Add support for basic chassis information

osquery/tables/system/windows/chassis_info.cpp

@@ -0,0 +1,69 @@
+/**
+ *  Copyright (c) 2014-present, Facebook, Inc.
+ *  All rights reserved.
+ *
+ *  This source code is licensed under both the Apache 2.0 license (found in the
+ *  LICENSE file in the root directory of this source tree) and the GPLv2 (found
+ *  in the COPYING file in the root directory of this source tree).
+ *  You may select, at your option, one of the above-listed licenses.
+ */
+
+#include <osquery/logger.h>
+#include <osquery/sql.h>
+#include <osquery/system.h>
+#include <osquery/tables.h>
+
+#include "osquery/core/windows/wmi.h"
+
+namespace osquery {
+namespace tables {
+
+QueryData genChassisInfo(QueryContext& context) {
+  QueryData results;
+
+  WmiRequest wmiSystemReq("select * from Win32_SystemEnclosure");
+  const auto& wmiResults = wmiSystemReq.results();
+  if (wmiSystemReq.getStatus().ok()) {
+    if (!wmiResults.empty()) {
+      for (const auto& data : wmiResults) {
+        Row r;
+        bool boolean = false;
+        long number;
+        data.GetBool("AudibleAlarm", boolean);
+        r["audible_alarm"] = boolean ? "True" : "False";
+        data.GetString("BreachDescription", r["breach_description"]);
+        data.GetLong("ChassisTypes", number);
+        r["chassis_types"] = INTEGER(number);
+        data.GetString("Description", r["description"]);
+
+        //reset boolean to make sure there is no interference from the last call
+        boolean = false;
+
+        data.GetBool("LockPresent", boolean);
+        r["lock"] = boolean ? "True" : "False";
+        data.GetString("Manufacturer", r["manufacturer"]);
+        data.GetString("Model", r["model"]);
+        data.GetLong("SecurityBreach", number);
+        r["security_status"] = INTEGER(number);
+        data.GetString("SerialNumber", r["serial"]);
+        data.GetString("SMBIOSAssetTag", r["smbios_tag"]);
+        data.GetString("SKU", r["sku"]);
+        data.GetString("Status", r["status"]);
+
+        //reset boolean to make sure there is no interference from the last call
+        boolean = false;
+
+        data.GetBool("VisibleAlarm", boolean);
+        r["visible_alarm"] = boolean ? "True" : "False";
+        results.push_back(std::move(r));
+      }
+    } else {
+      LOG(WARNING) << "WMI resultset empty.";
+    }
+  } else {
+    VLOG(1) << wmiSystemReq.getStatus().getMessage();
+  }
+  return results;
+}
+} // namespace tables
+} // namespace osquery

specs/windows/chassis_info.table

@@ -0,0 +1,21 @@
+table_name("chassis_info")
+description("Display information pertaining to the chassis and its security status.")
+schema([
+    Column("audible_alarm", TEXT, "If TRUE, the frame is equipped with an audible alarm."),
+    Column("breach_description", TEXT, "If provided, gives a more detailed description of a detected security breach."),
+    Column("chassis_types", INTEGER, "The type of chassis, such as Desktop or Laptop."),
+    Column("description", TEXT, "An extended description of the chassis if available."),
+    Column("lock", TEXT, "If TRUE, the frame is equipped with a lock."),
+    Column("manufacturer", TEXT, "The manufacturer of the chassis."),
+    Column("model", TEXT, "The model of the chassis."),
+    Column("security_status", INTEGER, "The physical status of the chassis such as breached, not breached, etc."),
+    Column("serial", TEXT, "The serial number of the chassis."),
+    Column("smbios_tag", TEXT, "The assigned asset tag number of the chassis."),
+    Column("sku", TEXT, "The Stock Keeping Unit number if available."),
+    Column("status", TEXT, "If available, gives various operational or nonoperational statuses such as OK, Degraded, and Pred Fail."),
+    Column("visible_alarm", TEXT, "If TRUE, the frame is equipped with a visual alarm."),
+])
+implementation("chassis_info@genChassisInfo")
+examples([
+  "select * from chassis_info",
+])