Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

analysis.py: Add --pack flag to load queries from a pack file #7935

Merged
merged 1 commit into from
Feb 10, 2023

Conversation

tstromberg
Copy link
Contributor

This adds a --pack flag so that analysis.py can pull queries from an osquery pack file.

For example:

./profile.py --shell /usr/bin/osqueryi --pack pack.conf
Profiling query: SELECT file.path, file.type, file.size, file.mtime, file.uid, file.ctime, file.gid, hash.sha256, magic.data FROM file LEFT JOIN hash ON file.path = hash.path LEFT JOIN users u ON file.uid = u.uid LEFT JOIN magic ON file.path = magic.path WHERE ( file.directory LIKE '/Users/%/Downloads/%' OR file.directory LIKE '/home/%/%' OR file.directory LIKE '/home/%/' OR file.directory LIKE '/home/%/.%' OR file.directory LIKE '/home/%/Downloads/%' OR file.directory LIKE '/tmp/%' OR file.directory LIKE '/tmp/' OR file.directory LIKE '/Users/%/%' OR file.directory LIKE '/Users/%/' OR file.directory LIKE '/Users/%/.%' OR file.directory LIKE '/var/tmp/%' OR file.directory LIKE '/var/tmp/' ) AND file.directory NOT LIKE "%/../%" AND file.directory NOT LIKE "%/./%" AND filename LIKE "%-%-%.json" AND size BETWEEN 2311 AND 2385 AND NOT INSTR(filename, CONCAT (u.username, "-")) == 1 AND NOT INSTR( filename, REPLACE(LOWER(TRIM(description)), " ", "-") ) == 1;

@tstromberg tstromberg requested review from a team as code owners February 9, 2023 15:33
@directionless directionless merged commit ed1f839 into osquery:master Feb 10, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants