to find the file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#mdfind +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/memory_array_mapped_addresses.yml b/source/data_dictionaries/macos/osquery/events/memory_array_mapped_addresses.yml new file mode 100644 index 000000000..3246a4034 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/memory_array_mapped_addresses.yml @@ -0,0 +1,17 @@ +title: Memory_array_mapped_addresses Table +description: Data associated for address mapping of physical memory arrays. +platform: macos +log_source: osquery +event_code: memory_array_mapped_addresses +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: ' TEXT' + description: Handle, or instance number, associated with the structure + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_array_mapped_addresses +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/memory_arrays.yml b/source/data_dictionaries/macos/osquery/events/memory_arrays.yml new file mode 100644 index 000000000..f12cd9ddf --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/memory_arrays.yml @@ -0,0 +1,42 @@ +title: Memory_arrays Table +description: Data associated with collection of memory devices that operate to form + a memory address. +platform: macos +log_source: osquery +event_code: memory_arrays +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: ' TEXT' + description: Handle, or instance number, associated with the array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: location + type: ' TEXT' + description: Physical location of the memory array + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: use + type: TEXT + description: Function for which the array is used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: max_capacity + type: INTEGER + description: Maximum capacity of array in gigabytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: number_memory_devices + type: INTEGER + description: Number of memory devices on array + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_arrays +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/memory_device_mapped_addresses.yml b/source/data_dictionaries/macos/osquery/events/memory_device_mapped_addresses.yml new file mode 100644 index 000000000..d9fad670d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/memory_device_mapped_addresses.yml @@ -0,0 +1,17 @@ +title: Memory_device_mapped_addresses Table +description: Data associated for address mapping of physical memory devices. +platform: macos +log_source: osquery +event_code: memory_device_mapped_addresses +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: ' TEXT' + description: Handle, or instance number, associated with the structure + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_device_mapped_addresses +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/memory_devices.yml b/source/data_dictionaries/macos/osquery/events/memory_devices.yml new file mode 100644 index 000000000..597049017 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/memory_devices.yml @@ -0,0 +1,135 @@ +title: Memory_devices Table +description: Physical memory device (type 17) information retrieved from SMBIOS. +platform: macos +log_source: osquery +event_code: memory_devices +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: ' TEXT' + description: Handle, or instance number, associated with the structure in SMBIOS + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: array_handle + type: ' TEXT' + description: The memory array that the device is attached to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: form_factor + type: TEXT + description: Implementation form factor for this memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_width + type: INTEGER + description: Total width, in bits, of this memory device, including any check or + error-correction bits + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: data_width + type: INTEGER + description: Data width, in bits, of this memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of memory device in Megabyte + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: set + type: INTEGER + description: Identifies if memory device is one of a set of devices. A value of + 0 indicates no set affiliation. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device_locator + type: TEXT + description: String number of the string that identifies the physically-labeled + socket or board position where the memory device is located + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bank_locator + type: TEXT + description: String number of the string that identifies the physically-labeled + bank where the memory device is located + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_type + type: TEXT + description: Type of memory used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: memory_type_details + type: TEXT + description: Additional details for memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: max_speed + type: INTEGER + description: Max speed of memory device in megatransfers per second (MT/s) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: configured_clock_speed + type: INTEGER + description: Configured speed of memory device in megatransfers per second (MT/s) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: Manufacturer ID string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial_number + type: TEXT + description: Serial number of memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: asset_tag + type: TEXT + description: Manufacturer specific asset tag of memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: part_number + type: TEXT + description: Manufacturer specific serial number of memory device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: min_voltage + type: INTEGER + description: Minimum operating voltage of device in millivolts + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: max_voltage + type: INTEGER + description: Maximum operating voltage of device in millivolts + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: configured_voltage + type: INTEGER + description: Configured operating voltage of device in millivolts + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_devices +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/memory_error_info.yml b/source/data_dictionaries/macos/osquery/events/memory_error_info.yml new file mode 100644 index 000000000..09a434f5d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/memory_error_info.yml @@ -0,0 +1,17 @@ +title: Memory_error_info Table +description: Data associated with errors of a physical memory array. +platform: macos +log_source: osquery +event_code: memory_error_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: ' TEXT' + description: Handle, or instance number, associated with the structure + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#memory_error_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/mounts.yml b/source/data_dictionaries/macos/osquery/events/mounts.yml new file mode 100644 index 000000000..19aedd52c --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/mounts.yml @@ -0,0 +1,77 @@ +title: Mounts Table +description: System mounted devices and filesystems (not process specific). +platform: macos +log_source: osquery +event_code: mounts +event_fields: +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Mounted device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device_alias + type: TEXT + description: Mounted device alias + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Mounted device path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Mounted device type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_size + type: BIGINT + description: Block size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks + type: BIGINT + description: Mounted device used blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_free + type: BIGINT + description: Mounted device free blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blocks_available + type: BIGINT + description: Mounted device available blocks + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inodes + type: BIGINT + description: Mounted device used inodes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inodes_free + type: BIGINT + description: Mounted device free inodes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: TEXT + description: Mounted device flags + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#mounts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/nfs_shares.yml b/source/data_dictionaries/macos/osquery/events/nfs_shares.yml new file mode 100644 index 000000000..6e05234a9 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/nfs_shares.yml @@ -0,0 +1,29 @@ +title: Nfs_shares Table +description: NFS shares exported by the host. +platform: macos +log_source: osquery +event_code: nfs_shares +event_fields: +- standard_name: TBD + standard_type: TBD + name: share + type: TEXT + description: Filesystem path to the share + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: options + type: TEXT + description: Options string set on the export share + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: readonly + type: INTEGER + description: 1 if the share is exported readonly else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#nfs_shares +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/nvram.yml b/source/data_dictionaries/macos/osquery/events/nvram.yml new file mode 100644 index 000000000..a3796f1be --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/nvram.yml @@ -0,0 +1,29 @@ +title: Nvram Table +description: Apple NVRAM variable listing. +platform: macos +log_source: osquery +event_code: nvram +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Variable name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Data type (CFData, CFString, etc) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Raw variable data + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#nvram +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/oem_strings.yml b/source/data_dictionaries/macos/osquery/events/oem_strings.yml new file mode 100644 index 000000000..b4c82a90d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/oem_strings.yml @@ -0,0 +1,29 @@ +title: Oem_strings Table +description: OEM defined strings retrieved from SMBIOS. +platform: macos +log_source: osquery +event_code: oem_strings +event_fields: +- standard_name: TBD + standard_type: TBD + name: handle + type: TEXT + description: Handle, or instance number, associated with the Type 11 structure + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: number + type: INTEGER + description: The string index of the structure + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: The value of the OEM string + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#oem_strings +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/opera_extensions.yml b/source/data_dictionaries/macos/osquery/events/opera_extensions.yml new file mode 100644 index 000000000..c08c3cbf2 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/opera_extensions.yml @@ -0,0 +1,65 @@ +title: Opera_extensions Table +description: Opera browser extensions. +platform: macos +log_source: osquery +event_code: opera_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Extension identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Extension-optional description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: locale + type: TEXT + description: Default locale supported by extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: update_url + type: TEXT + description: Extension-supplied update URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional extension author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to extension folder + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#opera_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/os_version.yml b/source/data_dictionaries/macos/osquery/events/os_version.yml new file mode 100644 index 000000000..6669957db --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/os_version.yml @@ -0,0 +1,71 @@ +title: Os_version Table +description: A single row containing the operating system name and version. +platform: macos +log_source: osquery +event_code: os_version +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Distribution or product name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Pretty, suitable for presentation, OS version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: major + type: INTEGER + description: Major release version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minor + type: INTEGER + description: Minor release version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: patch + type: INTEGER + description: Optional patch release + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build + type: TEXT + description: Optional build-specific or variant string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform + type: TEXT + description: OS Platform or ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_like + type: TEXT + description: Closely related platforms + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: codename + type: TEXT + description: OS version codename + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_date + type: TEXT + description: The install date of the OS. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#os_version +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/osquery_events.yml b/source/data_dictionaries/macos/osquery/events/osquery_events.yml new file mode 100644 index 000000000..eee821438 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/osquery_events.yml @@ -0,0 +1,35 @@ +title: Osquery_events Table +description: Information about the event publishers and subscribers. +platform: macos +log_source: osquery +event_code: osquery_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Event publisher or subscriber name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: publisher + type: TEXT + description: Name of the associated publisher + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Either publisher or subscriber + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: refreshes + type: INTEGER + description: 'Publisher only: number of runloop restarts' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/osquery_extensions.yml b/source/data_dictionaries/macos/osquery/events/osquery_extensions.yml new file mode 100644 index 000000000..9eb05bd04 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/osquery_extensions.yml @@ -0,0 +1,47 @@ +title: Osquery_extensions Table +description: List of active osquery extensions. +platform: macos +log_source: osquery +event_code: osquery_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uuid + type: BIGINT + description: The transient ID assigned for communication + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension's name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension's version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sdk_version + type: TEXT + description: osquery SDK version used to build the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of the extenion's domain socket or library path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: 'SDK extension type: extension or module' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/osquery_flags.yml b/source/data_dictionaries/macos/osquery/events/osquery_flags.yml new file mode 100644 index 000000000..13c278102 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/osquery_flags.yml @@ -0,0 +1,47 @@ +title: Osquery_flags Table +description: Configurable flags that modify osquery's behavior. +platform: macos +log_source: osquery +event_code: osquery_flags +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Flag name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Flag type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Flag description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: default_value + type: TEXT + description: Flag default value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Flag value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shell_only + type: INTEGER + description: Is the flag shell only? + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_flags +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/osquery_info.yml b/source/data_dictionaries/macos/osquery/events/osquery_info.yml new file mode 100644 index 000000000..0b81638b1 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/osquery_info.yml @@ -0,0 +1,83 @@ +title: Osquery_info Table +description: Top level information about the running version of osquery. +platform: macos +log_source: osquery +event_code: osquery_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread/handle) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Unique ID provided by the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: instance_id + type: TEXT + description: Unique, long-lived ID per instance of osquery + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: osquery toolkit version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_hash + type: TEXT + description: Hash of the working configuration state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_valid + type: INTEGER + description: 1 if the config was loaded and considered valid, else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: extensions + type: TEXT + description: osquery extensions status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_platform + type: TEXT + description: osquery toolkit build platform + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_distro + type: TEXT + description: osquery toolkit platform distribution name (os version) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start_time + type: INTEGER + description: UNIX time in seconds when the process started + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: watcher + type: INTEGER + description: Process (or thread/handle) ID of optional watcher process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_mask + type: INTEGER + description: The osquery platform bitmask + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/osquery_packs.yml b/source/data_dictionaries/macos/osquery/events/osquery_packs.yml new file mode 100644 index 000000000..c57593e35 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/osquery_packs.yml @@ -0,0 +1,56 @@ +title: Osquery_packs Table +description: Information about the current query packs that are loaded in osquery. +platform: macos +log_source: osquery +event_code: osquery_packs +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The given name for this query pack + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform + type: TEXT + description: Platforms this query is supported on + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Minimum osquery version that this query will run on + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shard + type: INTEGER + description: Shard restriction limit, 1-100, 0 meaning no restriction + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: discovery_cache_hits + type: INTEGER + description: The number of times that the discovery query used cached values since + the last time the config was reloaded + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: discovery_executions + type: INTEGER + description: The number of times that the discovery queries have been executed since + the last time the config was reloaded + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: Whether this pack is active (the version, platform and discovery queries + match) yes=1, no=0. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_packs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/osquery_registry.yml b/source/data_dictionaries/macos/osquery/events/osquery_registry.yml new file mode 100644 index 000000000..68638fa38 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/osquery_registry.yml @@ -0,0 +1,41 @@ +title: Osquery_registry Table +description: List the osquery registry plugins. +platform: macos +log_source: osquery +event_code: osquery_registry +event_fields: +- standard_name: TBD + standard_type: TBD + name: registry + type: TEXT + description: Name of the osquery registry + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the plugin item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_uuid + type: INTEGER + description: Extension route UUID (0 for core) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: internal + type: INTEGER + description: 1 If the plugin is internal else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: 1 If this plugin is active else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_registry +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/osquery_schedule.yml b/source/data_dictionaries/macos/osquery/events/osquery_schedule.yml new file mode 100644 index 000000000..4e1745c7c --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/osquery_schedule.yml @@ -0,0 +1,53 @@ +title: Osquery_schedule Table +description: Information about the current queries that are scheduled in osquery. +platform: macos +log_source: osquery +event_code: osquery_schedule +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The given name for this query + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: query + type: TEXT + description: The exact query to run + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: executions + type: BIGINT + description: Number of times the query was executed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blacklisted + type: INTEGER + description: 1 if the query is blacklisted else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wall_time + type: BIGINT + description: Total wall time spent executing + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_time + type: BIGINT + description: Total user time spent executing + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_time + type: BIGINT + description: Total system time spent executing + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_schedule +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/package_bom.yml b/source/data_dictionaries/macos/osquery/events/package_bom.yml new file mode 100644 index 000000000..57ed741f0 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/package_bom.yml @@ -0,0 +1,53 @@ +title: Package_bom Table +description: OS X package bill of materials (BOM) file list. +platform: macos +log_source: osquery +event_code: package_bom +event_fields: +- standard_name: TBD + standard_type: TBD + name: filepath + type: TEXT + description: Package file or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: INTEGER + description: Expected user of file or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: INTEGER + description: Expected group of file or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: INTEGER + description: Expected permissions + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Expected file size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: modified_time + type: INTEGER + description: Timestamp the file was installed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of package bom + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#package_bom +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/package_install_history.yml b/source/data_dictionaries/macos/osquery/events/package_install_history.yml new file mode 100644 index 000000000..900b61b5f --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/package_install_history.yml @@ -0,0 +1,47 @@ +title: Package_install_history Table +description: OS X package install history. +platform: macos +log_source: osquery +event_code: package_install_history +event_fields: +- standard_name: TBD + standard_type: TBD + name: package_id + type: TEXT + description: Label packageIdentifiers + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Label date as UNIX timestamp + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package display version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: 'Install source: usually the installer process name' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: content_type + type: TEXT + description: Package content_type (optional) + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#package_install_history +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/package_receipts.yml b/source/data_dictionaries/macos/osquery/events/package_receipts.yml new file mode 100644 index 000000000..f6acc538d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/package_receipts.yml @@ -0,0 +1,53 @@ +title: Package_receipts Table +description: OS X package receipt details. +platform: macos +log_source: osquery +event_code: package_receipts +event_fields: +- standard_name: TBD + standard_type: TBD + name: package_id + type: TEXT + description: Package domain identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: package_filename + type: TEXT + description: Filename of original .pkg file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Installed package version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: location + type: TEXT + description: Optional relative install path on volume + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_time + type: DOUBLE + description: Timestamp of install time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: installer_name + type: TEXT + description: Name of installer process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of receipt plist + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#package_receipts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/pci_devices.yml b/source/data_dictionaries/macos/osquery/events/pci_devices.yml new file mode 100644 index 000000000..4abd761ec --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/pci_devices.yml @@ -0,0 +1,119 @@ +title: Pci_devices Table +description: PCI devices active on the host system. +platform: macos +log_source: osquery +event_code: pci_devices +event_fields: +- standard_name: TBD + standard_type: TBD + name: pci_slot + type: TEXT + description: PCI Device used slot + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_class + type: TEXT + description: PCI Device class + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: PCI Device used driver + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: PCI Device vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor_id + type: TEXT + description: Hex encoded PCI Device vendor identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: PCI Device model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model_id + type: TEXT + description: Hex encoded PCI Device model identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem + type: TEXT + description: PCI Device subsystem + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: express + type: INTEGER + description: 1 If PCI device is express else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: thunderbolt + type: INTEGER + description: 1 If PCI device is thunderbolt else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: removable + type: INTEGER + description: 1 If PCI device is removable else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_class_id + type: TEXT + description: PCI Device class ID in hex format [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_subclass_id + type: TEXT + description: PCI Device subclass in hex format [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_subclass + type: TEXT + description: PCI Device subclass [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem_vendor_id + type: TEXT + description: Vendor ID of PCI device subsystem [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem_vendor + type: TEXT + description: Vendor of PCI device subsystem [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem_model_id + type: TEXT + description: Model ID of PCI device subsystem [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem_model + type: TEXT + description: Device description of PCI device subsystem [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#pci_devices +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/platform_info.yml b/source/data_dictionaries/macos/osquery/events/platform_info.yml new file mode 100644 index 000000000..e0ac044ca --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/platform_info.yml @@ -0,0 +1,59 @@ +title: Platform_info Table +description: Information about EFI/UEFI/ROM and platform/boot. +platform: macos +log_source: osquery +event_code: platform_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: Platform code vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Platform code version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: date + type: TEXT + description: Self-reported platform code update date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: revision + type: TEXT + description: BIOS major and minor revision + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Relative address of firmware mapping + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: TEXT + description: Size in