Standard query library

[noahtalerman]

This issue describes the project of adding a standard query library to Fleet.

Goal

Provide a set of queries in Fleet that provides a baseline template of queries/packs for organizations deploying Fleet and osquery. Eventually, this library could become a location for community contributions.

Community source

Listed below are great resources that contain queries and query packs to consider for Fleet's standard query library:

• https://github.com/osquery/osquery/tree/master/packs
• https://github.com/palantir/osquery-configuration/tree/master/Fleet

Estimated release date

2021-6-30

[mikermcneil]

Maybe also worth looking to see what Recon InfoSec might have available free and open source, for inspiration.

[mikermcneil]

How we can get started on the standard query library now:

• where will we put the queries? (probably start with a yaml file in handbook or something)
  • https://github.com/fleetdm/fleet/blob/master/handbook/queries/get-installed-macos-software.md
• what format? (probably yaml)
  • markdown for now
• what keys? (maybe like friendlyName, description, query, notes, remediation, purpose)
  • see example: https://github.com/fleetdm/fleet/blob/master/handbook/queries/get-installed-macos-software.md
• separate file for each query or all in one file? (separate for each query is more ADS friendly, and easier to link to from Fleet product). If separate file, consider that the filename needs to be immutable
  • separate files
• where do we start?
  • stuff we need for host details page
    • installed software on other OSs
    • other stuff we're already displaying
    • stuff we know is coming but , if any of it is crystal clear already
    • palantir
      • https://github.com/palantir/osquery-configuration/tree/89c2ae5c7fcad242696e6febb16c05abb0375155/Fleet/Endpoints

An example of a palantir query: https://github.com/palantir/osquery-configuration/blob/89c2ae5c7fcad242696e6febb16c05abb0375155/Fleet/Endpoints/MacOS/osquery.yaml#L700-L706

[mikermcneil]

Next step: Take a crack at a wireframe for how pages like this will look on fleetdm.com (e.g. fleetdm.com/queries/get-installed-macos-software) @mike-j-thomas

Works along the same lines as #706

After we've had a chance to review that and it comes time to implement, for working with compiled HTML for the query pages:

• A sandbox page is stubbed out at http://localhost:2024/sandbox/example-query
• First run sails run scripts/build-from-markdown.js, then sails lift and visit the sandbox page to see generated HTML ready to be styled
• 

[mike-j-thomas]

Current design progress https://www.figma.com/file/Jzo81K6E4jC0mcjD4JsWM8/?node-id=317%3A12406

[noahtalerman]

@mike-j-thomas passing this issue to you while the design of the fleetdm.com pages is in progress.