Skip to content

Commit

Permalink
Remove Retrieve from more query names (#116)
Browse files Browse the repository at this point in the history
This makes this display better in the data queries tab

---------

Signed-off-by: Tim Smith <[email protected]>
Co-authored-by: Letha <[email protected]>
  • Loading branch information
tas50 and misterpantz authored Dec 1, 2023
1 parent 6484f5d commit 035aef9
Show file tree
Hide file tree
Showing 9 changed files with 69 additions and 69 deletions.
24 changes: 12 additions & 12 deletions core/mondoo-gcp-inventory.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ packs:
- asset.platform == "gcp" || asset.platform == "gcp-project"
queries:
- uid: mondoo-asset-inventory-gcp-project-info
title: Retrieve GCP Project Information
title: GCP Project Information
mql: |
gcp.project {
name
Expand All @@ -29,68 +29,68 @@ packs:
labels
}
- uid: mondoo-asset-inventory-gcp-project-owners
title: Retrieve data for all owners of the GCP project
title: GCP project owners
docs:
desc: |
This query retrieves data for all owners of the GCP project
mql: gcp.project.iamPolicy.where( role == "roles/owner" )
- uid: mondoo-asset-inventory-gcp-project-editors
title: Retrieve data for all editors of the GCP project
title: GCP project editors
docs:
desc: |
This query retrieves data for all editors of the GCP project
mql: gcp.project.iamPolicy.where( role == "roles/editors" )
- uid: mondoo-asset-inventory-gcp-iam-roles
title: Retrieve all IAM Policy roles for the GCP project
title: IAM Policy roles
docs:
desc: |
This query retrieves all roles defined for a GCP project
mql: gcp.project.iamPolicy { role }
- uid: mondoo-asset-inventory-gcp-enabled-services
title: Retrieve all services enabled in the GCP project
title: Services enabled in the GCP project
docs:
desc: |
This query retrieves all services enabled in the GCP Project
mql: gcp.project.services.where( enabled == true )
- uid: mondoo-asset-inventory-gcp-gke-clusters-count
title: Retrieve count of GKE clusters in a GCP project
title: GKE clusters count
docs:
desc: |
This query retrieves a count of GKE clusters running in a GCP project
mql: gcp.project.gke.clusters.length
- uid: mondoo-asset-inventory-gcp-gke-clusters-data
title: Retrieve data on GKE clusters
title: GKE clusters configuration
docs:
desc: |
This query retrieves all of the configuration data for GKE clusters within a project
mql: gcp.project.gke.clusters
- uid: mondoo-asset-inventory-gcp-compute-instances-count
title: Retrieve a count of GCP compute instances in a GCP project
title: GCP compute instances count
docs:
desc: |
This query retrieves a count of running GCP compute instances in a GCP project
mql: gcp.compute.instances.where( status == "RUNNING" ).length
- uid: mondoo-asset-inventory-gcp-compute-instances-data
title: Retrieve data from all running GCP compute instances in a GCP project
title: GCP compute instances
docs:
desc: |
This query retrieves the data for all running GCP compute instances in a GCP project
mql: gcp.compute.instances.where( status == "RUNNING" )
- uid: mondoo-asset-inventory-gcp-compute-instances-public
title: Retrieve data on public GCP Compute Engine instances
title: GCP Compute Engine instances
docs:
desc: |
This query retrieves the data for all GCP Compute Engine instances that have been configured with an external IP address.
mql: |
gcp.compute.instances.where( networkInterfaces[0]['accessConfigs'][0]['name'] == "External NAT" )
- uid: mondoo-asset-inventory-gcp-compute-networks-count
title: Retrieve a count of GCP Compute Engine networks in a GCP project
title: GCP Compute Engine networks count
docs:
desc: |
This query retrieves a count of GCP Compute Engine networks configured in a GCP project
mql: gcp.compute.networks.length
- uid: mondoo-asset-inventory-gcp-compute-networks-data
title: Retrieve data for all GCP Compute Engine networks in a GCP project
title: GCP Compute Engine networks
docs:
desc: |
This query retrieves the data for all GCP Compute Engine networks configured in a GCP project.
Expand Down
34 changes: 17 additions & 17 deletions core/mondoo-kubernetes-incident-response.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,11 @@ packs:
- asset.platform == "kubernetes" || asset.platform == "k8s-cluster"
queries:
- uid: mondoo-kubernetes-incident-response-cluster-version
title: Retrieve Kubernetes Cluster Version
title: Kubernetes Cluster Version
mql: |
k8s.serverVersion
- uid: mondoo-kubernetes-incident-response-role-bindings-with-cluster-admin-permissions
title: Retrieve role bindings with cluster-admin permissions
title: Role bindings with cluster-admin permissions