bytes of firmware + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: volume_size + type: INTEGER + description: (Optional) size of firmware volume + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: extra + type: TEXT + description: Platform-specific additional information + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#platform_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/plist.yml b/source/data_dictionaries/macos/osquery/events/plist.yml new file mode 100644 index 000000000..bdc2b82f6 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/plist.yml @@ -0,0 +1,35 @@ +title: Plist Table +description: Read and parse a plist file. +platform: macos +log_source: osquery +event_code: plist +event_fields: +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Preference top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subkey + type: TEXT + description: Intermediate key path, includes lists/dicts + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: String value of most CF types + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: (required) read preferences from a plist + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#plist +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/power_sensors.yml b/source/data_dictionaries/macos/osquery/events/power_sensors.yml new file mode 100644 index 000000000..674390d8f --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/power_sensors.yml @@ -0,0 +1,35 @@ +title: Power_sensors Table +description: Machine power (currents, voltages, wattages, etc) sensors. +platform: macos +log_source: osquery +event_code: power_sensors +event_fields: +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: The SMC key on OS X + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: category + type: TEXT + description: 'The sensor category: currents, voltage, wattage' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of power source + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Power in Watts + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#power_sensors +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/preferences.yml b/source/data_dictionaries/macos/osquery/events/preferences.yml new file mode 100644 index 000000000..3a14a47cf --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/preferences.yml @@ -0,0 +1,47 @@ +title: Preferences Table +description: OS X defaults and managed preferences. +platform: macos +log_source: osquery +event_code: preferences +event_fields: +- standard_name: TBD + standard_type: TBD + name: domain + type: TEXT + description: Application ID usually in com.name.product format + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Preference top-level key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subkey + type: TEXT + description: Intemediate key path, includes lists/dicts + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: String value of most CF types + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: forced + type: INTEGER + description: 1 if the value is forced/managed, else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: (optional) read preferences for a specific user + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#preferences +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/process_envs.yml b/source/data_dictionaries/macos/osquery/events/process_envs.yml new file mode 100644 index 000000000..005a7bf15 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/process_envs.yml @@ -0,0 +1,29 @@ +title: Process_envs Table +description: A key/value table of environment variables for each process. +platform: macos +log_source: osquery +event_code: process_envs +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Environment variable name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Environment variable value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_envs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/process_events.yml b/source/data_dictionaries/macos/osquery/events/process_events.yml new file mode 100644 index 000000000..f339a8e51 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/process_events.yml @@ -0,0 +1,173 @@ +title: Process_events Table +description: Track time/action process executions. +platform: macos +log_source: osquery +event_code: process_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of executed file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: File mode permissions + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline + type: TEXT + description: Command line arguments (argv) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline_size + type: BIGINT + description: Actual size (bytes) of command line arguments + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env + type: TEXT + description: Environment variables delimited by spaces + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env_count + type: BIGINT + description: Number of environment variables + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: env_size + type: BIGINT + description: Actual size (bytes) of environment list + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cwd + type: TEXT + description: The process current working directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: auid + type: BIGINT + description: Audit User ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: BIGINT + description: Effective user ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: BIGINT + description: Effective group ID at process start + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_uid + type: BIGINT + description: File owner user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_gid + type: BIGINT + description: File owner group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: atime + type: BIGINT + description: File last access in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: BIGINT + description: File modification in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ctime + type: BIGINT + description: File last metadata change in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: btime + type: BIGINT + description: File creation in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: overflows + type: TEXT + description: List of structures that overflowed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Process parent's PID, or -1 if cannot be determined. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of execution in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uptime + type: BIGINT + description: Time of execution in system uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: BIGINT + description: 'OpenBSM Attribute: Status of the process [DARWIN]' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: syscall + type: TEXT + description: 'Syscall name: fork, vfork, clone, execve, execveat [LINUX]' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/process_memory_map.yml b/source/data_dictionaries/macos/osquery/events/process_memory_map.yml new file mode 100644 index 000000000..c8ca343b3 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/process_memory_map.yml @@ -0,0 +1,65 @@ +title: Process_memory_map Table +description: Process memory mapped files and pseudo device/regions. +platform: macos +log_source: osquery +event_code: process_memory_map +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start + type: TEXT + description: Virtual start address (hex) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: end + type: TEXT + description: Virtual end address (hex) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: r=read, w=write, x=execute, p=private (cow) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offset + type: BIGINT + description: Offset into mapped path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: MA:MI Major/minor device ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: INTEGER + description: Mapped path inode, 0 means uninitialized (BSS) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to mapped file or mapped type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pseudo + type: INTEGER + description: 1 If path is a pseudo path, else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_memory_map +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/process_open_files.yml b/source/data_dictionaries/macos/osquery/events/process_open_files.yml new file mode 100644 index 000000000..a9a22e7ec --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/process_open_files.yml @@ -0,0 +1,29 @@ +title: Process_open_files Table +description: File descriptors for each process. +platform: macos +log_source: osquery +event_code: process_open_files +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Process-specific file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Filesystem path of descriptor + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_open_files +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/process_open_sockets.yml b/source/data_dictionaries/macos/osquery/events/process_open_sockets.yml new file mode 100644 index 000000000..e3ca6e4de --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/process_open_sockets.yml @@ -0,0 +1,83 @@ +title: Process_open_sockets Table +description: Processes which have open network sockets on the system. +platform: macos +log_source: osquery +event_code: process_open_sockets +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Socket file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: socket + type: BIGINT + description: Socket handle or inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: family + type: INTEGER + description: Network protocol (IPv4, IPv6) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: INTEGER + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_address + type: TEXT + description: Socket local address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_address + type: TEXT + description: Socket remote address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_port + type: INTEGER + description: Socket local port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_port + type: INTEGER + description: Socket remote port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: For UNIX sockets (family=AF_UNIX), the domain path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: 'TCP socket state [lambda: LINUX() or DARWIN() or WINDOWS()]' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: The inode number of the network namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_open_sockets +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/processes.yml b/source/data_dictionaries/macos/osquery/events/processes.yml new file mode 100644 index 000000000..f1acb8902 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/processes.yml @@ -0,0 +1,215 @@ +title: Processes Table +description: All running processes on the host system. +platform: macos +log_source: osquery +event_code: processes +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The process path or shorthand argv[0] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to executed binary + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline + type: TEXT + description: Complete argv + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: Process state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cwd + type: TEXT + description: Process current working directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: root + type: TEXT + description: Process virtual root directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Unsigned user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Unsigned group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: BIGINT + description: Unsigned effective user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: BIGINT + description: Unsigned effective group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: suid + type: BIGINT + description: Unsigned saved user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sgid + type: BIGINT + description: Unsigned saved group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wired_size + type: BIGINT + description: Bytes of unpagable memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resident_size + type: BIGINT + description: Bytes of private memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_size + type: BIGINT + description: Total virtual memory size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_time + type: BIGINT + description: CPU time in milliseconds spent in user space + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_time + type: BIGINT + description: CPU time in milliseconds spent in kernel space + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_bytes_read + type: BIGINT + description: Bytes read from disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_bytes_written + type: BIGINT + description: Bytes written to disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start_time + type: BIGINT + description: Process start time in seconds since Epoch, in case of error -1 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Process parent's PID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pgroup + type: BIGINT + description: Process group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: threads + type: INTEGER + description: Number of threads used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: nice + type: INTEGER + description: Process nice level (-20 to 20, default 0) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_elevated_token + type: INTEGER + description: Process uses elevated token yes=1, no=0 [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: elapsed_time + type: BIGINT + description: Elapsed time in seconds this process has been running. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: handle_count + type: BIGINT + description: Total number of handles that the process has open. This number is the + sum of the handles currently opened by each thread in the process. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: percent_processor_time + type: BIGINT + description: Returns elapsed time that all of the threads of this process used the + processor to execute instructions in 100 nanoseconds ticks. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: upid + type: BIGINT + description: A 64bit pid that is never reused. Returns -1 if we couldn't gather + them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uppid + type: BIGINT + description: The 64bit parent pid that is never reused. Returns -1 if we couldn't + gather them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_type + type: INTEGER + description: A 64bit pid that is never reused. Returns -1 if we couldn't gather + them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_subtype + type: INTEGER + description: The 64bit parent pid that is never reused. Returns -1 if we couldn't + gather them from the system. [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#processes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/prometheus_metrics.yml b/source/data_dictionaries/macos/osquery/events/prometheus_metrics.yml new file mode 100644 index 000000000..cf188fc27 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/prometheus_metrics.yml @@ -0,0 +1,35 @@ +title: Prometheus_metrics Table +description: Retrieve metrics from a Prometheus server. +platform: macos +log_source: osquery +event_code: prometheus_metrics +event_fields: +- standard_name: TBD + standard_type: TBD + name: target_name + type: TEXT + description: Address of prometheus target + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric_name + type: TEXT + description: Name of collected Prometheus metric + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric_value + type: DOUBLE + description: Value of collected Prometheus metric + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timestamp_ms + type: BIGINT + description: Unix timestamp of collected data in MS + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#prometheus_metrics +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/python_packages.yml b/source/data_dictionaries/macos/osquery/events/python_packages.yml new file mode 100644 index 000000000..e53cf7117 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/python_packages.yml @@ -0,0 +1,53 @@ +title: Python_packages Table +description: Python packages installed in a system. +platform: macos +log_source: osquery +event_code: python_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: summary + type: TEXT + description: Package-supplied summary + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional package author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: license + type: TEXT + description: License under which package is launched + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path at which this module resides + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: Directory where Python modules are located + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#python_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/quicklook_cache.yml b/source/data_dictionaries/macos/osquery/events/quicklook_cache.yml new file mode 100644 index 000000000..b2baca303 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/quicklook_cache.yml @@ -0,0 +1,77 @@ +title: Quicklook_cache Table +description: Files and thumbnails within OS X's Quicklook Cache. +platform: macos +log_source: osquery +event_code: quicklook_cache +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rowid + type: INTEGER + description: Quicklook file rowid key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fs_id + type: TEXT + description: Quicklook file fs_id key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: volume_id + type: INTEGER + description: Parsed volume ID from fs_id + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: INTEGER + description: Parsed file ID (inode) from fs_id + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: INTEGER + description: Parsed version date field + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: Parsed version size field + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: Parsed version 'gen' field + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hit_count + type: TEXT + description: Number of cache hits on thumbnail + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: icon_mode + type: BIGINT + description: Thumbnail icon mode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cache_path + type: TEXT + description: Path to cache data + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#quicklook_cache +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/routes.yml b/source/data_dictionaries/macos/osquery/events/routes.yml new file mode 100644 index 000000000..c5847ce59 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/routes.yml @@ -0,0 +1,71 @@ +title: Routes Table +description: The active route table for the host system. +platform: macos +log_source: osquery +event_code: routes +event_fields: +- standard_name: TBD + standard_type: TBD + name: destination + type: TEXT + description: Destination IP address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: netmask + type: INTEGER + description: Netmask length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gateway + type: TEXT + description: Route gateway + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Route source + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: Flags to describe route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Route local interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtu + type: INTEGER + description: Maximum Transmission Unit for the route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric + type: INTEGER + description: Cost of route. Lowest is preferred + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hopcount + type: INTEGER + description: Max hops expected [POSIX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#routes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/running_apps.yml b/source/data_dictionaries/macos/osquery/events/running_apps.yml new file mode 100644 index 000000000..848af8425 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/running_apps.yml @@ -0,0 +1,29 @@ +title: Running_apps Table +description: macOS applications currently running on the host system. +platform: macos +log_source: osquery +event_code: running_apps +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: The pid of the application + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bundle_identifier + type: TEXT + description: The bundle identifier of the application + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_active + type: INTEGER + description: 1 if the application is in focus, 0 otherwise + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#running_apps +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/safari_extensions.yml b/source/data_dictionaries/macos/osquery/events/safari_extensions.yml new file mode 100644 index 000000000..55a792f4f --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/safari_extensions.yml @@ -0,0 +1,71 @@ +title: Safari_extensions Table +description: Safari browser extension details for all users. +platform: macos +log_source: osquery +event_code: safari_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Extension identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension long version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sdk + type: TEXT + description: Bundle SDK used to compile extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: update_url + type: TEXT + description: Extension-supplied update URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional extension author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: developer_id + type: TEXT + description: Optional developer identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Optional extension description text + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to extension XAR bundle + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#safari_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/sandboxes.yml b/source/data_dictionaries/macos/osquery/events/sandboxes.yml new file mode 100644 index 000000000..621829056 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/sandboxes.yml @@ -0,0 +1,47 @@ +title: Sandboxes Table +description: OS X application sandboxes container details. +platform: macos +log_source: osquery +event_code: sandboxes +event_fields: +- standard_name: TBD + standard_type: TBD + name: label + type: TEXT + description: UTI-format bundle or label ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: TEXT + description: Sandbox owner + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: INTEGER + description: Application sandboxings enabled on container + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_id + type: TEXT + description: Sandbox-specific identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bundle_path + type: TEXT + description: Application bundle used by the sandbox + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to sandbox container directory + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#sandboxes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/shared_folders.yml b/source/data_dictionaries/macos/osquery/events/shared_folders.yml new file mode 100644 index 000000000..850d7dfbe --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/shared_folders.yml @@ -0,0 +1,23 @@ +title: Shared_folders Table +description: Folders available to others via SMB or AFP. +platform: macos +log_source: osquery +event_code: shared_folders +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The shared name of the folder as it appears to other users + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Absolute path of shared folder on the local system + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#shared_folders +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/sharing_preferences.yml b/source/data_dictionaries/macos/osquery/events/sharing_preferences.yml new file mode 100644 index 000000000..bc3cc4826 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/sharing_preferences.yml @@ -0,0 +1,71 @@ +title: Sharing_preferences Table +description: OS X Sharing preferences. +platform: macos +log_source: osquery +event_code: sharing_preferences +event_fields: +- standard_name: TBD + standard_type: TBD + name: screen_sharing + type: INTEGER + description: 1 If screen sharing is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: file_sharing + type: INTEGER + description: 1 If file sharing is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: printer_sharing + type: INTEGER + description: 1 If printer sharing is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_login + type: INTEGER + description: 1 If remote login is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_management + type: INTEGER + description: 1 If remote management is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_apple_events + type: INTEGER + description: 1 If remote apple events are enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: internet_sharing + type: INTEGER + description: 1 If internet sharing is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bluetooth_sharing + type: INTEGER + description: 1 If bluetooth sharing is enabled for any user else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disc_sharing + type: INTEGER + description: 1 If CD or DVD sharing is enabled else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: content_caching + type: INTEGER + description: 1 If content caching is enabled else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#sharing_preferences +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/shell_history.yml b/source/data_dictionaries/macos/osquery/events/shell_history.yml new file mode 100644 index 000000000..03a18591d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/shell_history.yml @@ -0,0 +1,35 @@ +title: Shell_history Table +description: A line-delimited (command) table of per-user .*_history data. +platform: macos +log_source: osquery +event_code: shell_history +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Shell history owner + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Entry timestamp. It could be absent, default value is 0. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command + type: TEXT + description: Unparsed date/line/command history line + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: history_file + type: TEXT + description: Path to the .