Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🐛 Prefix incident reponse queries properly #86

Merged
merged 1 commit into from
Aug 14, 2023
Merged

🐛 Prefix incident reponse queries properly #86

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 17 additions & 17 deletions core/mondoo-kubernetes-incident-response.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,11 +13,11 @@ packs:
filters:
- asset.platform == "kubernetes" || asset.platform == "k8s-cluster"
queries:
- uid: k8s-cluster-version
- uid: mondoo-kubernetes-incident-response-cluster-version
title: Retrieve Kubernetes Cluster Version
mql: |
k8s.serverVersion
- uid: role-bindings-with-cluster-admin-permissions
- uid: mondoo-kubernetes-incident-response-role-bindings-with-cluster-admin-permissions
title: Retrieve role bindings with cluster-admin permissions
mql: |
k8s.rolebindings.where(roleRef["kind"] == "ClusterRole" && roleRef["name"] == "cluster-admin") {
Expand All @@ -26,7 +26,7 @@ packs:
subjects
roleRef
}
- uid: clusterrole-bindings-with-cluster-admin-permissions
- uid: mondoo-kubernetes-incident-response-clusterrole-bindings-with-cluster-admin-permissions
title: Retrieve ClusterRoleBindings with cluster-admin permissions
mql: |
k8s.clusterrolebindings.where(roleRef["kind"] == "ClusterRole" && roleRef["name"] == "cluster-admin") {
Expand All @@ -38,7 +38,7 @@ packs:
filters:
- asset.platform == "k8s-pod"
queries:
- uid: k8s-pod-security-context
- uid: mondoo-kubernetes-incident-response-pod-security-context
title: Retrieve Pod Security Context
mql: |
k8s.pod {
Expand All @@ -52,7 +52,7 @@ packs:
securityContext
}
}
- uid: k8s-pod-container
- uid: mondoo-kubernetes-incident-response-pod-container
title: Retrieve container image information
mql: |
k8s.pod {
Expand Down Expand Up @@ -100,7 +100,7 @@ packs:
filters:
- asset.platform == "k8s-deployment"
queries:
- uid: k8s-deployment-security-context
- uid: mondoo-kubernetes-incident-response-deployment-security-context
title: Retrieve Deployment Security Context
mql: |
k8s.deployment {
Expand All @@ -111,7 +111,7 @@ packs:
securityContext
}
}
- uid: k8s-deployment-container
- uid: mondoo-kubernetes-incident-response-deployment-container
title: Retrieve container image information
mql: |
k8s.deployment {
Expand Down Expand Up @@ -146,7 +146,7 @@ packs:
filters:
- asset.platform == "k8s-cronjob"
queries:
- uid: k8s-cronjob-security-context
- uid: mondoo-kubernetes-incident-response-cronjob-security-context
title: Retrieve CronJob Security Context
mql: |
k8s.cronjob {
Expand All @@ -157,7 +157,7 @@ packs:
securityContext
}
}
- uid: k8s-cronjob-container
- uid: mondoo-kubernetes-incident-response-cronjob-container
title: Retrieve container image information
mql: |
k8s.cronjob {
Expand Down Expand Up @@ -192,7 +192,7 @@ packs:
filters:
- asset.platform == "k8s-job"
queries:
- uid: k8s-job-security-context
- uid: mondoo-kubernetes-incident-response-job-security-context
title: Retrieve Job Security Context
mql: |
k8s.job {
Expand All @@ -203,7 +203,7 @@ packs:
securityContext
}
}
- uid: k8s-job-container
- uid: mondoo-kubernetes-incident-response-job-container
title: Retrieve container image information
mql: |
k8s.job {
Expand Down Expand Up @@ -238,7 +238,7 @@ packs:
filters:
- asset.platform == "k8s-daemonset"
queries:
- uid: k8s-daemonset-security-context
- uid: mondoo-kubernetes-incident-response-daemonset-security-context
title: Retrieve DaemonSet Security Context
mql: |
k8s.daemonset {
Expand All @@ -249,7 +249,7 @@ packs:
securityContext
}
}
- uid: k8s-daemonset-container
- uid: mondoo-kubernetes-incident-response-daemonset-container
title: Retrieve container image information
mql: |
k8s.daemonset {
Expand Down Expand Up @@ -284,7 +284,7 @@ packs:
filters:
- asset.platform == "k8s-statefulset"
queries:
- uid: k8s-statefulset-security-context
- uid: mondoo-kubernetes-incident-response-statefulset-security-context
title: Retrieve StatefulSet Security Context
mql: |
k8s.statefulset {
Expand All @@ -295,7 +295,7 @@ packs:
securityContext
}
}
- uid: k8s-statefulset-container
- uid: mondoo-kubernetes-incident-response-statefulset-container
title: Retrieve container image information
mql: |
k8s.statefulset {
Expand Down Expand Up @@ -330,7 +330,7 @@ packs:
filters:
- asset.platform == "k8s-replicaset"
queries:
- uid: k8s-replicaset-security-context
- uid: mondoo-kubernetes-incident-response-replicaset-security-context
title: Retrieve ReplicaSet Security Context
mql: |
k8s.replicaset {
Expand All @@ -341,7 +341,7 @@ packs:
securityContext
}
}
- uid: k8s-replicaset-container
- uid: mondoo-kubernetes-incident-response-replicaset-container
title: Retrieve container image information
mql: |
k8s.replicaset {
Expand Down
20 changes: 10 additions & 10 deletions core/mondoo-linux-incident-response.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,45 +11,45 @@ packs:
filters:
- asset.family.contains("linux")
queries:
- uid: mondoo-linux-installed-kernel
- uid: mondoo-linux-incident-response-installed-kernel
title: Retrieve installed Linux kernels
mql: |
