1.4.5
New features in 1.4.5:
OS X extended attributes generalization (merged quarantine/xattr_where_from)
RHEL6.5/7 supported building and custom RPM creation
Schedule logs now report UTC calendar time (with a " UTC" suffix) instead of localtime
Moved our Github Wiki to ReadTheDocs (https://osquery.readthedocs.org)
Less SQLite shell flags and switches, now with -A/-L for easy full-table querying
Barebones TLS/HTTP-based plugin interfaces, examples for external plugin development
Build YARA and snappy locally and compile/link statically (easier deploy)
Monitor schedule performance using the osquery_schedule table and --enable_monitoring
Bug fixes:
#921 Keychain table crashing with empty keychains
#915 Skip initialization tasks when only checking configurations
#922 Normalized EventSubscriber time, expected seconds since epoch
#937 osqueryd initscript correct error codes
#953 Empty SQLite predicate parsing in virtual table modules
#964 Restrict APT sources to AMD64 (no more x86-32)
#968 User-local LaunchAgents not found
#991 Debug and Optimized build overlaps (increased build time)
#1000 Upgrade SQLite to 3.8.9, bug fixes from libfuzz
#1040 Unknown EventSubscriber table implementations will crash
#1080 Raw sockets in Linux are not included (only TCP/UDP)
Config options / CLI flags changes:
Removed bail, batch, column, echo, explain, header, html, interactive, and stats from shell CLI
Added --A that takes a single table name arg and acts like: SELECT * FROM table
Added --L that lists all tables names
--disabled_tables takes a comma-delimited set of table names to runtime remove
Consolidated beta distributed flags into --distributed_retries
--enable_monitor keeps runtime schedule stats in osquery_schedule
Table changes (from 1.4.4 to 1.4.5):
API Change: Renamed table file_changes to file_events for All Platforms
API Change: Merged tables xattr_where_from and quarantine into extended_attributes
Moved table chrome_extensions to All Platforms
Moved table firefox_addons to All Platforms
Moved table opera_extensions to All Platforms
Moved table disk_encryption to All Platforms
Moved table process_memory_map to All Platforms
Added table etc_protocols to All Platforms
Added table yara to All Platforms
Added table yara_events to All Platforms
Added table rpm_package_files to CentOS
Added table launchd_overrides to Darwin (Apple OS X)
Added table managed_policies to Darwin (Apple OS X)
Added table osquery_schedule to Utility
Added column pattern (TEXT) to table file
Added column build (TEXT) to table os_version
Added column name (TEXT) to table os_version
Added column build_distro (TEXT) to table osquery_info
Added column build_platform (TEXT) to table osquery_info