mql: |
k8s.rolebindings.where(roleRef["kind"] == "ClusterRole" && roleRef["name"] == "cluster-admin") {
name
Expand All @@ -31,7 +31,7 @@ packs:
roleRef
}
- uid: mondoo-kubernetes-incident-response-clusterrole-bindings-with-cluster-admin-permissions
title: Retrieve ClusterRoleBindings with cluster-admin permissions
title: ClusterRoleBindings with cluster-admin permissions
mql: |
k8s.clusterrolebindings.where(roleRef["kind"] == "ClusterRole" && roleRef["name"] == "cluster-admin") {
name
Expand All @@ -43,7 +43,7 @@ packs:
- asset.platform == "k8s-pod"
queries:
- uid: mondoo-kubernetes-incident-response-pod-security-context
title: Retrieve Pod Security Context
title: Pod Security Context
mql: |
k8s.pod {
ephemeralContainers {
Expand All @@ -57,7 +57,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-pod-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.pod {
name
Expand Down Expand Up @@ -105,7 +105,7 @@ packs:
- asset.platform == "k8s-deployment"
queries:
- uid: mondoo-kubernetes-incident-response-deployment-security-context
title: Retrieve Deployment Security Context
title: Deployment Security Context
mql: |
k8s.deployment {
initContainers {
Expand All @@ -116,7 +116,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-deployment-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.deployment {
name
Expand Down Expand Up @@ -151,7 +151,7 @@ packs:
- asset.platform == "k8s-cronjob"
queries:
- uid: mondoo-kubernetes-incident-response-cronjob-security-context
title: Retrieve CronJob Security Context
title: CronJob Security Context
mql: |
k8s.cronjob {
initContainers {
Expand All @@ -162,7 +162,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-cronjob-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.cronjob {
name
Expand Down Expand Up @@ -197,7 +197,7 @@ packs:
- asset.platform == "k8s-job"
queries:
- uid: mondoo-kubernetes-incident-response-job-security-context
title: Retrieve Job Security Context
title: Job Security Context
mql: |
k8s.job {
initContainers {
Expand All @@ -208,7 +208,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-job-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.job {
name
Expand Down Expand Up @@ -243,7 +243,7 @@ packs:
- asset.platform == "k8s-daemonset"
queries:
- uid: mondoo-kubernetes-incident-response-daemonset-security-context
title: Retrieve DaemonSet Security Context
title: DaemonSet Security Context
mql: |
k8s.daemonset {
initContainers {
Expand All @@ -254,7 +254,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-daemonset-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.daemonset {
name
Expand Down Expand Up @@ -289,7 +289,7 @@ packs:
- asset.platform == "k8s-statefulset"
queries:
- uid: mondoo-kubernetes-incident-response-statefulset-security-context
title: Retrieve StatefulSet Security Context
title: StatefulSet Security Context
mql: |
k8s.statefulset {
initContainers {
Expand All @@ -300,7 +300,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-statefulset-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.statefulset {
name
Expand Down Expand Up @@ -335,7 +335,7 @@ packs:
- asset.platform == "k8s-replicaset"
queries:
- uid: mondoo-kubernetes-incident-response-replicaset-security-context
title: Retrieve ReplicaSet Security Context
title: ReplicaSet Security Context
mql: |
k8s.replicaset {
initContainers {
Expand All @@ -346,7 +346,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-replicaset-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.replicaset {
name
Expand Down
18 changes: 9 additions & 9 deletions core/mondoo-linux-incident-response.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,34 +16,34 @@ packs:
- asset.family.contains("linux")
queries:
- uid: mondoo-linux-incident-response-installed-kernel
title: Retrieve installed Linux kernels
title: Installed Linux kernels
filters: mondoo.capabilities.contains("run-command")
mql: kernel.installed
- uid: mondoo-linux-kernel-info
title: Retrieve the running Linux kernel
title: Running Linux kernel
filters: mondoo.capabilities.contains("run-command")
mql: kernel.info
- uid: mondoo-linux-kernel-modules
title: Retrieve Linux kernel modules
title: Linux kernel modules
mql: kernel.modules { name loaded }
- uid: mondoo-linux-incident-response-processes
title: Retrieve running processes
title: Running processes
filters: mondoo.capabilities.contains("run-command")
mql: processes { pid command }
- uid: mondoo-linux-mounts
title: Retrieve mounted devices
title: Mounted devices
mql: mount.list { path fstype device options }
- uid: mondoo-linux-listening-ports
title: Retrieve all listening ports