*_history for this user + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#shell_history +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/signature.yml b/source/data_dictionaries/macos/osquery/events/signature.yml new file mode 100644 index 000000000..10a82e5cc --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/signature.yml @@ -0,0 +1,53 @@ +title: Signature Table +description: File (executable, bundle, installer, disk) code signing status. +platform: macos +log_source: osquery +event_code: signature +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Must provide a path or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: arch + type: TEXT + description: If applicable, the arch of the signed code + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: signed + type: INTEGER + description: 1 If the file is signed else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: The signing identifier sealed into the signature + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cdhash + type: TEXT + description: Hash of the application Code Directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: team_identifier + type: TEXT + description: The team signing identifier sealed into the signature + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: authority + type: TEXT + description: Certificate Common Name + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#signature +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/sip_config.yml b/source/data_dictionaries/macos/osquery/events/sip_config.yml new file mode 100644 index 000000000..4067c8a4e --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/sip_config.yml @@ -0,0 +1,29 @@ +title: Sip_config Table +description: Apple's System Integrity Protection (rootless) status. +platform: macos +log_source: osquery +event_code: sip_config +event_fields: +- standard_name: TBD + standard_type: TBD + name: config_flag + type: TEXT + description: The System Integrity Protection config flag + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: INTEGER + description: 1 if this configuration is enabled, otherwise 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled_nvram + type: INTEGER + description: 1 if this configuration is enabled, otherwise 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#sip_config +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/smart_drive_info.yml b/source/data_dictionaries/macos/osquery/events/smart_drive_info.yml new file mode 100644 index 000000000..7d7757e6b --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/smart_drive_info.yml @@ -0,0 +1,119 @@ +title: Smart_drive_info Table +description: Drive information read by SMART controller utilizing autodetect. +platform: macos +log_source: osquery +event_code: smart_drive_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: device_name + type: TEXT + description: Name of block device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model_family + type: TEXT + description: Drive model family + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device_model + type: TEXT + description: Device Model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial_number + type: TEXT + description: Device serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: lu_wwn_device_id + type: TEXT + description: Device Identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: firmware_version + type: TEXT + description: Drive firmware version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_capacity + type: TEXT + description: Bytes of drive capacity + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sector_sizes + type: TEXT + description: Bytes of drive sector sizes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rotation_rate + type: TEXT + description: Drive RPM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: form_factor + type: TEXT + description: Form factor if reported + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ata_version + type: TEXT + description: ATA version of drive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: transport_type + type: TEXT + description: Drive transport type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sata_version + type: TEXT + description: SATA version, if any + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: smart_supported + type: TEXT + description: SMART support status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: smart_enabled + type: TEXT + description: SMART enabled status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: packet_device_type + type: TEXT + description: Packet device type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: power_mode + type: TEXT + description: Device power mode + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: warnings + type: TEXT + description: Warning messages from SMART controller + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#smart_drive_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/smbios_tables.yml b/source/data_dictionaries/macos/osquery/events/smbios_tables.yml new file mode 100644 index 000000000..bcac7110b --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/smbios_tables.yml @@ -0,0 +1,53 @@ +title: Smbios_tables Table +description: BIOS (DMI) structure common details and content. +platform: macos +log_source: osquery +event_code: smbios_tables +event_fields: +- standard_name: TBD + standard_type: TBD + name: number + type: INTEGER + description: Table entry number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: Table entry type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Table entry description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: handle + type: INTEGER + description: Table entry handle + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: header_size + type: INTEGER + description: Header size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Table entry size in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: md5 + type: TEXT + description: MD5 hash of table entry + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#smbios_tables +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/smc_keys.yml b/source/data_dictionaries/macos/osquery/events/smc_keys.yml new file mode 100644 index 000000000..8afac3b16 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/smc_keys.yml @@ -0,0 +1,41 @@ +title: Smc_keys Table +description: Apple's system management controller keys. +platform: macos +log_source: osquery +event_code: smc_keys +event_fields: +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: 4-character key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: SMC-reported type literal type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Reported size of data in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: A type-encoded representation of the key value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hidden + type: INTEGER + description: 1 if this key is normally hidden, otherwise 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#smc_keys +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/ssh_configs.yml b/source/data_dictionaries/macos/osquery/events/ssh_configs.yml new file mode 100644 index 000000000..b771b91c7 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/ssh_configs.yml @@ -0,0 +1,29 @@ +title: Ssh_configs Table +description: A table of parsed ssh_configs. +platform: macos +log_source: osquery +event_code: ssh_configs +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local owner of the ssh_config file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: option + type: TEXT + description: The option and value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssh_config_file + type: TEXT + description: Path to the ssh_config file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ssh_configs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/startup_items.yml b/source/data_dictionaries/macos/osquery/events/startup_items.yml new file mode 100644 index 000000000..4ed58f9a6 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/startup_items.yml @@ -0,0 +1,53 @@ +title: Startup_items Table +description: Applications and binaries set as user/login startup items. +platform: macos +log_source: osquery +event_code: startup_items +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of startup item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of startup item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: args + type: TEXT + description: Arguments provided to startup executable + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Startup Item or Login Item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Directory or plist containing startup item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Startup status; either enabled or disabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: The user associated with the startup item + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#startup_items +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/sudoers.yml b/source/data_dictionaries/macos/osquery/events/sudoers.yml new file mode 100644 index 000000000..d130c8b4d --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/sudoers.yml @@ -0,0 +1,29 @@ +title: Sudoers Table +description: Rules for running commands as other users via sudo. +platform: macos +log_source: osquery +event_code: sudoers +event_fields: +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source file containing the given rule + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: header + type: TEXT + description: Symbol for given rule + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rule_details + type: TEXT + description: Rule definition + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#sudoers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/suid_bin.yml b/source/data_dictionaries/macos/osquery/events/suid_bin.yml new file mode 100644 index 000000000..8a84ab58c --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/suid_bin.yml @@ -0,0 +1,35 @@ +title: Suid_bin Table +description: suid binaries in common locations. +platform: macos +log_source: osquery +event_code: suid_bin +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Binary path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Binary owner username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: groupname + type: TEXT + description: Binary owner group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: Binary permissions + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#suid_bin +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/system_controls.yml b/source/data_dictionaries/macos/osquery/events/system_controls.yml new file mode 100644 index 000000000..4225da8c8 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/system_controls.yml @@ -0,0 +1,53 @@ +title: System_controls Table +description: sysctl names, values, and settings information. +platform: macos +log_source: osquery +event_code: system_controls +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Full sysctl MIB name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: oid + type: TEXT + description: Control MIB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subsystem + type: TEXT + description: Subsystem ID, control type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: current_value + type: TEXT + description: Value of setting + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_value + type: TEXT + description: The MIB value set in /etc/sysctl.conf + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Data type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: field_name + type: TEXT + description: Specific attribute of opaque type [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#system_controls +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/system_info.yml b/source/data_dictionaries/macos/osquery/events/system_info.yml new file mode 100644 index 000000000..0e1f6f911 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/system_info.yml @@ -0,0 +1,101 @@ +title: System_info Table +description: System information for identification. +platform: macos +log_source: osquery +event_code: system_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: hostname + type: TEXT + description: Network hostname including domain + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Unique ID provided by the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_type + type: TEXT + description: CPU type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_subtype + type: TEXT + description: CPU subtype + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_brand + type: TEXT + description: CPU brand string, contains vendor and model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_physical_cores + type: INTEGER + description: Number of physical CPU cores in to the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_logical_cores + type: INTEGER + description: Number of logical CPU cores available to the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_microcode + type: TEXT + description: Microcode version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: physical_memory + type: BIGINT + description: Total physical memory in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_vendor + type: TEXT + description: Hardware or board vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_model + type: TEXT + description: Hardware or board model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_version + type: TEXT + description: Hardware or board version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_serial + type: TEXT + description: Device or board serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: computer_name + type: TEXT + description: Friendly computer name (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_hostname + type: TEXT + description: Local hostname (optional) + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#system_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/temperature_sensors.yml b/source/data_dictionaries/macos/osquery/events/temperature_sensors.yml new file mode 100644 index 000000000..96981560f --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/temperature_sensors.yml @@ -0,0 +1,35 @@ +title: Temperature_sensors Table +description: Machine's temperature sensors. +platform: macos +log_source: osquery +event_code: temperature_sensors +event_fields: +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: The SMC key on OS X + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of temperature source + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: celsius + type: DOUBLE + description: Temperature in Celsius + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fahrenheit + type: DOUBLE + description: Temperature in Fahrenheit + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#temperature_sensors +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/time.yml b/source/data_dictionaries/macos/osquery/events/time.yml new file mode 100644 index 000000000..22054d70a --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/time.yml @@ -0,0 +1,95 @@ +title: Time Table +description: Track current date and time in the system. +platform: macos +log_source: osquery +event_code: time +event_fields: +- standard_name: TBD + standard_type: TBD + name: weekday + type: TEXT + description: Current weekday in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: year + type: INTEGER + description: Current year in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: month + type: INTEGER + description: Current month in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: day + type: INTEGER + description: Current day in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hour + type: INTEGER + description: Current hour in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minutes + type: INTEGER + description: Current minutes in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: seconds + type: INTEGER + description: Current seconds in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timezone + type: TEXT + description: Current timezone in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_time + type: INTEGER + description: Current local UNIX time in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_timezone + type: TEXT + description: Current local timezone in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timestamp + type: TEXT + description: Current timestamp (log format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: datetime + type: TEXT + description: Current date and time (ISO format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: iso_8601 + type: TEXT + description: Current time (ISO format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: win_timestamp + type: BIGINT + description: Timestamp value in 100 nanosecond units. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#time +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/time_machine_backups.yml b/source/data_dictionaries/macos/osquery/events/time_machine_backups.yml new file mode 100644 index 000000000..fb7ed7102 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/time_machine_backups.yml @@ -0,0 +1,23 @@ +title: Time_machine_backups Table +description: Backups to drives using TimeMachine. +platform: macos +log_source: osquery +event_code: time_machine_backups +event_fields: +- standard_name: TBD + standard_type: TBD + name: destination_id + type: TEXT + description: Time Machine destination ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: backup_date + type: INTEGER + description: Backup Date + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#time_machine_backups +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/time_machine_destinations.yml b/source/data_dictionaries/macos/osquery/events/time_machine_destinations.yml new file mode 100644 index 000000000..44bfb51b2 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/time_machine_destinations.yml @@ -0,0 +1,53 @@ +title: Time_machine_destinations Table +description: Locations backed up to using Time Machine. +platform: macos +log_source: osquery +event_code: time_machine_destinations +event_fields: +- standard_name: TBD + standard_type: TBD + name: alias + type: TEXT + description: Human readable name of drive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: destination_id + type: TEXT + description: Time Machine destination ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: consistency_scan_date + type: INTEGER + description: Consistency scan date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: root_volume_uuid + type: TEXT + description: Root UUID of backup volume + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bytes_available + type: INTEGER + description: Bytes available on volume + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bytes_used + type: INTEGER + description: Bytes used on volume + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: encryption + type: TEXT + description: Last known encrypted state + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#time_machine_destinations +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/ulimit_info.yml b/source/data_dictionaries/macos/osquery/events/ulimit_info.yml new file mode 100644 index 000000000..d4326bf25 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/ulimit_info.yml @@ -0,0 +1,29 @@ +title: Ulimit_info Table +description: System resource usage limits. +platform: macos +log_source: osquery +event_code: ulimit_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: System resource to be limited + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: soft_limit + type: TEXT + description: Current limit value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hard_limit + type: TEXT + description: Maximum limit value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ulimit_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/uptime.yml b/source/data_dictionaries/macos/osquery/events/uptime.yml new file mode 100644 index 000000000..60ce0321c --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/uptime.yml @@ -0,0 +1,41 @@ +title: Uptime Table +description: Track time passed since last boot. +platform: macos +log_source: osquery +event_code: uptime +event_fields: +- standard_name: TBD + standard_type: TBD + name: days + type: INTEGER + description: Days of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hours + type: INTEGER + description: Hours of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minutes + type: INTEGER + description: Minutes of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: seconds + type: INTEGER + description: Seconds of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_seconds + type: BIGINT + description: Total uptime seconds + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#uptime +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/usb_devices.yml b/source/data_dictionaries/macos/osquery/events/usb_devices.yml new file mode 100644 index 000000000..2b5189b60 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/usb_devices.yml @@ -0,0 +1,83 @@ +title: Usb_devices Table +description: USB devices that are actively plugged into the host system. +platform: macos +log_source: osquery +event_code: usb_devices +event_fields: +- standard_name: TBD + standard_type: TBD + name: usb_address + type: INTEGER + description: USB Device used address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: usb_port + type: INTEGER + description: USB Device used port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: USB Device vendor string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vendor_id + type: TEXT + description: Hex encoded USB Device vendor identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: USB Device version number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: USB Device model string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model_id + type: TEXT + description: Hex encoded USB Device model identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial + type: TEXT + description: USB Device serial connection + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: USB Device class + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subclass + type: TEXT + description: USB Device subclass + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: TEXT + description: USB Device protocol + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: removable + type: INTEGER + description: 1 If USB device is removable else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#usb_devices +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/user_events.yml b/source/data_dictionaries/macos/osquery/events/user_events.yml new file mode 100644 index 000000000..728dc73d8 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/user_events.yml @@ -0,0 +1,77 @@ +title: User_events Table +description: Track user events from the audit framework. +platform: macos +log_source: osquery +event_code: user_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: auid + type: BIGINT + description: Audit User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: message + type: TEXT + description: Message from the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: The file description for the process socket + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Supplied path from event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: The Internet protocol address or family ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: terminal + type: TEXT + description: The network protocol ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of execution in UNIX time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uptime + type: BIGINT + description: Time of execution in system uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/user_groups.yml b/source/data_dictionaries/macos/osquery/events/user_groups.yml new file mode 100644 index 000000000..4f8ff6046 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/user_groups.yml @@ -0,0 +1,23 @@ +title: User_groups Table +description: Local system user group relationships. +platform: macos +log_source: osquery +event_code: user_groups +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_groups +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/user_interaction_events.yml b/source/data_dictionaries/macos/osquery/events/user_interaction_events.yml new file mode 100644 index 000000000..ef628e298 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/user_interaction_events.yml @@ -0,0 +1,17 @@ +title: User_interaction_events Table +description: Track user interaction events from macOS' event tapping framework. +platform: macos +log_source: osquery +event_code: user_interaction_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_interaction_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/user_ssh_keys.yml b/source/data_dictionaries/macos/osquery/events/user_ssh_keys.yml new file mode 100644 index 000000000..91179bdac --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/user_ssh_keys.yml @@ -0,0 +1,30 @@ +title: User_ssh_keys Table +description: Returns the private keys in the users ~/.ssh directory and whether or + not they are encrypted. +platform: macos +log_source: osquery +event_code: user_ssh_keys +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the key file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to key file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: encrypted + type: INTEGER + description: 1 if key is encrypted, 0 otherwise + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_ssh_keys +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/users.yml b/source/data_dictionaries/macos/osquery/events/users.yml new file mode 100644 index 000000000..db3be6323 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/users.yml @@ -0,0 +1,79 @@ +title: Users Table +description: Local user accounts (including domain accounts that have logged on locally + (Windows)). +platform: macos +log_source: osquery +event_code: users +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID (unsigned) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid_signed + type: BIGINT + description: User ID as int64 signed (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid_signed + type: BIGINT + description: Default group ID as int64 signed (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Optional user description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: User's home directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shell + type: TEXT + description: User's configured default shell + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: User's UUID (Apple) or SID (Windows) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Whether the account is roaming (domain), local, or a system profile + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_hidden + type: INTEGER + description: IsHidden attribute set in OpenDirectory [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#users +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/virtual_memory_info.yml b/source/data_dictionaries/macos/osquery/events/virtual_memory_info.yml new file mode 100644 index 000000000..74686be95 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/virtual_memory_info.yml @@ -0,0 +1,145 @@ +title: Virtual_memory_info Table +description: Darwin Virtual Memory statistics. +platform: macos +log_source: osquery +event_code: virtual_memory_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: free + type: BIGINT + description: Total number of free pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: BIGINT + description: Total number of active pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inactive + type: BIGINT + description: Total number of inactive pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: speculative + type: BIGINT + description: Total number of speculative pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: throttled + type: BIGINT + description: Total number of throttled pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wired + type: BIGINT + description: Total number of wired down pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: purgeable + type: BIGINT + description: Total number of purgeable pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: faults + type: BIGINT + description: Total number of calls to vm_faults. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: copy + type: BIGINT + description: Total number of copy-on-write pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: zero_fill + type: BIGINT + description: Total number of zero filled pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: reactivated + type: BIGINT + description: Total number of reactivated pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: purged + type: BIGINT + description: Total number of purged pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: file_backed + type: BIGINT + description: Total number of file backed pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: anonymous + type: BIGINT + description: Total number of anonymous pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uncompressed + type: BIGINT + description: Total number of uncompressed pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: compressor + type: BIGINT + description: The number of pages used to store compressed VM pages. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: decompressed + type: BIGINT + description: The total number of pages that have been decompressed by the VM compressor. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: compressed + type: BIGINT + description: The total number of pages that have been compressed by the VM compressor. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: page_ins + type: BIGINT + description: The total number of requests for pages from a pager. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: page_outs + type: BIGINT + description: Total number of pages paged out. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: swap_ins + type: BIGINT + description: The total number of compressed pages that have been swapped out to + disk. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: swap_outs + type: BIGINT + description: The total number of compressed pages that have been swapped back in + from disk. