mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-18 05:29:40 +03:00
mukul975
27c6414ca5
Complete skill folder anatomy across all cybersecurity skills: - scripts/agent.py: 80-150 line Python agents using real libraries (impacket, boto3, azure-mgmt-*, kubernetes, pefile, yara, scapy, shodan, stix2, etc.) - references/api-reference.md: real API documentation with method signatures - LICENSE: MIT license for all skill folders
1.4 KiB
1.4 KiB
API Reference: Osquery Endpoint Monitoring
osquery.conf Structure
{
"options": {
"logger_plugin": "filesystem",
"logger_path": "/var/log/osquery",
"database_path": "/var/osquery/osquery.db",
"worker_threads": "2"
},
"schedule": {
"query_name": {
"query": "SELECT * FROM processes;",
"interval": 300,
"description": "Description"
}
},
"file_paths": {
"category": ["/etc/%%", "/usr/bin/%%"]
}
}
Key Osquery Tables
| Table | Description |
|---|---|
| processes | Running processes (pid, name, path, cmdline, uid) |
| listening_ports | Open listening ports (pid, port, protocol) |
| process_open_sockets | Active network connections |
| crontab | Cron job entries |
| suid_bin | SUID/SGID binaries |
| file | File metadata (path, size, mtime, sha256) |
| kernel_modules | Loaded kernel modules |
| authorized_keys | SSH authorized keys |
| startup_items | Startup/login items |
| shell_history | Shell command history |
Result Log Format (JSON Lines)
{"name":"query_name","action":"added","columns":{"pid":"1234","name":"suspicious"},"unixTime":"1705312200"}
action: "added" (new row) or "removed" (row disappeared)columns: query result columns as key-value pairs
osquery CLI
osqueryi "SELECT * FROM processes WHERE name = 'nc';"
osqueryctl start # Start daemon
osqueryctl config-check # Validate config