title: All listening ports
filters: mondoo.capabilities.contains("run-command")
mql: ports.listening
- uid: mondoo-linux-uptime
title: Retrieve operating system uptime
title: Operating system uptime
filters: mondoo.capabilities.contains("run-command")
mql: os.uptime
- uid: mondoo-linux-installed-packages
title: Retrieve installed packages
title: Installed packages
mql: packages { name version arch installed }
- uid: mondoo-linux-running-services
title: Retrieve running services
title: Running services
mql: services { name running enabled masked type }
22 changes: 11 additions & 11 deletions core/mondoo-macos-incident-response.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,35 +16,35 @@ packs:
- asset.platform == "macos"
queries:
- uid: mondoo-macos-incident-response-platform-info
title: Retrieve platform information
title: Platform information
mql: asset { platform title version arch }
- uid: mondoo-macos-incident-response-regular-users
title: Retrieve regular users
title: Regular users
mql: users.where( name != /^_/ && shell != /\/usr\/bin\/false/ )
- uid: mondoo-macos-incident-response-kernel-info
title: Retrieve the running macOS kernel
title: Running macOS kernel
mql: kernel.info["version"]
- uid: mondoo-macos-incident-response-kernel-modules
title: Retrieve macOS kernel modules
title: macOS kernel modules
mql: kernel.modules { name loaded }
- uid: mondoo-macos-incident-response-processes
title: Retrieve running processes
title: Running processes
mql: processes.list { pid command }
- uid: mondoo-macos-incident-response-mounts
title: Retrieve mounted devices
title: Mounted devices
mql: mount.list
- uid: mondoo-macos-incident-response-uptime
title: Retrieve operating system uptime
title: Operating system uptime
mql: os.uptime
- uid: mondoo-macos-incident-response-installed-packages
title: Retrieve installed packages
title: Installed packages
mql: packages
- uid: mondoo-macos-incident-response-running-services
title: Retrieve running services
title: Running services
mql: services
- uid: mondoo-macos-incident-response-alf-extensions
title: Retrieve exceptions from the Application Layer Firewall
title: Exceptions from the Application Layer Firewall
mql: macos.alf.exceptions
- uid: mondoo-macos-incident-response-check-recommended-updates
title: Retrieve any recommended updates
title: Recommended OS and application updates
mql: parse.plist('/Library/Preferences/com.apple.SoftwareUpdate.plist').params['RecommendedUpdates']
6 changes: 3 additions & 3 deletions core/mondoo-openssl-incident-response.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,18 +16,18 @@ packs:
- asset.family.contains("linux")
queries:
- uid: mondoo-openssl-incident-response-platform
title: Retrieve platform details
title: Platform details
mql: |
asset {
platform
version
arch
}
- uid: mondoo-openssl-incident-response-installed-version
title: Retrieve installed ssl libraries
title: Installed ssl libraries
mql: packages.where(name == /ssl/)
- uid: mondoo-openssl-incident-response-listening-ports
title: Retrieve listening ports from running systems
title: Listening ports for running systems
mql: |
if ( mondoo.capabilities.contains('run-command') ) {
ports.listening {
Expand Down
10 changes: 5 additions & 5 deletions core/mondoo-vmware-incident-response.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -35,27 +35,27 @@ packs:
- asset.platform == "vmware-esxi"
queries:
- uid: mondoo-vmware-incident-response-kernel-modules
title: Retrieve kernel modules
title: Kernel modules
mql: vsphere.host.kernelModules
- uid: mondoo-vmware-incident-response-installed-packages
title: Retrieve installed packages
title: Installed packages
mql: vsphere.host.packages
- uid: mondoo-vmware-incident-response-running-services
title: Retrieve all services
title: All services
mql: vsphere.host.services
refs:
- title: VMSA-2021-0002
url: https://www.vmware.com/security/advisories/VMSA-2021-0002.html
- title: How to Disable/Enable the SLP Service on VMware ESXi (76372)
url: https://kb.vmware.com/s/article/76372
- uid: mondoo-vmware-incident-response-acceptance-level
title: Retrieve host acceptance level
title: Host acceptance level
docs:
desc: The host acceptance level determines which VIBs can be installed on a host.
mql: vsphere.host.acceptanceLevel
refs:
- title:
url: https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.upgrade.doc/GUID-27BBBAB8-01EA-4238-8140-1C3C3EFC0AA6.html
- uid: mondoo-vmware-incident-response-ntp-servers
title: Retrieve all configured NTP servers
title: Configured NTP servers
mql: vsphere.host.ntp.server
Loading

0 comments on commit 035aef9

Please sign in to comment.