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#virtual_memory_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/wifi_networks.yml b/source/data_dictionaries/macos/osquery/events/wifi_networks.yml new file mode 100644 index 000000000..118fba036 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/wifi_networks.yml @@ -0,0 +1,83 @@ +title: Wifi_networks Table +description: OS X known/remembered Wi-Fi networks list. +platform: macos +log_source: osquery +event_code: wifi_networks +event_fields: +- standard_name: TBD + standard_type: TBD + name: ssid + type: TEXT + description: SSID octets of the network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_name + type: TEXT + description: Name of the network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: security_type + type: TEXT + description: Type of security on this network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_connected + type: INTEGER + description: Last time this netword was connected to as a unix_time + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: passpoint + type: INTEGER + description: 1 if Passpoint is supported, 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: possibly_hidden + type: INTEGER + description: 1 if network is possibly a hidden network, 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: roaming + type: INTEGER + description: 1 if roaming is supported, 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: roaming_profile + type: TEXT + description: Describe the roaming profile, usually one of Single, Dual or Multi + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: captive_portal + type: INTEGER + description: 1 if this network has a captive portal, 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: auto_login + type: INTEGER + description: 1 if auto login is enabled, 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: temporarily_disabled + type: INTEGER + description: 1 if this network is temporarily disabled, 0 otherwise + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disabled + type: INTEGER + description: 1 if this network is disabled, 0 otherwise + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#wifi_networks +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/wifi_scan.yml b/source/data_dictionaries/macos/osquery/events/wifi_scan.yml new file mode 100644 index 000000000..6ee4415a9 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/wifi_scan.yml @@ -0,0 +1,71 @@ +title: Wifi_survey Table +description: Scan for nearby WiFi networks. +platform: macos +log_source: osquery +event_code: wifi_scan +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Name of the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssid + type: TEXT + description: SSID octets of the network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bssid + type: TEXT + description: The current basic service set identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_name + type: TEXT + description: Name of the network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: country_code + type: TEXT + description: The country code (ISO/IEC 3166-1:1997) for the network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rssi + type: INTEGER + description: The current received signal strength indication (dbm) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: noise + type: INTEGER + description: The current noise measurement (dBm) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: channel + type: INTEGER + description: Channel number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: channel_width + type: INTEGER + description: Channel width + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: channel_band + type: INTEGER + description: Channel band + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#wifi_survey +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/wifi_status.yml b/source/data_dictionaries/macos/osquery/events/wifi_status.yml new file mode 100644 index 000000000..eee288997 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/wifi_status.yml @@ -0,0 +1,89 @@ +title: Wifi_status Table +description: OS X current WiFi status. +platform: macos +log_source: osquery +event_code: wifi_status +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Name of the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssid + type: TEXT + description: SSID octets of the network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bssid + type: TEXT + description: The current basic service set identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: network_name + type: TEXT + description: Name of the network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: country_code + type: TEXT + description: The country code (ISO/IEC 3166-1:1997) for the network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: security_type + type: TEXT + description: Type of security on this network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: rssi + type: INTEGER + description: The current received signal strength indication (dbm) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: noise + type: INTEGER + description: The current noise measurement (dBm) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: channel + type: INTEGER + description: Channel number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: channel_width + type: INTEGER + description: Channel width + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: channel_band + type: INTEGER + description: Channel band + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: transmit_rate + type: TEXT + description: The current transmit rate + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mode + type: TEXT + description: The current operating mode for the Wi-Fi interface + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#wifi_status +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/xprotect_entries.yml b/source/data_dictionaries/macos/osquery/events/xprotect_entries.yml new file mode 100644 index 000000000..b82a52724 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/xprotect_entries.yml @@ -0,0 +1,53 @@ +title: Xprotect_entries Table +description: Database of the machine's XProtect signatures. +platform: macos +log_source: osquery +event_code: xprotect_entries +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Description of XProtected malware + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: launch_type + type: TEXT + description: Launch services content type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identity + type: TEXT + description: XProtect identity (SHA1) of content + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: filename + type: TEXT + description: Use this file name to match + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: filetype + type: TEXT + description: Use this file type to match + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: optional + type: INTEGER + description: Match any of the identities/patterns for this XProtect name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uses_pattern + type: INTEGER + description: Uses a match pattern instead of identity + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#xprotect_entries +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/xprotect_meta.yml b/source/data_dictionaries/macos/osquery/events/xprotect_meta.yml new file mode 100644 index 000000000..1a039e12e --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/xprotect_meta.yml @@ -0,0 +1,35 @@ +title: Xprotect_meta Table +description: Database of the machine's XProtect browser-related signatures. +platform: macos +log_source: osquery +event_code: xprotect_meta +event_fields: +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Browser plugin or extension identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Either plugin or extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: developer_id + type: TEXT + description: Developer identity (SHA1) of extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: min_version + type: TEXT + description: The minimum allowed plugin version. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#xprotect_meta +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/xprotect_reports.yml b/source/data_dictionaries/macos/osquery/events/xprotect_reports.yml new file mode 100644 index 000000000..e912a57a9 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/xprotect_reports.yml @@ -0,0 +1,29 @@ +title: Xprotect_reports Table +description: Database of XProtect matches (if user generated/sent an XProtect report). +platform: macos +log_source: osquery +event_code: xprotect_reports +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Description of XProtected malware + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_action + type: TEXT + description: Action taken by user after prompted + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: TEXT + description: Quarantine alert time + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#xprotect_reports +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/yara.yml b/source/data_dictionaries/macos/osquery/events/yara.yml new file mode 100644 index 000000000..76dfc5747 --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/yara.yml @@ -0,0 +1,53 @@ +title: Yara Table +description: Track YARA matches for files or PIDs. +platform: macos +log_source: osquery +event_code: yara +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path scanned + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: matches + type: TEXT + description: List of YARA matches + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: count + type: INTEGER + description: Number of YARA matches + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sig_group + type: TEXT + description: Signature group used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sigfile + type: TEXT + description: Signature file used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: strings + type: TEXT + description: Matching strings + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tags + type: TEXT + description: Matching tags + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#yara +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/yara_events.yml b/source/data_dictionaries/macos/osquery/events/yara_events.yml new file mode 100644 index 000000000..11fb73bed --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/yara_events.yml @@ -0,0 +1,71 @@ +title: Yara_events Table +description: Track YARA matches for files specified in configuration data. +platform: macos +log_source: osquery +event_code: yara_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: target_path + type: TEXT + description: The path scanned + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: category + type: TEXT + description: The category of the file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Change action (UPDATE, REMOVE, etc) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: transaction_id + type: BIGINT + description: ID used during bulk update + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: matches + type: TEXT + description: List of YARA matches + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: count + type: INTEGER + description: Number of YARA matches + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: strings + type: TEXT + description: Matching strings + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tags + type: TEXT + description: Matching tags + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of the scan + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#yara_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/macos/osquery/events/yum_sources.yml b/source/data_dictionaries/macos/osquery/events/yum_sources.yml new file mode 100644 index 000000000..27766364f --- /dev/null +++ b/source/data_dictionaries/macos/osquery/events/yum_sources.yml @@ -0,0 +1,41 @@ +title: Yum_sources Table +description: Current list of Yum repositories or software channels. +platform: macos +log_source: osquery +event_code: yum_sources +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Repository name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: baseurl + type: TEXT + description: Repository base URL + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: TEXT + description: Whether the repository is used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gpgcheck + type: TEXT + description: Whether packages are GPG checked + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gpgkey + type: TEXT + description: URL to GPG key + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#yum_sources +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/README.yml b/source/data_dictionaries/windows/osquery/README.yml index 79c009f16..671d85343 100644 --- a/source/data_dictionaries/windows/osquery/README.yml +++ b/source/data_dictionaries/windows/osquery/README.yml @@ -2,7 +2,7 @@ title: Windows Osquery Event Logs description: Osquery schema is defined in tables by osquery engineers. images: [] references: -- text: osquery schema 3.2.4 (website) - link: https://osquery.io/schema/3.2.4 +- text: osquery schema 4.1.2 (website) + link: https://osquery.io/schema/4.1.2 - text: osquery schema linux specs (GitHub) link: https://github.com/facebook/osquery/tree/master/specs/windows diff --git a/source/data_dictionaries/windows/osquery/events/appcompat_shims.yml b/source/data_dictionaries/windows/osquery/events/appcompat_shims.yml new file mode 100644 index 000000000..bb7179c1e --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/appcompat_shims.yml @@ -0,0 +1,51 @@ +title: Appcompat_shims Table +description: Application Compatibility shims are a way to persist malware. This table + presents the AppCompat Shim information from the registry in a nice format. See + http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf for more + details. +platform: windows +log_source: osquery +event_code: appcompat_shims +event_fields: +- standard_name: TBD + standard_type: TBD + name: executable + type: TEXT + description: Name of the executable that is being shimmed. This is pulled from the + registry. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: This is the path to the SDB database. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Description of the SDB. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_time + type: INTEGER + description: Install time of the SDB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of the SDB database. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sdb_id + type: TEXT + description: Unique GUID of the SDB. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#appcompat_shims +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/arp_cache.yml b/source/data_dictionaries/windows/osquery/events/arp_cache.yml new file mode 100644 index 000000000..cc2603bfb --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/arp_cache.yml @@ -0,0 +1,35 @@ +title: Arp_cache Table +description: Address resolution cache, both static and dynamic (from ARP, NDP). +platform: windows +log_source: osquery +event_code: arp_cache +event_fields: +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: IPv4 address target + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac + type: TEXT + description: MAC address of broadcasted address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface of the network for the MAC + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permanent + type: TEXT + description: 1 for true, 0 for false + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#arp_cache +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/authenticode.yml b/source/data_dictionaries/windows/osquery/events/authenticode.yml new file mode 100644 index 000000000..91fa5ac75 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/authenticode.yml @@ -0,0 +1,47 @@ +title: Authenticode Table +description: File (executable, bundle, installer, disk) code signing status. +platform: windows +log_source: osquery +event_code: authenticode +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Must provide a path or directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: original_program_name + type: TEXT + description: The original program name that the publisher has signed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial_number + type: TEXT + description: The certificate serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_name + type: TEXT + description: The certificate issuer name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subject_name + type: TEXT + description: The certificate subject name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: result + type: TEXT + description: The signature check result + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#authenticode +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/autoexec.yml b/source/data_dictionaries/windows/osquery/events/autoexec.yml new file mode 100644 index 000000000..26872db36 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/autoexec.yml @@ -0,0 +1,29 @@ +title: Autoexec Table +description: 'Aggregate of executables that will automatically ' +platform: windows +log_source: osquery +event_code: autoexec +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to the executable + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the program + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source table of the autoexec item + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#autoexec +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/azure_instance_metadata.yml b/source/data_dictionaries/windows/osquery/events/azure_instance_metadata.yml new file mode 100644 index 000000000..7cbbba904 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/azure_instance_metadata.yml @@ -0,0 +1,107 @@ +title: Azure_instance_metadata Table +description: Azure instance metadata. +platform: windows +log_source: osquery +event_code: azure_instance_metadata +event_fields: +- standard_name: TBD + standard_type: TBD + name: location + type: TEXT + description: Azure Region the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offer + type: TEXT + description: Offer information for the VM image (Azure image gallery VMs only) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: publisher + type: TEXT + description: Publisher of the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sku + type: TEXT + description: SKU for the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Version of the VM image + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: os_type + type: TEXT + description: Linux or Windows + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_update_domain + type: TEXT + description: Update domain the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_fault_domain + type: TEXT + description: Fault domain the VM is running in + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_id + type: TEXT + description: Unique identifier for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_size + type: TEXT + description: VM size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subscription_id + type: TEXT + description: Azure subscription for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resource_group_name + type: TEXT + description: Resource group for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: placement_group_id + type: TEXT + description: Placement group for the VM scale set + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vm_scale_set_name + type: TEXT + description: VM scale set name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: zone + type: TEXT + description: Availability zone of the VM + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#azure_instance_metadata +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/azure_instance_tags.yml b/source/data_dictionaries/windows/osquery/events/azure_instance_tags.yml new file mode 100644 index 000000000..9b218f511 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/azure_instance_tags.yml @@ -0,0 +1,29 @@ +title: Azure_instance_tags Table +description: Azure instance tags. +platform: windows +log_source: osquery +event_code: azure_instance_tags +event_fields: +- standard_name: TBD + standard_type: TBD + name: vm_id + type: TEXT + description: Unique identifier for the VM + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: The tag key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: The tag value + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#azure_instance_tags +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/bitlocker_info.yml b/source/data_dictionaries/windows/osquery/events/bitlocker_info.yml new file mode 100644 index 000000000..6c19cc9b5 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/bitlocker_info.yml @@ -0,0 +1,65 @@ +title: Bitlocker_info Table +description: Retrieve bitlocker status of the machine. +platform: windows +log_source: osquery +event_code: bitlocker_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: device_id + type: TEXT + description: ID of the encrypted drive. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: drive_letter + type: TEXT + description: Drive letter of the encrypted drive. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: persistent_volume_id + type: TEXT + description: Persistent ID of the drive. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: conversion_status + type: INTEGER + description: The bitlocker conversion status of the drive. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protection_status + type: INTEGER + description: The bitlocker protection status of the drive. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: encryption_method + type: TEXT + description: The encryption type of the device. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: INTEGER + description: The FVE metadata version of the drive. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: percentage_encrypted + type: INTEGER + description: The percentage of the drive that is encrypted. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: lock_status + type: INTEGER + description: The accessibility status of the drive from Windows. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#bitlocker_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/carbon_black_info.yml b/source/data_dictionaries/windows/osquery/events/carbon_black_info.yml new file mode 100644 index 000000000..797a7b24d --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/carbon_black_info.yml @@ -0,0 +1,138 @@ +title: Carbon_black_info Table +description: Returns info about a Carbon Black sensor install. +platform: windows +log_source: osquery +event_code: carbon_black_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: sensor_id + type: INTEGER + description: Sensor ID of the Carbon Black sensor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_name + type: TEXT + description: Sensor group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_store_files + type: INTEGER + description: If the sensor is configured to send back binaries to the Carbon Black + server + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_module_loads + type: INTEGER + description: If the sensor is configured to capture module loads + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_module_info + type: INTEGER + description: If the sensor is configured to collect metadata of binaries + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_file_mods + type: INTEGER + description: If the sensor is configured to collect file modification events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_reg_mods + type: INTEGER + description: If the sensor is configured to collect registry modification events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_net_conns + type: INTEGER + description: If the sensor is configured to collect network connections + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_processes + type: INTEGER + description: If the sensor is configured to process events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_cross_processes + type: INTEGER + description: If the sensor is configured to cross process events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_emet_events + type: INTEGER + description: If the sensor is configured to EMET events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_data_file_writes + type: INTEGER + description: If the sensor is configured to collect non binary file writes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_process_user_context + type: INTEGER + description: If the sensor is configured to collect the user running a process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collect_sensor_operations + type: INTEGER + description: Unknown + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: log_file_disk_quota_mb + type: INTEGER + description: Event file disk quota in MB + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: log_file_disk_quota_percentage + type: INTEGER + description: Event file disk quota in a percentage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protection_disabled + type: INTEGER + description: If the sensor is configured to report tamper events + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sensor_ip_addr + type: TEXT + description: IP address of the sensor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sensor_backend_server + type: TEXT + description: Carbon Black server + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: event_queue + type: INTEGER + description: Size in bytes of Carbon Black event files on disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: binary_queue + type: INTEGER + description: Size in bytes of binaries waiting to be sent to Carbon Black server + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#carbon_black_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/carves.yml b/source/data_dictionaries/windows/osquery/events/carves.yml new file mode 100644 index 000000000..edfa17062 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/carves.yml @@ -0,0 +1,53 @@ +title: Carves Table +description: Forensic Carves. +platform: windows +log_source: osquery +event_code: carves +event_fields: +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time at which the carve was kicked off + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256 + type: TEXT + description: A SHA256 sum of the carved archive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: INTEGER + description: Size of the carved archive + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: The path of the requested carve + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: carve_guid + type: TEXT + description: Identifying value of the carve session + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: carve + type: INTEGER + description: Set this value to '1' to start a file carve + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#carves +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/certificates.yml b/source/data_dictionaries/windows/osquery/events/certificates.yml new file mode 100644 index 000000000..91285652d --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/certificates.yml @@ -0,0 +1,138 @@ +title: Certificates Table +description: Certificate Authorities installed in Keychains/ca-bundles. +platform: windows +log_source: osquery +event_code: certificates +event_fields: +- standard_name: TBD + standard_type: TBD + name: common_name + type: TEXT + description: Certificate CommonName + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subject + type: TEXT + description: Certificate distinguished name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer + type: TEXT + description: Certificate issuer distinguished name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ca + type: INTEGER + description: '1 if CA: true (certificate is an authority) else 0' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: self_signed + type: INTEGER + description: 1 if self-signed, else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: not_valid_before + type: DATETIME + description: Lower bound of valid date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: not_valid_after + type: DATETIME + description: Certificate expiration data + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: signing_algorithm + type: TEXT + description: Signing algorithm used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_algorithm + type: TEXT + description: Key algorithm used + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_strength + type: TEXT + description: Key size used for RSA/DSA, or curve name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: key_usage + type: TEXT + description: Certificate key usage and extended key usage + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: subject_key_id + type: TEXT + description: SKID an optionally included SHA1 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: authority_key_id + type: TEXT + description: AKID an optionally included SHA1 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1 + type: TEXT + description: SHA1 hash of the raw certificate contents + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to Keychain or PEM bundle + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial + type: TEXT + description: Certificate serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sid + type: TEXT + description: SID [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: store_location + type: TEXT + description: Certificate system store location [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: store + type: TEXT + description: Certificate system store [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Username [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: store_id + type: TEXT + description: Exists for service/user stores. Contains raw store id provided by WinAPI. + [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#certificates +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/chocolatey_packages.yml b/source/data_dictionaries/windows/osquery/events/chocolatey_packages.yml new file mode 100644 index 000000000..bc673f1dc --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/chocolatey_packages.yml @@ -0,0 +1,47 @@ +title: Chocolatey_packages Table +description: Chocolatey packages installed in a system. +platform: windows +log_source: osquery +event_code: chocolatey_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: summary + type: TEXT + description: Package-supplied summary + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional package author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: license + type: TEXT + description: License under which package is launched + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path at which this package resides + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#chocolatey_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/chrome_extensions.yml b/source/data_dictionaries/windows/osquery/events/chrome_extensions.yml new file mode 100644 index 000000000..1edbb66af --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/chrome_extensions.yml @@ -0,0 +1,83 @@ +title: Chrome_extensions Table +description: Chrome browser extensions. +platform: windows +log_source: osquery +event_code: chrome_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: profile + type: TEXT + description: The Chrome profile that contains this extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Extension identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Extension-optional description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: locale + type: TEXT + description: Default locale supported by extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: update_url + type: TEXT + description: Extension-supplied update URI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional extension author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to extension folder + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: The permissions required by the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: optional_permissions + type: TEXT + description: The permissions optionally required by the extensions + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#chrome_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/connectivity.yml b/source/data_dictionaries/windows/osquery/events/connectivity.yml new file mode 100644 index 000000000..d0a97da4f --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/connectivity.yml @@ -0,0 +1,65 @@ +title: Connectivity Table +description: Provides the overall system's network state. +platform: windows +log_source: osquery +event_code: connectivity +event_fields: +- standard_name: TBD + standard_type: TBD + name: disconnected + type: INTEGER + description: True if the all interfaces are not connected to any network + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv4_no_traffic + type: INTEGER + description: True if any interface is connected via IPv4, but has seen no traffic + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_no_traffic + type: INTEGER + description: True if any interface is connected via IPv6, but has seen no traffic + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv4_subnet + type: INTEGER + description: True if any interface is connected to the local subnet via IPv4 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv4_local_network + type: INTEGER + description: True if any interface is connected to a routed network via IPv4 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv4_internet + type: INTEGER + description: True if any interface is connected to the Internet via IPv4 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_subnet + type: INTEGER + description: True if any interface is connected to the local subnet via IPv6 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_local_network + type: INTEGER + description: True if any interface is connected to a routed network via IPv6 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipv6_internet + type: INTEGER + description: True if any interface is connected to the Internet via IPv6 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#connectivity +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/cpu_info.yml b/source/data_dictionaries/windows/osquery/events/cpu_info.yml new file mode 100644 index 000000000..975fd637c --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/cpu_info.yml @@ -0,0 +1,83 @@ +title: Cpu_info Table +description: Retrieve cpu hardware info of the machine. +platform: windows +log_source: osquery +event_code: cpu_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: device_id + type: TEXT + description: The DeviceID of the CPU. