mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-07-19 22:19:39 +03:00
mukul975
c21af3347e
- Add scripts/agent.py and references/api-reference.md to all remaining skills - Update all 648 LICENSE files: copyright now reads 'Mahipal' - Add implementing-security-monitoring-with-datadog (new skill with full anatomy) - All 649 skills now have: SKILL.md, LICENSE, scripts/agent.py, references/api-reference.md
1.4 KiB
1.4 KiB
osquery Endpoint Monitoring — API Reference
Installation
| Platform | Command |
|---|---|
| macOS | brew install osquery |
| Ubuntu | apt install osquery |
| Windows | MSI installer from osquery.io |
Key osquery Tables
| Table | Description |
|---|---|
processes |
Running processes with pid, name, cmdline, uid |
listening_ports |
Open network ports with bound process |
suid_bin |
SUID/SGID binaries on the system |
crontab |
Scheduled cron jobs |
authorized_keys |
SSH authorized keys per user |
kernel_modules |
Loaded kernel modules |
docker_containers |
Docker container status |
startup_items |
Boot/login startup items |
file |
File metadata, hashes, timestamps |
Fleet API Endpoints
| Method | Endpoint | Description |
|---|---|---|
| GET | /api/v1/fleet/hosts |
List enrolled hosts |
| GET | /api/v1/fleet/hosts/{id} |
Host details |
| POST | /api/v1/fleet/queries |
Create scheduled query |
| GET | /api/v1/fleet/queries |
List queries |
osquery CLI
osqueryi --json "SELECT * FROM processes LIMIT 5"
osqueryctl start # Start osquery daemon
osqueryctl config-check # Validate configuration