if ( mondoo.capabilities.contains('run-command') ) {
kernel.installed
}
- uid: mondoo-linux-kernel-info
- uid: mondoo-linux-incident-response-kernel-info
title: Retrieve the running Linux kernel
mql: |
if ( mondoo.capabilities.contains('run-command') ) {
kernel.info
}
- uid: mondoo-linux-kernel-modules
- uid: mondoo-linux-incident-response-kernel-modules
title: Retrieve Linux kernel modules
mql: kernel.modules { name loaded }
- uid: mondoo-linux-processes
- uid: mondoo-linux-incident-response-processes
title: Retrieve running processes
mql: |
if ( mondoo.capabilities.contains('run-command') ) {
processes { pid command }
}
- uid: mondoo-linux-mounts
- uid: mondoo-linux-incident-response-mounts
title: Retrieve mounted devices
mql: mount.list { * }
- uid: mondoo-linux-listening-ports
- uid: mondoo-linux-incident-response-listening-ports
title: Retrieve all listening ports
mql: |
if ( mondoo.capabilities.contains('run-command') ) {
ports.listening { * }
}
- uid: mondoo-linux-uptime
- uid: mondoo-linux-incident-response-uptime
title: Retrieve operating system uptime
mql: |
if ( mondoo.capabilities.contains('run-command') ) {
os.uptime
}
- uid: mondoo-linux-installed-packages
- uid: mondoo-linux-incident-response-installed-packages
title: Retrieve installed packages
mql: packages { * }
- uid: mondoo-linux-running-services
- uid: mondoo-linux-incident-response-running-services
title: Retrieve running services
mql: services { * }
mql: services { * }
20 changes: 10 additions & 10 deletions core/mondoo-macos-incident-response.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,30 +17,30 @@ packs:
- uid: mondoo-macos-incident-response-regular-users
title: Retrieve regular users
mql: users.where( name != /^_/ && shell != /\/usr\/bin\/false/ )
- uid: mondoo-macos-kernel-info
- uid: mondoo-macos-incident-response-kernel-info
title: Retrieve the running macOS kernel
mql: kernel.info["version"]
- uid: mondoo-macos-kernel-modules
- uid: mondoo-macos-incident-response-kernel-modules
title: Retrieve macOS kernel modules
mql: kernel.modules { name loaded }
- uid: mondoo-macos-processes
- uid: mondoo-macos-incident-response-processes
title: Retrieve running processes
mql: processes.list { pid command }
- uid: mondoo-macos-mounts
- uid: mondoo-macos-incident-response-mounts
title: Retrieve mounted devices
mql: mount.list
- uid: mondoo-macos-uptime
- uid: mondoo-macos-incident-response-uptime
title: Retrieve operating system uptime
mql: os.uptime
- uid: mondoo-macos-installed-packages
- uid: mondoo-macos-incident-response-installed-packages
title: Retrieve installed packages
mql: packages
- uid: mondoo-macos-running-services
- uid: mondoo-macos-incident-response-running-services
title: Retrieve running services
mql: services
- uid: mondoo-macos-alf-extensions
- uid: mondoo-macos-incident-response-alf-extensions
title: Retrieve exceptions from the Application Layer Firewall
mql: macos.alf.exceptions
- uid: mondoo-macos-check-recommended-updates
- uid: mondoo-macos-incident-response-check-recommended-updates
title: Retrieve any recommended updates
mql: parse.plist('/Library/Preferences/com.apple.SoftwareUpdate.plist').params['RecommendedUpdates']
mql: parse.plist('/Library/Preferences/com.apple.SoftwareUpdate.plist').params['RecommendedUpdates']
8 changes: 4 additions & 4 deletions core/mondoo-openssl-incident-response.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,18 +11,18 @@ packs:
filters:
- asset.family.contains("linux")
queries:
- uid: mondoo-openssl-platform
- uid: mondoo-openssl-incident-response-platform
title: Retrieve platform details
mql: |
asset {
platform
version
arch
}
- uid: mondoo-openssl-installed-version
- uid: mondoo-openssl-incident-response-installed-version
title: Retrieve installed ssl libraries
mql: packages.where(name == /ssl/)
- uid: mondoo-openssl-listening-ports
- uid: mondoo-openssl-incident-response-listening-ports
title: Retrieve listening ports from running systems
mql: |
if ( mondoo.capabilities.contains('run-command') ) {
Expand All @@ -31,4 +31,4 @@ packs:
address
port
}
}
}
10 changes: 5 additions & 5 deletions core/mondoo-windows-incident-response.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,18 +11,18 @@ packs:
filters:
- asset.platform == "windows"
queries:
- uid: mondoo-windows-installed-hotfixes
- uid: mondoo-windows-incident-response-installed-hotfixes
title: Retrieve installed hotfixes
mql: windows.hotfixes { hotfixId installedOn }
- uid: mondoo-windows-uptime
- uid: mondoo-windows-incident-response-uptime
title: Retrieve operating system uptime
mql: os.uptime
- uid: mondoo-windows-installed-packages
- uid: mondoo-windows-incident-response-installed-packages
title: Retrieve list of installed packages
mql: packages
- uid: mondoo-windows-interface-configuration
- uid: mondoo-windows-incident-response-interface-configuration
title: Retrieve all Windows Computer/System information
mql: windows.computerInfo
- uid: mondoo-windows-running-services
- uid: mondoo-windows-incident-response-running-services
title: Retrieve running services
mql: services
Loading