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: The model of the CPU. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: The manufacturer of the CPU. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: processor_type + type: TEXT + description: The processor type, such as Central, Math, or Video. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: availability + type: TEXT + description: The availability and status of the CPU. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_status + type: INTEGER + description: The current operating status of the CPU. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: number_of_cores + type: TEXT + description: The number of cores of the CPU. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logical_processors + type: INTEGER + description: The number of logical processors of the CPU. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address_width + type: TEXT + description: The width of the CPU address bus. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: current_clock_speed + type: INTEGER + description: The current frequency of the CPU. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: max_clock_speed + type: INTEGER + description: The maximum possible frequency of the CPU. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: socket_designation + type: TEXT + description: The assigned socket on the board for the given CPU. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#cpu_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/cpuid.yml b/source/data_dictionaries/windows/osquery/events/cpuid.yml new file mode 100644 index 000000000..819a6b447 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/cpuid.yml @@ -0,0 +1,41 @@ +title: Cpuid Table +description: Useful CPU features from the cpuid ASM call. +platform: windows +log_source: osquery +event_code: cpuid +event_fields: +- standard_name: TBD + standard_type: TBD + name: feature + type: TEXT + description: Present feature flags + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Bit value or string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: output_register + type: TEXT + description: Register used to for feature value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: output_bit + type: INTEGER + description: Bit in register value for feature value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: input_eax + type: TEXT + description: Value of EAX used + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#cpuid +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/curl.yml b/source/data_dictionaries/windows/osquery/events/curl.yml new file mode 100644 index 000000000..868f750b5 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/curl.yml @@ -0,0 +1,53 @@ +title: Curl Table +description: Perform an http request and return stats about it. +platform: windows +log_source: osquery +event_code: curl +event_fields: +- standard_name: TBD + standard_type: TBD + name: url + type: TEXT + description: The url for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: method + type: TEXT + description: The HTTP method for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_agent + type: TEXT + description: The user-agent string to use for the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: response_code + type: INTEGER + description: The HTTP status code for the response + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: round_trip_time + type: BIGINT + description: Time taken to complete the request + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bytes + type: BIGINT + description: Number of bytes in the response + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: result + type: TEXT + description: The HTTP response body + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#curl +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/curl_certificate.yml b/source/data_dictionaries/windows/osquery/events/curl_certificate.yml new file mode 100644 index 000000000..039e11606 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/curl_certificate.yml @@ -0,0 +1,83 @@ +title: Curl_certificate Table +description: Inspect TLS certificates by connecting to input hostnames. +platform: windows +log_source: osquery +event_code: curl_certificate +event_fields: +- standard_name: TBD + standard_type: TBD + name: hostname + type: TEXT + description: Hostname (domain[:port]) to CURL + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: common_name + type: TEXT + description: Common name of company issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: organization + type: TEXT + description: Organization issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: organization_unit + type: TEXT + description: Organization unit issued to + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial_number + type: TEXT + description: Certificate serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_common_name + type: TEXT + description: Issuer common name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_organization + type: TEXT + description: Issuer organization + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: issuer_organization_unit + type: TEXT + description: Issuer organization unit + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: valid_from + type: TEXT + description: Period of validity start date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: valid_to + type: TEXT + description: Period of validity end date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha256_fingerprint + type: TEXT + description: SHA-256 fingerprint + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sha1_fingerprint + type: TEXT + description: SHA1 fingerprint + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#curl_certificate +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/default_environment.yml b/source/data_dictionaries/windows/osquery/events/default_environment.yml new file mode 100644 index 000000000..904d3d267 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/default_environment.yml @@ -0,0 +1,29 @@ +title: Default_environment Table +description: Default environment variables and values. +platform: windows +log_source: osquery +event_code: default_environment +event_fields: +- standard_name: TBD + standard_type: TBD + name: variable + type: TEXT + description: Name of the environment variable + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Value of the environment variable + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: expand + type: INTEGER + description: 1 if the variable needs expanding, 0 otherwise + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#default_environment +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/disk_info.yml b/source/data_dictionaries/windows/osquery/events/disk_info.yml new file mode 100644 index 000000000..e8c139bfb --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/disk_info.yml @@ -0,0 +1,77 @@ +title: Disk_info Table +description: Retrieve basic information about the physical disks of a system. +platform: windows +log_source: osquery +event_code: disk_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: partitions + type: INTEGER + description: Number of detected partitions on disk. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_index + type: INTEGER + description: Physical drive number of the disk. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: The interface type of the disk. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: id + type: TEXT + description: The unique identifier of the drive on the system. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pnp_device_id + type: TEXT + description: The unique identifier of the drive on the system. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_size + type: BIGINT + description: Size of the disk. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: The manufacturer of the disk. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_model + type: TEXT + description: Hard drive model. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The label of the disk object. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: serial + type: TEXT + description: The serial number of the disk. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: The OS's description of the disk. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#disk_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/drivers.yml b/source/data_dictionaries/windows/osquery/events/drivers.yml new file mode 100644 index 000000000..b965667f2 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/drivers.yml @@ -0,0 +1,96 @@ +title: Drivers Table +description: Details for in-use Windows device drivers. This does not display installed + but unused drivers. +platform: windows +log_source: osquery +event_code: drivers +event_fields: +- standard_name: TBD + standard_type: TBD + name: device_id + type: TEXT + description: Device ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device_name + type: TEXT + description: Device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: image + type: TEXT + description: Path to driver image file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Driver description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: service + type: TEXT + description: Driver service name, if one exists + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: service_key + type: TEXT + description: Driver service registry key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Driver version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inf + type: TEXT + description: Associated inf file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: Device/driver class name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: provider + type: TEXT + description: Driver provider + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: Device manufacturer + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver_key + type: TEXT + description: Driver key + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: date + type: BIGINT + description: Driver date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: signed + type: INTEGER + description: Whether the driver is signed or not + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#drivers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/etc_hosts.yml b/source/data_dictionaries/windows/osquery/events/etc_hosts.yml new file mode 100644 index 000000000..c95f458a4 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/etc_hosts.yml @@ -0,0 +1,23 @@ +title: Etc_hosts Table +description: Line-parsed /etc/hosts. +platform: windows +log_source: osquery +event_code: etc_hosts +event_fields: +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: IP address mapping + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hostnames + type: TEXT + description: Raw hosts mapping + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_hosts +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/etc_protocols.yml b/source/data_dictionaries/windows/osquery/events/etc_protocols.yml new file mode 100644 index 000000000..9897e67b2 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/etc_protocols.yml @@ -0,0 +1,35 @@ +title: Etc_protocols Table +description: Line-parsed /etc/protocols. +platform: windows +log_source: osquery +event_code: etc_protocols +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Protocol name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: number + type: INTEGER + description: Protocol number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: alias + type: TEXT + description: Protocol alias + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Comment with protocol description + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_protocols +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/etc_services.yml b/source/data_dictionaries/windows/osquery/events/etc_services.yml new file mode 100644 index 000000000..75ef73a2e --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/etc_services.yml @@ -0,0 +1,41 @@ +title: Etc_services Table +description: Line-parsed /etc/services. +platform: windows +log_source: osquery +event_code: etc_services +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Service name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Service port number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: TEXT + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: aliases + type: TEXT + description: Optional space separated list of other names for a service + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Optional comment for a service. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#etc_services +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/example.yml b/source/data_dictionaries/windows/osquery/events/example.yml new file mode 100644 index 000000000..1742cdc5f --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/example.yml @@ -0,0 +1,47 @@ +title: Example Table +description: This is an example table spec. +platform: windows +log_source: osquery +event_code: example +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Description for name column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: points + type: INTEGER + description: This is a signed SQLite int column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: This is a signed SQLite bigint column + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Action performed in generation + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: id + type: INTEGER + description: An index of some sort + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of example + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#example +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/file.yml b/source/data_dictionaries/windows/osquery/events/file.yml index 120e1e73c..602027c5e 100644 --- a/source/data_dictionaries/windows/osquery/events/file.yml +++ b/source/data_dictionaries/windows/osquery/events/file.yml @@ -9,104 +9,123 @@ event_fields: name: path type: TEXT description: Absolute file path - sample_value: '' -- standard_name: file_directory + sample_value: file_directory +- standard_name: TBD standard_type: TBD name: directory type: TEXT description: Directory of file(s) - sample_value: '' + sample_value: TBD - standard_name: file_name standard_type: TBD name: filename type: TEXT description: Name portion of file path - sample_value: '' + sample_value: TBD - standard_name: file_inode standard_type: TBD name: inode type: BIGINT description: Filesystem inode number - sample_value: '' + sample_value: TBD - standard_name: user_uid standard_type: TBD name: uid type: BIGINT description: Owning user ID - sample_value: '' + sample_value: TBD - standard_name: user_gid standard_type: TBD name: gid type: BIGINT description: Owning group ID - sample_value: '' + sample_value: TBD - standard_name: user_permissions standard_type: TBD name: mode type: TEXT description: Permission bits - sample_value: '' + sample_value: TBD - standard_name: device_id standard_type: TBD name: device type: BIGINT description: Device ID (optional) - sample_value: '' + sample_value: TBD - standard_name: file_size standard_type: TBD name: size type: BIGINT description: Size of file in bytes - sample_value: '' -- standard_name: file_block_size + sample_value: TBD +- standard_name: file_system_block_size standard_type: TBD name: block_size type: INTEGER description: Block size of filesystem - sample_value: '' + sample_value: TBD - standard_name: date_last_access standard_type: TBD name: atime type: BIGINT description: Last access time - sample_value: '' + sample_value: TBD - standard_name: date_last_modification standard_type: TBD name: mtime type: BIGINT description: Last modification time - sample_value: '' + sample_value: TBD - standard_name: date_last_status_change standard_type: TBD name: ctime type: BIGINT description: Last status change time - sample_value: '' + sample_value: TBD - standard_name: date_creation_time standard_type: TBD name: btime type: BIGINT description: (B)irth or (cr)eate time - sample_value: '' + sample_value: TBD - standard_name: file_hard_links standard_type: TBD name: hard_links type: INTEGER description: Number of hard links - sample_value: '' + sample_value: TBD - standard_name: file_symlink standard_type: TBD name: symlink type: INTEGER description: 1 if the path is a symlink, otherwise 0 - sample_value: '' + sample_value: TBD - standard_name: file_type standard_type: TBD name: type type: TEXT description: File status - sample_value: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: attributes + type: TEXT + description: 'File attrib string. See: https://ss64.com/nt/attrib.html [WINDOWS]' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: volume_serial + type: TEXT + description: Volume serial number [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: file_id + type: TEXT + description: file ID [WINDOWS] + sample_value: TBD references: -- text: osquery GitHub - link: https://github.com/facebook/osquery/blob/master/specs/utility/file.table -tags: [] +- text: OSQuery table documentation + link: https://osquery.io/schema/current#file +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/firefox_addons.yml b/source/data_dictionaries/windows/osquery/events/firefox_addons.yml new file mode 100644 index 000000000..ca7a3012d --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/firefox_addons.yml @@ -0,0 +1,83 @@ +title: Firefox_addons Table +description: Firefox browser extensions, webapps, and addons. +platform: windows +log_source: osquery +event_code: firefox_addons +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the addon + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Addon display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifier + type: TEXT + description: Addon identifier + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: creator + type: TEXT + description: Addon-supported creator string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Extension, addon, webapp + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Addon-supplied version string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Addon-supplied description string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source_url + type: TEXT + description: URL that installed the addon + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: visible + type: INTEGER + description: 1 If the addon is shown in browser else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: 1 If the addon is active else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: location + type: TEXT + description: Global, profile location + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to plugin bundle + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#firefox_addons +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/groups.yml b/source/data_dictionaries/windows/osquery/events/groups.yml new file mode 100644 index 000000000..047716f25 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/groups.yml @@ -0,0 +1,47 @@ +title: Groups Table +description: Local system groups. +platform: windows +log_source: osquery +event_code: groups +event_fields: +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Unsigned int64 group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid_signed + type: BIGINT + description: A signed int64 version of gid + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: groupname + type: TEXT + description: Canonical local group name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: group_sid + type: TEXT + description: Unique group ID [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: comment + type: TEXT + description: Remarks or comments associated with the group [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_hidden + type: INTEGER + description: IsHidden attribute set in OpenDirectory [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#groups +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/hash.yml b/source/data_dictionaries/windows/osquery/events/hash.yml index 4f067f717..59804ce3c 100644 --- a/source/data_dictionaries/windows/osquery/events/hash.yml +++ b/source/data_dictionaries/windows/osquery/events/hash.yml @@ -9,32 +9,39 @@ event_fields: name: path type: TEXT description: Must provide a path or directory - sample_value: '' + sample_value: TBD - standard_name: file_directory standard_type: TBD name: directory type: TEXT description: Must provide a path or directory - sample_value: '' + sample_value: TBD - standard_name: hash_md5 standard_type: TBD name: md5 type: TEXT description: MD5 hash of provided filesystem data - sample_value: '' + sample_value: TBD - standard_name: hash_sha1 standard_type: TBD name: sha1 type: TEXT description: SHA1 hash of provided filesystem data - sample_value: '' + sample_value: TBD - standard_name: hadh_sha256 standard_type: TBD name: sha256 type: TEXT description: SHA256 hash of provided filesystem data - sample_value: '' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssdeep + type: TEXT + description: ssdeep hash of provided filesystem data [POSIX] + sample_value: TBD references: -- text: osquery GitHub - link: https://github.com/facebook/osquery/blob/master/specs/hash.table -tags: [] +- text: OSQuery table documentation + link: https://osquery.io/schema/current#hash +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/hvci_status.yml b/source/data_dictionaries/windows/osquery/events/hvci_status.yml new file mode 100644 index 000000000..d0aac0c7a --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/hvci_status.yml @@ -0,0 +1,44 @@ +title: Hvci_status Table +description: Retrieve HVCI info of the machine. +platform: windows +log_source: osquery +event_code: hvci_status +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: The version number of the Device Guard build. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: instance_identifier + type: TEXT + description: The instance ID of Device Guard. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: vbs_status + type: TEXT + description: The status of the virtualization based security settings. Returns UNKNOWN + if an error is encountered. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: code_integrity_policy_enforcement_status + type: TEXT + description: The status of the code integrity policy enforcement settings. Returns + UNKNOWN if an error is encountered. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: umci_policy_status + type: TEXT + description: The status of the User Mode Code Integrity security settings. Returns + UNKNOWN if an error is encountered. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#hvci_status +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/ie_extensions.yml b/source/data_dictionaries/windows/osquery/events/ie_extensions.yml index 285477bce..ab161cc92 100644 --- a/source/data_dictionaries/windows/osquery/events/ie_extensions.yml +++ b/source/data_dictionaries/windows/osquery/events/ie_extensions.yml @@ -1,4 +1,4 @@ -title: Pipes Table +title: Ie_extensions Table description: Internet Explorer browser extensions. platform: windows log_source: osquery @@ -9,26 +9,27 @@ event_fields: name: name type: TEXT description: Extension display name - sample_value: '' + sample_value: TBD - standard_name: registry_path standard_type: TBD name: registry_path type: TEXT description: Extension identifier - sample_value: '' + sample_value: TBD - standard_name: file_version standard_type: TBD name: version type: TEXT description: Version of the executable - sample_value: '' + sample_value: TBD - standard_name: process_path standard_type: TBD name: path type: TEXT description: Path to executable - sample_value: '' + sample_value: TBD references: -- text: osquery GitHub - link: https://github.com/facebook/osquery/blob/master/specs/windows/ie_extensions.table -tags: [] +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ie_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/intel_me_info.yml b/source/data_dictionaries/windows/osquery/events/intel_me_info.yml new file mode 100644 index 000000000..78f6847f8 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/intel_me_info.yml @@ -0,0 +1,17 @@ +title: Intel_me_info Table +description: Intel ME/CSE Info. +platform: windows +log_source: osquery +event_code: intel_me_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: ' TEXT' + description: Intel ME version + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#intel_me_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/interface_addresses.yml b/source/data_dictionaries/windows/osquery/events/interface_addresses.yml new file mode 100644 index 000000000..07495821e --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/interface_addresses.yml @@ -0,0 +1,53 @@ +title: Interface_addresses Table +description: Network interfaces and relevant metadata. +platform: windows +log_source: osquery +event_code: interface_addresses +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Specific address for interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mask + type: TEXT + description: Interface netmask + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: broadcast + type: TEXT + description: Broadcast address for the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: point_to_point + type: TEXT + description: PtP address for the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of address. One of dhcp, manual, auto, other, unknown + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: friendly_name + type: TEXT + description: The friendly display name of the interface. