osquery
osquery
4.5.0

0.0

osquery free download for Mac

osquery4.5.0

06 October 2020

Query your devices like a database.

Overview

Osquery uses basic SQL commands to leverage a relational data-model to describe a device.

Processes running without a binary on disk

Frequently, attackers will leave a malicious process running but delete the original binary on disk. This query returns any process whose original binary has been deleted, which could be an indicator of a suspicious process.

Three things you should know about osquery
  • It's fast and tested: Our build infrastructure ensures that newly introduced code is benchmarked and tested. We perform continuous testing for memory leaks, thread safety, and binary reproducibility on all supported platforms.
  • It runs everywhere: Windows, macOS, CentOS, FreeBSD, and almost every Linux OS released since 2011 are supported with no dependencies. osquery powers some of the most demanding companies, including Facebook.
  • It's open source: Osquery is released under the Apache License. Ever since we open-sourced it in 2014, organizations and individuals have contributed an ever-growing list of impressive features, useful tools, and helpful documentation.

What's new in osquery

Version 4.5.0:
New Features:
  • ARM64/AARCH64 beta support for Linux
  • Windows 32bit support
  • Fix buildup of RocksDB SST files
Under the Hood improvements:
  • Remove selectAllFrom from Linux process_events callback
  • Remove database read only concept
  • Move database initialization retry logic into DB API
  • Move osquery/include files into respective CMake targets
  • Memoize EventFactory::getType
  • Update schedule counter behavior
  • Define UNICODE and _UNICODE preprocessors for windows
  • Add WMI utility function to convert datetime to FILETIME
  • Move osquery shutdown logic outside of Initializer
Table Changes:
  • Support for Windows Background Activity Moderator
  • Add apparmor_events table to Linux
  • Add sigurl column to get YARA signatures from an HTTPS server
  • Add sigrules column to pass YARA signatures within queries
  • Add non-evented table for querying windows_event_log
  • Improve chassis_types and security_breach columns within chassis_info
  • Fix bool type usage in powershell_events
  • Add FileVersionRaw column to file table for Windows
  • Enable YARA table on Windows
  • Add dns_cache table for Windows
  • Add support for processing KILL syscall
  • Add startup_items table for Linux
  • Add shimcache table
  • Refactor shell_history to use generators (it will use less memory)
Bug Fixes:
  • Set thread names correctly on macOS and Linux
  • Apply --scheduler_timeout correctly
  • Add check for character_frequencies size
  • Fix race in removing external TablePlugins
  • Force shell to disable watchdog and logger
  • Return early within the shell if relative flags are used
  • Apply watcher delay each time the worker is started
  • Set global output function for Thrift
  • Fix incorrect readFile params in createPidFile
  • Fix call to LocalFree on deinit ptr inside getUidFromSid
  • Fix readFile to observe requested read size
  • Replace fstream within syslog_events with a custom non-blocking getline
  • Only fire events if a publisher exists
  • Fix Leak in psidToString
  • Fix memory leaks in rpm_package_files
  • Change "Symlink loop" message from warning to verbose
Documentation:
  • Update process auditing docs schema link
  • Improve descriptions for the processes table
  • Replace slackin with Slack shared invite
  • Update copyright notices to osquery foundation
Build:
  • Fix Windows build by removing non existing C11 conformance
  • Remove ExecStartPre from systemd service unit
  • Fix pip upgrade warning within CI
  • Detect MAJOR_IN_SYSMACROS/MKDEV for librpm in CMake
  • Add curl_certificate tests
  • Update YARA library to 4.0.2
  • Improve testing assumptions and flush fsevents when stopping
  • Fix the test utility to allow Windows profiling
  • Support ASAN for boost coroutine2 using ucontext
  • Update instructions for CPack package building
  • Use specific RPM variables to set the package name
  • Update compiler version used to v142 within Azure
Hardening:
  • Restore PIE support being dropped on Linux

Join over 500,000 subscribers.

Subscribe for our newsletter with best Mac offers from MacUpdate.

How would you rate osquery app?

0 Reviews of osquery