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_addresses +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/interface_details.yml b/source/data_dictionaries/windows/osquery/events/interface_details.yml new file mode 100644 index 000000000..214fd29de --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/interface_details.yml @@ -0,0 +1,231 @@ +title: Interface_details Table +description: Detailed information and stats of network interfaces. +platform: windows +log_source: osquery +event_code: interface_details +event_fields: +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Interface name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mac + type: TEXT + description: MAC of interface (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: Interface type (includes virtual) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtu + type: INTEGER + description: Network MTU + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric + type: INTEGER + description: Metric based on the speed of the interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: Flags (netdevice) for the device + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ipackets + type: BIGINT + description: Input packets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: opackets + type: BIGINT + description: Output packets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ibytes + type: BIGINT + description: Input bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: obytes + type: BIGINT + description: Output bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ierrors + type: BIGINT + description: Input errors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: oerrors + type: BIGINT + description: Output errors + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: idrops + type: BIGINT + description: Input drops + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: odrops + type: BIGINT + description: Output drops + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: collisions + type: BIGINT + description: Packet Collisions detected + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_change + type: BIGINT + description: Time of last device modification (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: link_speed + type: BIGINT + description: Interface speed in Mb/s [POSIX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pci_slot + type: TEXT + description: PCI slot number [LINUX] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: friendly_name + type: TEXT + description: The friendly display name of the interface. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Short description of the object a one-line string. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: Name of the network adapter's manufacturer. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: connection_id + type: TEXT + description: Name of the network connection as it appears in the Network Connections + Control Panel program. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: connection_status + type: TEXT + description: State of the network adapter connection to the network. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: INTEGER + description: Indicates whether the adapter is enabled or not. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: physical_adapter + type: INTEGER + description: Indicates whether the adapter is a physical or a logical adapter. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: speed + type: INTEGER + description: Estimate of the current bandwidth in bits per second. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: service + type: TEXT + description: The name of the service the network adapter uses. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_enabled + type: INTEGER + description: If TRUE, the dynamic host configuration protocol (DHCP) server automatically + assigns an IP address to the computer system when establishing a network connection. + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_lease_expires + type: TEXT + description: Expiration date and time for a leased IP address that was assigned + to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_lease_obtained + type: TEXT + description: Date and time the lease was obtained for the IP address assigned to + the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dhcp_server + type: TEXT + description: IP address of the dynamic host configuration protocol (DHCP) server. + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_domain + type: TEXT + description: Organization name followed by a period and an extension that indicates + the type of organization, such as 'microsoft.com'. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_domain_suffix_search_order + type: TEXT + description: Array of DNS domain suffixes to be appended to the end of host names + during name resolution. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_host_name + type: TEXT + description: Host name used to identify the local computer for authentication by + some utilities. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_server_search_order + type: TEXT + description: Array of server IP addresses to be used in querying for DNS servers. + [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#interface_details +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/kernel_info.yml b/source/data_dictionaries/windows/osquery/events/kernel_info.yml new file mode 100644 index 000000000..cb1800cb4 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/kernel_info.yml @@ -0,0 +1,35 @@ +title: Kernel_info Table +description: Basic active kernel information. +platform: windows +log_source: osquery +event_code: kernel_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Kernel version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: arguments + type: TEXT + description: Kernel arguments + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Kernel path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: Kernel device identifier + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#kernel_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/kva_speculative_info.yml b/source/data_dictionaries/windows/osquery/events/kva_speculative_info.yml new file mode 100644 index 000000000..a796759f5 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/kva_speculative_info.yml @@ -0,0 +1,78 @@ +title: Kva_speculative_info Table +description: Display kernel virtual address and speculative execution information + for the system. +platform: windows +log_source: osquery +event_code: kva_speculative_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: kva_shadow_enabled + type: INTEGER + description: Kernel Virtual Address shadowing is enabled. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kva_shadow_user_global + type: INTEGER + description: User pages are marked as global. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kva_shadow_pcid + type: INTEGER + description: Kernel VA PCID flushing optimization is enabled. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: kva_shadow_inv_pcid + type: INTEGER + description: Kernel VA INVPCID is enabled. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bp_mitigations + type: INTEGER + description: Branch Prediction mitigations are enabled. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bp_system_pol_disabled + type: INTEGER + description: Branch Predictions are disabled via system policy. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: bp_microcode_disabled + type: INTEGER + description: Branch Predictions are disabled due to lack of microcode update. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_spec_ctrl_supported + type: INTEGER + description: SPEC_CTRL MSR supported by CPU Microcode. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ibrs_support_enabled + type: INTEGER + description: Windows uses IBRS. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: stibp_support_enabled + type: INTEGER + description: Windows uses STIBP. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_pred_cmd_supported + type: INTEGER + description: PRED_CMD MSR supported by CPU Microcode. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#kva_speculative_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/listening_ports.yml b/source/data_dictionaries/windows/osquery/events/listening_ports.yml new file mode 100644 index 000000000..659104ef3 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/listening_ports.yml @@ -0,0 +1,65 @@ +title: Listening_ports Table +description: Processes with listening (bound) network sockets/ports. +platform: windows +log_source: osquery +event_code: listening_ports +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: port + type: INTEGER + description: Transport layer port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: INTEGER + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: family + type: INTEGER + description: Network protocol (IPv4, IPv6) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Specific address for bind + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Socket file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: socket + type: BIGINT + description: Socket handle or inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path for UNIX domain sockets + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: The inode number of the network namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#listening_ports +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/logged_in_users.yml b/source/data_dictionaries/windows/osquery/events/logged_in_users.yml new file mode 100644 index 000000000..fe257cad4 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/logged_in_users.yml @@ -0,0 +1,59 @@ +title: Logged_in_users Table +description: Users with an active shell on the system. +platform: windows +log_source: osquery +event_code: logged_in_users +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Login type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: TEXT + description: User login name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tty + type: TEXT + description: Device name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: host + type: TEXT + description: Remote hostname + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: INTEGER + description: Time entry was made + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sid + type: TEXT + description: The user's unique security identifier [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: registry_hive + type: TEXT + description: HKEY_USERS registry hive [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#logged_in_users +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/logical_drives.yml b/source/data_dictionaries/windows/osquery/events/logical_drives.yml new file mode 100644 index 000000000..a3956fee0 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/logical_drives.yml @@ -0,0 +1,55 @@ +title: Logical_drives Table +description: Details for logical drives on the system. A logical drive generally represents + a single partition. +platform: windows +log_source: osquery +event_code: logical_drives +event_fields: +- standard_name: TBD + standard_type: TBD + name: device_id + type: TEXT + description: The drive id, usually the drive name, e.g., 'C:'. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Deprecated (always 'Unknown'). + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: The canonical description of the drive, e.g. 'Logical Fixed Disk', + 'CD-ROM Disk'. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: free_space + type: BIGINT + description: The amount of free space, in bytes, of the drive (-1 on failure). + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: BIGINT + description: The total amount of space, in bytes, of the drive (-1 on failure). + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: file_system + type: TEXT + description: The file system of the drive. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: boot_partition + type: INTEGER + description: True if Windows booted from this drive. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#logical_drives +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/logon_sessions.yml b/source/data_dictionaries/windows/osquery/events/logon_sessions.yml new file mode 100644 index 000000000..6822afec5 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/logon_sessions.yml @@ -0,0 +1,104 @@ +title: Logon_sessions Table +description: Windows Logon Session. +platform: windows +log_source: osquery +event_code: logon_sessions +event_fields: +- standard_name: TBD + standard_type: TBD + name: logon_id + type: INTEGER + description: A locally unique identifier (LUID) that identifies a logon session. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user + type: TEXT + description: The account name of the security principal that owns the logon session. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logon_domain + type: TEXT + description: The name of the domain used to authenticate the owner of the logon + session. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: authentication_package + type: TEXT + description: The authentication package used to authenticate the owner of the logon + session. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logon_type + type: TEXT + description: The logon method. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: session_id + type: INTEGER + description: The Terminal Services session identifier. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logon_sid + type: TEXT + description: The user's security identifier (SID). + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logon_time + type: BIGINT + description: The time the session owner logged on. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logon_server + type: TEXT + description: The name of the server used to authenticate the owner of the logon + session. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_domain_name + type: TEXT + description: The DNS name for the owner of the logon session. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: upn + type: TEXT + description: The user principal name (UPN) for the owner of the logon session. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: logon_script + type: TEXT + description: The script used for logging on. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: profile_path + type: TEXT + description: The home directory for the logon session. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: home_directory + type: TEXT + description: The home directory for the logon session. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: home_directory_drive + type: TEXT + description: The drive location of the home directory of the logon session. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#logon_sessions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/ntdomains.yml b/source/data_dictionaries/windows/osquery/events/ntdomains.yml new file mode 100644 index 000000000..dc392ba35 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/ntdomains.yml @@ -0,0 +1,59 @@ +title: Ntdomains Table +description: Display basic NT domain information of a Windows machine. +platform: windows +log_source: osquery +event_code: ntdomains +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The label by which the object is known. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: client_site_name + type: TEXT + description: The name of the site where the domain controller is configured. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dc_site_name + type: TEXT + description: The name of the site where the domain controller is located. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: dns_forest_name + type: TEXT + description: The name of the root of the DNS tree. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: domain_controller_address + type: TEXT + description: The IP Address of the discovered domain controller.. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: domain_controller_name + type: TEXT + description: The name of the discovered domain controller. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: domain_name + type: TEXT + description: The name of the domain. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: The current status of the domain object. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ntdomains +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/ntfs_acl_permissions.yml b/source/data_dictionaries/windows/osquery/events/ntfs_acl_permissions.yml new file mode 100644 index 000000000..3618ca710 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/ntfs_acl_permissions.yml @@ -0,0 +1,41 @@ +title: Ntfs_acl_permissions Table +description: Retrieve NTFS ACL permission information for files and directories. +platform: windows +log_source: osquery +event_code: ntfs_acl_permissions +event_fields: +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to the file or directory. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of access mode for the access control entry. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: principal + type: TEXT + description: User or group to which the ACE applies. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: access + type: TEXT + description: Specific permissions that indicate the rights described by the ACE. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inherited_from + type: TEXT + description: The inheritance policy of the ACE. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ntfs_acl_permissions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/ntfs_journal_events.yml b/source/data_dictionaries/windows/osquery/events/ntfs_journal_events.yml new file mode 100644 index 000000000..d43742b8d --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/ntfs_journal_events.yml @@ -0,0 +1,91 @@ +title: Ntfs_journal_events Table +description: Track time/action changes to files specified in configuration data. +platform: windows +log_source: osquery +event_code: ntfs_journal_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Change action (Write, Delete, etc) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: category + type: TEXT + description: The category that the event originated from + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: old_path + type: TEXT + description: Old path (renames only) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: record_timestamp + type: TEXT + description: Journal record timestamp + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: record_usn + type: TEXT + description: The update sequence number that identifies the journal record + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: node_ref_number + type: TEXT + description: The ordinal that associates a journal record with a filename + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent_ref_number + type: TEXT + description: The ordinal that associates a journal record with a filename's parent + directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: drive_letter + type: TEXT + description: The drive letter identifying the source journal + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: file_attributes + type: TEXT + description: File attributes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: partial + type: BIGINT + description: Set to 1 if either path or old_path only contains the file or folder + name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Time of file event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ntfs_journal_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/os_version.yml b/source/data_dictionaries/windows/osquery/events/os_version.yml new file mode 100644 index 000000000..e76512b34 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/os_version.yml @@ -0,0 +1,71 @@ +title: Os_version Table +description: A single row containing the operating system name and version. +platform: windows +log_source: osquery +event_code: os_version +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Distribution or product name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Pretty, suitable for presentation, OS version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: major + type: INTEGER + description: Major release version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minor + type: INTEGER + description: Minor release version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: patch + type: INTEGER + description: Optional patch release + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build + type: TEXT + description: Optional build-specific or variant string + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform + type: TEXT + description: OS Platform or ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_like + type: TEXT + description: Closely related platforms + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: codename + type: TEXT + description: OS version codename + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_date + type: TEXT + description: The install date of the OS. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#os_version +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/osquery_events.yml b/source/data_dictionaries/windows/osquery/events/osquery_events.yml new file mode 100644 index 000000000..7bab86a72 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/osquery_events.yml @@ -0,0 +1,35 @@ +title: Osquery_events Table +description: Information about the event publishers and subscribers. +platform: windows +log_source: osquery +event_code: osquery_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Event publisher or subscriber name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: publisher + type: TEXT + description: Name of the associated publisher + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Either publisher or subscriber + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: refreshes + type: INTEGER + description: 'Publisher only: number of runloop restarts' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/osquery_extensions.yml b/source/data_dictionaries/windows/osquery/events/osquery_extensions.yml new file mode 100644 index 000000000..3719ed834 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/osquery_extensions.yml @@ -0,0 +1,47 @@ +title: Osquery_extensions Table +description: List of active osquery extensions. +platform: windows +log_source: osquery +event_code: osquery_extensions +event_fields: +- standard_name: TBD + standard_type: TBD + name: uuid + type: BIGINT + description: The transient ID assigned for communication + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Extension's name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Extension's version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sdk_version + type: TEXT + description: osquery SDK version used to build the extension + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of the extenion's domain socket or library path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: 'SDK extension type: extension or module' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_extensions +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/osquery_flags.yml b/source/data_dictionaries/windows/osquery/events/osquery_flags.yml new file mode 100644 index 000000000..6b8f9c9ca --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/osquery_flags.yml @@ -0,0 +1,47 @@ +title: Osquery_flags Table +description: Configurable flags that modify osquery's behavior. +platform: windows +log_source: osquery +event_code: osquery_flags +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Flag name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Flag type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Flag description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: default_value + type: TEXT + description: Flag default value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Flag value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shell_only + type: INTEGER + description: Is the flag shell only? + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_flags +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/osquery_info.yml b/source/data_dictionaries/windows/osquery/events/osquery_info.yml new file mode 100644 index 000000000..9a1d9db45 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/osquery_info.yml @@ -0,0 +1,83 @@ +title: Osquery_info Table +description: Top level information about the running version of osquery. +platform: windows +log_source: osquery +event_code: osquery_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread/handle) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Unique ID provided by the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: instance_id + type: TEXT + description: Unique, long-lived ID per instance of osquery + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: osquery toolkit version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_hash + type: TEXT + description: Hash of the working configuration state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: config_valid + type: INTEGER + description: 1 if the config was loaded and considered valid, else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: extensions + type: TEXT + description: osquery extensions status + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_platform + type: TEXT + description: osquery toolkit build platform + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_distro + type: TEXT + description: osquery toolkit platform distribution name (os version) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start_time + type: INTEGER + description: UNIX time in seconds when the process started + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: watcher + type: INTEGER + description: Process (or thread/handle) ID of optional watcher process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform_mask + type: INTEGER + description: The osquery platform bitmask + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/osquery_packs.yml b/source/data_dictionaries/windows/osquery/events/osquery_packs.yml new file mode 100644 index 000000000..4ce666b86 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/osquery_packs.yml @@ -0,0 +1,56 @@ +title: Osquery_packs Table +description: Information about the current query packs that are loaded in osquery. +platform: windows +log_source: osquery +event_code: osquery_packs +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The given name for this query pack + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: platform + type: TEXT + description: Platforms this query is supported on + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Minimum osquery version that this query will run on + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shard + type: INTEGER + description: Shard restriction limit, 1-100, 0 meaning no restriction + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: discovery_cache_hits + type: INTEGER + description: The number of times that the discovery query used cached values since + the last time the config was reloaded + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: discovery_executions + type: INTEGER + description: The number of times that the discovery queries have been executed since + the last time the config was reloaded + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: Whether this pack is active (the version, platform and discovery queries + match) yes=1, no=0. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_packs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/osquery_registry.yml b/source/data_dictionaries/windows/osquery/events/osquery_registry.yml new file mode 100644 index 000000000..e6e7ca943 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/osquery_registry.yml @@ -0,0 +1,41 @@ +title: Osquery_registry Table +description: List the osquery registry plugins. +platform: windows +log_source: osquery +event_code: osquery_registry +event_fields: +- standard_name: TBD + standard_type: TBD + name: registry + type: TEXT + description: Name of the osquery registry + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the plugin item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: owner_uuid + type: INTEGER + description: Extension route UUID (0 for core) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: internal + type: INTEGER + description: 1 If the plugin is internal else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: active + type: INTEGER + description: 1 If this plugin is active else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_registry +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/osquery_schedule.yml b/source/data_dictionaries/windows/osquery/events/osquery_schedule.yml new file mode 100644 index 000000000..4cb3da8bf --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/osquery_schedule.yml @@ -0,0 +1,53 @@ +title: Osquery_schedule Table +description: Information about the current queries that are scheduled in osquery. +platform: windows +log_source: osquery +event_code: osquery_schedule +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The given name for this query + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: query + type: TEXT + description: The exact query to run + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: executions + type: BIGINT + description: Number of times the query was executed + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: blacklisted + type: INTEGER + description: 1 if the query is blacklisted else 0 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wall_time + type: BIGINT + description: Total wall time spent executing + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_time + type: BIGINT + description: Total user time spent executing + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_time + type: BIGINT + description: Total system time spent executing + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#osquery_schedule +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/patches.yml b/source/data_dictionaries/windows/osquery/events/patches.yml new file mode 100644 index 000000000..565ab3de2 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/patches.yml @@ -0,0 +1,61 @@ +title: Patches Table +description: 'Lists all the patches applied. Note: This does not include patches applied + via MSI or downloaded from Windows Update (e.g. Service Packs).' +platform: windows +log_source: osquery +event_code: patches +event_fields: +- standard_name: TBD + standard_type: TBD + name: csname + type: TEXT + description: The name of the host the patch is installed on. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hotfix_id + type: TEXT + description: The KB ID of the patch. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: caption + type: TEXT + description: Short description of the patch. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Fuller description of the patch. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fix_comments + type: TEXT + description: Additional comments about the patch. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: installed_by + type: TEXT + description: The system context in which the patch as installed. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_date + type: TEXT + description: Indicates when the patch was installed. Lack of a value does not indicate + that the patch was not installed. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: installed_on + type: TEXT + description: The date when the patch was installed. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#patches +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/physical_disk_performance.yml b/source/data_dictionaries/windows/osquery/events/physical_disk_performance.yml new file mode 100644 index 000000000..e3c05396b --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/physical_disk_performance.yml @@ -0,0 +1,90 @@ +title: Physical_disk_performance Table +description: Provides provides raw data from performance counters that monitor hard + or fixed disk drives on the system. +platform: windows +log_source: osquery +event_code: physical_disk_performance +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the physical disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: avg_disk_bytes_per_read + type: BIGINT + description: Average number of bytes transferred from the disk during read operations + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: avg_disk_bytes_per_write + type: BIGINT + description: Average number of bytes transferred to the disk during write operations + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: avg_disk_read_queue_length + type: BIGINT + description: Average number of read requests that were queued for the selected disk + during the sample interval + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: avg_disk_write_queue_length + type: BIGINT + description: Average number of write requests that were queued for the selected + disk during the sample interval + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: avg_disk_sec_per_read + type: INTEGER + description: Average time, in seconds, of a read operation of data from the disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: avg_disk_sec_per_write + type: INTEGER + description: Average time, in seconds, of a write operation of data to the disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: current_disk_queue_length + type: INTEGER + description: Number of requests outstanding on the disk at the time the performance + data is collected + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: percent_disk_read_time + type: BIGINT + description: Percentage of elapsed time that the selected disk drive is busy servicing + read requests + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: percent_disk_write_time + type: BIGINT + description: Percentage of elapsed time that the selected disk drive is busy servicing + write requests + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: percent_disk_time + type: BIGINT + description: Percentage of elapsed time that the selected disk drive is busy servicing + read or write requests + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: percent_idle_time + type: BIGINT + description: Percentage of time during the sample interval that the disk was idle + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#physical_disk_performance +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/pipes.yml b/source/data_dictionaries/windows/osquery/events/pipes.yml index e85d45ca9..aa28790cb 100644 --- a/source/data_dictionaries/windows/osquery/events/pipes.yml +++ b/source/data_dictionaries/windows/osquery/events/pipes.yml @@ -9,33 +9,34 @@ event_fields: name: pid type: BIGINT description: Process ID of the process to which the pipe belongs - sample_value: '' + sample_value: TBD - standard_name: pipe_name standard_type: TBD name: name type: TEXT description: Name of the pipe - sample_value: '' + sample_value: TBD - standard_name: pipe_instances standard_type: TBD name: instances type: INTEGER description: Number of instances of the named pipe - sample_value: '' + sample_value: TBD - standard_name: pipe_max_instances standard_type: TBD name: max_instances type: INTEGER description: The maximum number of instances creatable for this pipe - sample_value: '' + sample_value: TBD - standard_name: pipe_flags standard_type: TBD name: flags type: TEXT description: The flags indicating whether this pipe connection is a server or client end, and if the pipe for sending messages or bytes - sample_value: '' + sample_value: TBD references: -- text: osquery GitHub - link: https://github.com/facebook/osquery/blob/master/specs/windows/pipes.table -tags: [] +- text: OSQuery table documentation + link: https://osquery.io/schema/current#pipes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/platform_info.yml b/source/data_dictionaries/windows/osquery/events/platform_info.yml new file mode 100644 index 000000000..6dce5830e --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/platform_info.yml @@ -0,0 +1,59 @@ +title: Platform_info Table +description: Information about EFI/UEFI/ROM and platform/boot. +platform: windows +log_source: osquery +event_code: platform_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: vendor + type: TEXT + description: Platform code vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Platform code version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: date + type: TEXT + description: Self-reported platform code update date + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: revision + type: TEXT + description: BIOS major and minor revision + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: address + type: TEXT + description: Relative address of firmware mapping + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: size + type: TEXT + description: Size in bytes of firmware + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: volume_size + type: INTEGER + description: (Optional) size of firmware volume + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: extra + type: TEXT + description: Platform-specific additional information + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#platform_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/powershell_events.yml b/source/data_dictionaries/windows/osquery/events/powershell_events.yml new file mode 100644 index 000000000..97d15018c --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/powershell_events.yml @@ -0,0 +1,61 @@ +title: Powershell_events Table +description: Powershell script blocks reconstructed to their full script content, + this table requires script block logging to be enabled. +platform: windows +log_source: osquery +event_code: powershell_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Timestamp the event was received by the osquery event publisher + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: datetime + type: TEXT + description: System time at which the Powershell script event occurred + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: script_block_id + type: TEXT + description: The unique GUID of the powershell script to which this block belongs + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: script_block_count + type: INTEGER + description: The total number of script blocks for this script + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: script_text + type: TEXT + description: The text content of the Powershell script + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: script_name + type: TEXT + description: The name of the Powershell script + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: script_path + type: TEXT + description: The path for the Powershell script + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cosine_similarity + type: DOUBLE + description: How similar the Powershell script is to a provided 'normal' character + frequency + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#powershell_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/process_memory_map.yml b/source/data_dictionaries/windows/osquery/events/process_memory_map.yml new file mode 100644 index 000000000..6d7aa0250 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/process_memory_map.yml @@ -0,0 +1,65 @@ +title: Process_memory_map Table +description: Process memory mapped files and pseudo device/regions. +platform: windows +log_source: osquery +event_code: process_memory_map +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start + type: TEXT + description: Virtual start address (hex) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: end + type: TEXT + description: Virtual end address (hex) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: permissions + type: TEXT + description: r=read, w=write, x=execute, p=private (cow) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: offset + type: BIGINT + description: Offset into mapped path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: device + type: TEXT + description: MA:MI Major/minor device ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: inode + type: INTEGER + description: Mapped path inode, 0 means uninitialized (BSS) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to mapped file or mapped type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pseudo + type: INTEGER + description: 1 If path is a pseudo path, else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_memory_map +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/process_open_sockets.yml b/source/data_dictionaries/windows/osquery/events/process_open_sockets.yml new file mode 100644 index 000000000..d6bad55b6 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/process_open_sockets.yml @@ -0,0 +1,83 @@ +title: Process_open_sockets Table +description: Processes which have open network sockets on the system. +platform: windows +log_source: osquery +event_code: process_open_sockets +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: INTEGER + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: fd + type: BIGINT + description: Socket file descriptor number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: socket + type: BIGINT + description: Socket handle or inode number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: family + type: INTEGER + description: Network protocol (IPv4, IPv6) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: protocol + type: INTEGER + description: Transport protocol (TCP/UDP) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_address + type: TEXT + description: Socket local address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_address + type: TEXT + description: Socket remote address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_port + type: INTEGER + description: Socket local port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remote_port + type: INTEGER + description: Socket remote port + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: For UNIX sockets (family=AF_UNIX), the domain path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: 'TCP socket state [lambda: LINUX() or DARWIN() or WINDOWS()]' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: net_namespace + type: TEXT + description: The inode number of the network namespace [LINUX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#process_open_sockets +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/processes.yml b/source/data_dictionaries/windows/osquery/events/processes.yml new file mode 100644 index 000000000..698548667 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/processes.yml @@ -0,0 +1,215 @@ +title: Processes Table +description: All running processes on the host system. +platform: windows +log_source: osquery +event_code: processes +event_fields: +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process (or thread) ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: The process path or shorthand argv[0] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to executed binary + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cmdline + type: TEXT + description: Complete argv + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: Process state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cwd + type: TEXT + description: Process current working directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: root + type: TEXT + description: Process virtual root directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: Unsigned user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Unsigned group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: euid + type: BIGINT + description: Unsigned effective user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: egid + type: BIGINT + description: Unsigned effective group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: suid + type: BIGINT + description: Unsigned saved user ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: sgid + type: BIGINT + description: Unsigned saved group ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: wired_size + type: BIGINT + description: Bytes of unpagable memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: resident_size + type: BIGINT + description: Bytes of private memory used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_size + type: BIGINT + description: Total virtual memory size + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: user_time + type: BIGINT + description: CPU time in milliseconds spent in user space + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: system_time + type: BIGINT + description: CPU time in milliseconds spent in kernel space + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_bytes_read + type: BIGINT + description: Bytes read from disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: disk_bytes_written + type: BIGINT + description: Bytes written to disk + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: start_time + type: BIGINT + description: Process start time in seconds since Epoch, in case of error -1 + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: parent + type: BIGINT + description: Process parent's PID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pgroup + type: BIGINT + description: Process group + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: threads + type: INTEGER + description: Number of threads used by process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: nice + type: INTEGER + description: Process nice level (-20 to 20, default 0) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_elevated_token + type: INTEGER + description: Process uses elevated token yes=1, no=0 [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: elapsed_time + type: BIGINT + description: Elapsed time in seconds this process has been running. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: handle_count + type: BIGINT + description: Total number of handles that the process has open. This number is the + sum of the handles currently opened by each thread in the process. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: percent_processor_time + type: BIGINT + description: Returns elapsed time that all of the threads of this process used the + processor to execute instructions in 100 nanoseconds ticks. [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: upid + type: BIGINT + description: A 64bit pid that is never reused. Returns -1 if we couldn't gather + them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uppid + type: BIGINT + description: The 64bit parent pid that is never reused. Returns -1 if we couldn't + gather them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_type + type: INTEGER + description: A 64bit pid that is never reused. Returns -1 if we couldn't gather + them from the system. [DARWIN] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_subtype + type: INTEGER + description: The 64bit parent pid that is never reused. Returns -1 if we couldn't + gather them from the system. [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#processes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/programs.yml b/source/data_dictionaries/windows/osquery/events/programs.yml new file mode 100644 index 000000000..94b7b1a9e --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/programs.yml @@ -0,0 +1,69 @@ +title: Programs Table +description: Represents products as they are installed by Windows Installer. A product + generally correlates to one installation package on Windows. Some fields may be + blank as Windows installation details are left to the discretion of the product + author. +platform: windows +log_source: osquery +event_code: programs +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Commonly used product name. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Product version information. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_location + type: TEXT + description: The installation location directory of the product. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_source + type: TEXT + description: The installation source of the product. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: language + type: TEXT + description: The language of the product. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: publisher + type: TEXT + description: Name of the product supplier. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uninstall_string + type: TEXT + description: Path and filename of the uninstaller. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_date + type: TEXT + description: 'Date that this product was installed on the system. ' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: identifying_number + type: TEXT + description: Product identification such as a serial number on software, or a die + number on a hardware chip. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#programs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/python_packages.yml b/source/data_dictionaries/windows/osquery/events/python_packages.yml new file mode 100644 index 000000000..be7ef88d9 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/python_packages.yml @@ -0,0 +1,53 @@ +title: Python_packages Table +description: Python packages installed in a system. +platform: windows +log_source: osquery +event_code: python_packages +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Package display name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: Package-supplied version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: summary + type: TEXT + description: Package-supplied summary + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: author + type: TEXT + description: Optional package author + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: license + type: TEXT + description: License under which package is launched + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path at which this module resides + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: Directory where Python modules are located + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#python_packages +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/registry.yml b/source/data_dictionaries/windows/osquery/events/registry.yml new file mode 100644 index 000000000..52df06170 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/registry.yml @@ -0,0 +1,47 @@ +title: Registry Table +description: All of the Windows registry hives. +platform: windows +log_source: osquery +event_code: registry +event_fields: +- standard_name: TBD + standard_type: TBD + name: key + type: TEXT + description: Name of the key to search for + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Full path to the value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the registry value entry + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of the registry value, or 'subkey' if item is a subkey + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: data + type: TEXT + description: Data content of registry value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtime + type: BIGINT + description: timestamp of the most recent registry write + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#registry +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/routes.yml b/source/data_dictionaries/windows/osquery/events/routes.yml new file mode 100644 index 000000000..9c09be740 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/routes.yml @@ -0,0 +1,71 @@ +title: Routes Table +description: The active route table for the host system. +platform: windows +log_source: osquery +event_code: routes +event_fields: +- standard_name: TBD + standard_type: TBD + name: destination + type: TEXT + description: Destination IP address + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: netmask + type: INTEGER + description: Netmask length + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gateway + type: TEXT + description: Route gateway + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Route source + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: flags + type: INTEGER + description: Flags to describe route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: interface + type: TEXT + description: Route local interface + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: mtu + type: INTEGER + description: Maximum Transmission Unit for the route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: metric + type: INTEGER + description: Cost of route. Lowest is preferred + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of route + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hopcount + type: INTEGER + description: Max hops expected [POSIX] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#routes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/scheduled_tasks.yml b/source/data_dictionaries/windows/osquery/events/scheduled_tasks.yml new file mode 100644 index 000000000..b8865e1b1 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/scheduled_tasks.yml @@ -0,0 +1,71 @@ +title: Scheduled_tasks Table +description: Lists all of the tasks in the Windows task scheduler. +platform: windows +log_source: osquery +event_code: scheduled_tasks +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the scheduled task + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: action + type: TEXT + description: Actions executed by the scheduled task + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to the executable to be run + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: enabled + type: INTEGER + description: Whether or not the scheduled task is enabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: State of the scheduled task + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hidden + type: INTEGER + description: Whether or not the task is visible in the UI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_run_time + type: INTEGER + description: Timestamp the task last ran + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: next_run_time + type: INTEGER + description: Timestamp the task is scheduled to run next + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_run_message + type: TEXT + description: Exit status message of the last task run + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: last_run_code + type: TEXT + description: Exit status code of the last task run + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#scheduled_tasks +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/services.yml b/source/data_dictionaries/windows/osquery/events/services.yml index 868b050c8..85a8e30fb 100644 --- a/source/data_dictionaries/windows/osquery/events/services.yml +++ b/source/data_dictionaries/windows/osquery/events/services.yml @@ -1,5 +1,5 @@ title: Services Table -description: List all installed Windows services and their relevant data. +description: Lists all installed Windows services and their relevant data. platform: windows log_source: osquery event_code: services @@ -9,81 +9,82 @@ event_fields: name: name type: TEXT description: Service name - sample_value: '' + sample_value: TBD - standard_name: service_type standard_type: TBD name: service_type type: TEXT description: 'Service Type: OWN_PROCESS, SHARE_PROCESS and maybe Interactive (can interact with the desktop)' - sample_value: '' + sample_value: TBD - standard_name: service_display_name standard_type: TBD name: display_name type: TEXT description: Service Display name - sample_value: '' + sample_value: TBD - standard_name: service_status standard_type: TBD name: status type: TEXT description: 'Service Current status: STOPPED, START_PENDING, STOP_PENDING, RUNNING, CONTINUE_PENDING, PAUSE_PENDING, PAUSED' - sample_value: '' + sample_value: TBD - standard_name: process_id standard_type: TBD name: pid type: INTEGER description: the Process ID of the service - sample_value: '' + sample_value: TBD - standard_name: service_start_type standard_type: TBD name: start_type type: TEXT description: 'Service start type: BOOT_START, SYSTEM_START, AUTO_START, DEMAND_START, DISABLED' - sample_value: '' + sample_value: TBD - standard_name: service_error_code standard_type: TBD name: win32_exit_code type: INTEGER description: The error code that the service uses to report an error that occurs when it is starting or stopping - sample_value: '' + sample_value: TBD - standard_name: service_exit_code standard_type: TBD name: service_exit_code type: INTEGER description: The service-specific error code that the service returns when an error occurs while the service is starting or stopping - sample_value: '' + sample_value: TBD - standard_name: file_path standard_type: TBD name: path type: TEXT description: Path to Service Executable - sample_value: '' + sample_value: TBD - standard_name: module_path standard_type: TBD name: module_path type: TEXT description: Path to ServiceDll - sample_value: '' + sample_value: TBD - standard_name: service_description standard_type: TBD name: description type: TEXT description: Service Description - sample_value: '' + sample_value: TBD - standard_name: user_name standard_type: TBD name: user_account type: TEXT description: The name of the account that the service process will be logged on - as when it runs. This name can be of the form Domain\UserName. If the account - belongs to the built-in domain, the name can be of the form .\UserName. - sample_value: '' + as when it runs. This name can be of the form Domain\\UserName. If the account + belongs to the built-in domain, the name can be of the form .\\UserName. + sample_value: TBD references: -- text: osquery GitHub - link: https://github.com/facebook/osquery/blob/master/specs/windows/services.table -tags: [] +- text: OSQuery table documentation + link: https://osquery.io/schema/current#services +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/shared_resources.yml b/source/data_dictionaries/windows/osquery/events/shared_resources.yml new file mode 100644 index 000000000..3ec03eb85 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/shared_resources.yml @@ -0,0 +1,65 @@ +title: Shared_resources Table +description: Displays shared resources on a computer system running Windows. This + may be a disk drive, printer, interprocess communication, or other sharable device. +platform: windows +log_source: osquery +event_code: shared_resources +event_fields: +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: A textual description of the object + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: install_date + type: TEXT + description: Indicates when the object was installed. Lack of a value does not indicate + that the object is not installed. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: String that indicates the current status of the object. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: allow_maximum + type: INTEGER + description: Number of concurrent users for this resource has been limited. If True, + the value in the MaximumAllowed property is ignored. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: maximum_allowed + type: INTEGER + description: Limit on the maximum number of users allowed to use this resource concurrently. + The value is only valid if the AllowMaximum property is set to FALSE. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Alias given to a path set up as a share on a computer system running + Windows. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Local path of the Windows share. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: INTEGER + description: 'Type of resource being shared. Types include: disk drives, print queues, + interprocess communications (IPC), and general devices.' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#shared_resources +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/ssh_configs.yml b/source/data_dictionaries/windows/osquery/events/ssh_configs.yml new file mode 100644 index 000000000..a74b677ee --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/ssh_configs.yml @@ -0,0 +1,29 @@ +title: Ssh_configs Table +description: A table of parsed ssh_configs. +platform: windows +log_source: osquery +event_code: ssh_configs +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local owner of the ssh_config file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: option + type: TEXT + description: The option and value + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: ssh_config_file + type: TEXT + description: Path to the ssh_config file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#ssh_configs +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/startup_items.yml b/source/data_dictionaries/windows/osquery/events/startup_items.yml new file mode 100644 index 000000000..c24703d5b --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/startup_items.yml @@ -0,0 +1,53 @@ +title: Startup_items Table +description: Applications and binaries set as user/login startup items. +platform: windows +log_source: osquery +event_code: startup_items +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of startup item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of startup item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: args + type: TEXT + description: Arguments provided to startup executable + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Startup Item or Login Item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Directory or plist containing startup item + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: status + type: TEXT + description: Startup status; either enabled or disabled + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: The user associated with the startup item + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#startup_items +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/system_info.yml b/source/data_dictionaries/windows/osquery/events/system_info.yml new file mode 100644 index 000000000..51ad430fc --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/system_info.yml @@ -0,0 +1,101 @@ +title: System_info Table +description: System information for identification. +platform: windows +log_source: osquery +event_code: system_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: hostname + type: TEXT + description: Network hostname including domain + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: Unique ID provided by the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_type + type: TEXT + description: CPU type + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_subtype + type: TEXT + description: CPU subtype + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_brand + type: TEXT + description: CPU brand string, contains vendor and model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_physical_cores + type: INTEGER + description: Number of physical CPU cores in to the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_logical_cores + type: INTEGER + description: Number of logical CPU cores available to the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: cpu_microcode + type: TEXT + description: Microcode version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: physical_memory + type: BIGINT + description: Total physical memory in bytes + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_vendor + type: TEXT + description: Hardware or board vendor + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_model + type: TEXT + description: Hardware or board model + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_version + type: TEXT + description: Hardware or board version + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hardware_serial + type: TEXT + description: Device or board serial number + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: computer_name + type: TEXT + description: Friendly computer name (optional) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_hostname + type: TEXT + description: Local hostname (optional) + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#system_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/time.yml b/source/data_dictionaries/windows/osquery/events/time.yml new file mode 100644 index 000000000..6296dbb86 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/time.yml @@ -0,0 +1,95 @@ +title: Time Table +description: Track current date and time in the system. +platform: windows +log_source: osquery +event_code: time +event_fields: +- standard_name: TBD + standard_type: TBD + name: weekday + type: TEXT + description: Current weekday in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: year + type: INTEGER + description: Current year in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: month + type: INTEGER + description: Current month in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: day + type: INTEGER + description: Current day in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hour + type: INTEGER + description: Current hour in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minutes + type: INTEGER + description: Current minutes in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: seconds + type: INTEGER + description: Current seconds in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timezone + type: TEXT + description: Current timezone in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_time + type: INTEGER + description: Current local UNIX time in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: local_timezone + type: TEXT + description: Current local timezone in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: timestamp + type: TEXT + description: Current timestamp (log format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: datetime + type: TEXT + description: Current date and time (ISO format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: iso_8601 + type: TEXT + description: Current time (ISO format) in the system + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: win_timestamp + type: BIGINT + description: Timestamp value in 100 nanosecond units. [WINDOWS] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#time +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/uptime.yml b/source/data_dictionaries/windows/osquery/events/uptime.yml new file mode 100644 index 000000000..16c067bd7 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/uptime.yml @@ -0,0 +1,41 @@ +title: Uptime Table +description: Track time passed since last boot. +platform: windows +log_source: osquery +event_code: uptime +event_fields: +- standard_name: TBD + standard_type: TBD + name: days + type: INTEGER + description: Days of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: hours + type: INTEGER + description: Hours of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minutes + type: INTEGER + description: Minutes of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: seconds + type: INTEGER + description: Seconds of uptime + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: total_seconds + type: BIGINT + description: Total uptime seconds + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#uptime +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/user_groups.yml b/source/data_dictionaries/windows/osquery/events/user_groups.yml new file mode 100644 index 000000000..62e615391 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/user_groups.yml @@ -0,0 +1,23 @@ +title: User_groups Table +description: Local system user group relationships. +platform: windows +log_source: osquery +event_code: user_groups +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_groups +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/user_ssh_keys.yml b/source/data_dictionaries/windows/osquery/events/user_ssh_keys.yml new file mode 100644 index 000000000..43b4fb016 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/user_ssh_keys.yml @@ -0,0 +1,30 @@ +title: User_ssh_keys Table +description: Returns the private keys in the users ~/.ssh directory and whether or + not they are encrypted. +platform: windows +log_source: osquery +event_code: user_ssh_keys +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: The local user that owns the key file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path to key file + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: encrypted + type: INTEGER + description: 1 if key is encrypted, 0 otherwise + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#user_ssh_keys +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/users.yml b/source/data_dictionaries/windows/osquery/events/users.yml new file mode 100644 index 000000000..aa8b0723c --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/users.yml @@ -0,0 +1,79 @@ +title: Users Table +description: Local user accounts (including domain accounts that have logged on locally + (Windows)). +platform: windows +log_source: osquery +event_code: users +event_fields: +- standard_name: TBD + standard_type: TBD + name: uid + type: BIGINT + description: User ID + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid + type: BIGINT + description: Group ID (unsigned) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uid_signed + type: BIGINT + description: User ID as int64 signed (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: gid_signed + type: BIGINT + description: Default group ID as int64 signed (Apple) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Username + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: description + type: TEXT + description: Optional user description + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: directory + type: TEXT + description: User's home directory + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: shell + type: TEXT + description: User's configured default shell + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: uuid + type: TEXT + description: User's UUID (Apple) or SID (Windows) + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Whether the account is roaming (domain), local, or a system profile + [WINDOWS] + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: is_hidden + type: INTEGER + description: IsHidden attribute set in OpenDirectory [DARWIN] + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#users +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/video_info.yml b/source/data_dictionaries/windows/osquery/events/video_info.yml new file mode 100644 index 000000000..47dda2c25 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/video_info.yml @@ -0,0 +1,59 @@ +title: Video_info Table +description: Retrieve video card information of the machine. +platform: windows +log_source: osquery +event_code: video_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: color_depth + type: INTEGER + description: The amount of bits per pixel to represent color. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver + type: TEXT + description: The driver of the device. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver_date + type: TEXT + description: The date listed on the installed driver. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: driver_version + type: TEXT + description: The version of the installed driver. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: manufacturer + type: TEXT + description: The manufaturer of the gpu. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: model + type: TEXT + description: The model of the gpu. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: series + type: TEXT + description: The series of the gpu. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: video_mode + type: TEXT + description: The current resolution of the display. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#video_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/winbaseobj.yml b/source/data_dictionaries/windows/osquery/events/winbaseobj.yml new file mode 100644 index 000000000..96c857877 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/winbaseobj.yml @@ -0,0 +1,30 @@ +title: Winbaseobj Table +description: Lists named Windows objects in the default object directories, across + all terminal services sessions. +platform: windows +log_source: osquery +event_code: winbaseobj +event_fields: +- standard_name: TBD + standard_type: TBD + name: session_id + type: INTEGER + description: Terminal Services Session Id + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: object_name + type: TEXT + description: Object Name + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: object_type + type: TEXT + description: Object Type + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#winbaseobj +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/windows_crashes.yml b/source/data_dictionaries/windows/osquery/events/windows_crashes.yml new file mode 100644 index 000000000..c8e83e3d3 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/windows_crashes.yml @@ -0,0 +1,137 @@ +title: Windows_crashes Table +description: Extracted information from Windows crash logs (Minidumps). +platform: windows +log_source: osquery +event_code: windows_crashes +event_fields: +- standard_name: TBD + standard_type: TBD + name: datetime + type: TEXT + description: Timestamp (log format) of the crash + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: module + type: TEXT + description: Path of the crashed module within the process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: path + type: TEXT + description: Path of the executable file for the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: pid + type: BIGINT + description: Process ID of the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: tid + type: BIGINT + description: Thread ID of the crashed thread + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: version + type: TEXT + description: File version info of the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: process_uptime + type: BIGINT + description: Uptime of the process in seconds + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: stack_trace + type: TEXT + description: Multiple stack frames from the stack trace + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: exception_code + type: TEXT + description: The Windows exception code + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: exception_message + type: TEXT + description: The NTSTATUS error message associated with the exception code + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: exception_address + type: TEXT + description: Address (in hex) where the exception occurred + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: registers + type: TEXT + description: The values of the system registers + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command_line + type: TEXT + description: Command-line string passed to the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: current_directory + type: TEXT + description: Current working directory of the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: username + type: TEXT + description: Username of the user who ran the crashed process + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: machine_name + type: TEXT + description: Name of the machine where the crash happened + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: major_version + type: INTEGER + description: Windows major version of the machine + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: minor_version + type: INTEGER + description: Windows minor version of the machine + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: build_number + type: INTEGER + description: Windows build number of the crashing machine + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of crash log + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: crash_path + type: TEXT + description: Path of the log file + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#windows_crashes +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/windows_events.yml b/source/data_dictionaries/windows/osquery/events/windows_events.yml new file mode 100644 index 000000000..12bb973ba --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/windows_events.yml @@ -0,0 +1,77 @@ +title: Windows_events Table +description: Windows Event logs. +platform: windows +log_source: osquery +event_code: windows_events +event_fields: +- standard_name: TBD + standard_type: TBD + name: time + type: BIGINT + description: Timestamp the event was received + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: datetime + type: TEXT + description: System time at which the event occurred + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: source + type: TEXT + description: Source or channel of the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: provider_name + type: TEXT + description: Provider name of the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: provider_guid + type: TEXT + description: Provider guid of the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eventid + type: INTEGER + description: Event ID of the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: task + type: INTEGER + description: Task value associated with the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: level + type: INTEGER + description: The severity level associated with the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: keywords + type: BIGINT + description: A bitmask of the keywords defined in the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: data + type: TEXT + description: Data associated with the event + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: eid + type: TEXT + description: Event ID + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#windows_events +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/windows_optional_features.yml b/source/data_dictionaries/windows/osquery/events/windows_optional_features.yml new file mode 100644 index 000000000..e7022fa9c --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/windows_optional_features.yml @@ -0,0 +1,36 @@ +title: Windows_optional_features Table +description: Lists names and installation states of windows features. Maps to Win32_OptionalFeature + WMI class. +platform: windows +log_source: osquery +event_code: windows_optional_features +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the feature + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: caption + type: TEXT + description: Caption of feature in settings UI + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: INTEGER + description: Installation state value. 1 == Enabled, 2 == Disabled, 3 == Absent + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: statename + type: TEXT + description: Installation state name. 'Enabled','Disabled','Absent' + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#windows_optional_features +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/windows_security_products.yml b/source/data_dictionaries/windows/osquery/events/windows_security_products.yml new file mode 100644 index 000000000..5dd187147 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/windows_security_products.yml @@ -0,0 +1,47 @@ +title: Windows_security_products Table +description: Enumeration of registered Windows security products. +platform: windows +log_source: osquery +event_code: windows_security_products +event_fields: +- standard_name: TBD + standard_type: TBD + name: type + type: TEXT + description: Type of security product + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of product + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state + type: TEXT + description: State of protection + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: state_timestamp + type: TEXT + description: Timestamp for the product state + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: remediation_path + type: TEXT + description: Remediation path + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: signatures_up_to_date + type: INTEGER + description: 1 if product signatures are up to date, else 0 + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#windows_security_products +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/wmi_bios_info.yml b/source/data_dictionaries/windows/osquery/events/wmi_bios_info.yml new file mode 100644 index 000000000..2514ee618 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/wmi_bios_info.yml @@ -0,0 +1,23 @@ +title: Wmi_bios_info Table +description: Lists important information from the system bios. +platform: windows +log_source: osquery +event_code: wmi_bios_info +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Name of the Bios setting + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: value + type: TEXT + description: Value of the Bios setting + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#wmi_bios_info +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/wmi_cli_event_consumers.yml b/source/data_dictionaries/windows/osquery/events/wmi_cli_event_consumers.yml new file mode 100644 index 000000000..db8414089 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/wmi_cli_event_consumers.yml @@ -0,0 +1,47 @@ +title: Wmi_cli_event_consumers Table +description: WMI CommandLineEventConsumer, which can be used for persistence on Windows. + See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf + for more details. +platform: windows +log_source: osquery +event_code: wmi_cli_event_consumers +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Unique name of a consumer. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: command_line_template + type: TEXT + description: Standard string template that specifies the process to be started. + This property can be NULL, and the ExecutablePath property is used as the command + line. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: executable_path + type: TEXT + description: Module to execute. The string can specify the full path and file name + of the module to execute, or it can specify a partial name. If a partial name + is specified, the current drive and current directory are assumed. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: The name of the class. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: relative_path + type: TEXT + description: Relative path to the class or instance. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#wmi_cli_event_consumers +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/wmi_event_filters.yml b/source/data_dictionaries/windows/osquery/events/wmi_event_filters.yml new file mode 100644 index 000000000..a398bfda9 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/wmi_event_filters.yml @@ -0,0 +1,43 @@ +title: Wmi_event_filters Table +description: Lists WMI event filters. +platform: windows +log_source: osquery +event_code: wmi_event_filters +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: Unique identifier of an event filter. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: query + type: TEXT + description: Windows Management Instrumentation Query Language (WQL) event query + that specifies the set of events for consumer notification, and the specific conditions + for notification. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: query_language + type: TEXT + description: Query language that the query is written in. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: The name of the class. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: relative_path + type: TEXT + description: Relative path to the class or instance. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#wmi_event_filters +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/wmi_filter_consumer_binding.yml b/source/data_dictionaries/windows/osquery/events/wmi_filter_consumer_binding.yml new file mode 100644 index 000000000..01435e02b --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/wmi_filter_consumer_binding.yml @@ -0,0 +1,38 @@ +title: Wmi_filter_consumer_binding Table +description: Lists the relationship between event consumers and filters. +platform: windows +log_source: osquery +event_code: wmi_filter_consumer_binding +event_fields: +- standard_name: TBD + standard_type: TBD + name: consumer + type: TEXT + description: Reference to an instance of __EventConsumer that represents the object + path to a logical consumer, the recipient of an event. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: filter + type: TEXT + description: Reference to an instance of __EventFilter that represents the object + path to an event filter which is a query that specifies the type of event to be + received. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: The name of the class. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: relative_path + type: TEXT + description: Relative path to the class or instance. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#wmi_filter_consumer_binding +tags: +- version_4.4.2 diff --git a/source/data_dictionaries/windows/osquery/events/wmi_script_event_consumers.yml b/source/data_dictionaries/windows/osquery/events/wmi_script_event_consumers.yml new file mode 100644 index 000000000..7027db424 --- /dev/null +++ b/source/data_dictionaries/windows/osquery/events/wmi_script_event_consumers.yml @@ -0,0 +1,52 @@ +title: Wmi_script_event_consumers Table +description: WMI ActiveScriptEventConsumer, which can be used for persistence on Windows. + See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf + for more details. +platform: windows +log_source: osquery +event_code: wmi_script_event_consumers +event_fields: +- standard_name: TBD + standard_type: TBD + name: name + type: TEXT + description: 'Unique identifier for the event consumer. ' + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: scripting_engine + type: TEXT + description: Name of the scripting engine to use, for example, 'VBScript'. This + property cannot be NULL. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: script_file_name + type: TEXT + description: Name of the file from which the script text is read, intended as an + alternative to specifying the text of the script in the ScriptText property. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: script_text + type: TEXT + description: Text of the script that is expressed in a language known to the scripting + engine. This property must be NULL if the ScriptFileName property is not NULL. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: class + type: TEXT + description: The name of the class. + sample_value: TBD +- standard_name: TBD + standard_type: TBD + name: relative_path + type: TEXT + description: Relative path to the class or instance. + sample_value: TBD +references: +- text: OSQuery table documentation + link: https://osquery.io/schema/current#wmi_script_event_consumers +tags: +- version_4.4.2