mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-28 12:19:41 +03:00
mukul975
c47eed6a64
- Fix 25 shell=True subprocess calls with list-based commands - Fix 49 verify=False in defensive skills (env-var override) - Add timeout to 231 HTTP/subprocess/socket calls - Fix 6 SQL injection patterns with whitelist validation - Replace 8 __import__() with standard imports - Remove 701 unused imports across 442 files - Add authorized-testing disclaimers to all offensive skills - Complete 11 incomplete skill directories - Expand 10 stub SKILL.md files with full content - Fix 2 YAML parse errors in frontmatter - Fix 5 pre-existing syntax errors - Convert 22 hardcoded paths/ports to environment variables - Back up 21 redundant skill pairs to .bak - Fix 2 global declaration errors - 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE) - 0 compile errors across all 724 agent.py files
1.4 KiB
1.4 KiB
API Reference: Osquery Endpoint Monitoring
osquery.conf Structure
{
"options": {
"logger_plugin": "filesystem",
"logger_path": "/var/log/osquery",
"database_path": "/var/osquery/osquery.db",
"worker_threads": "2"
},
"schedule": {
"query_name": {
"query": "SELECT * FROM processes;",
"interval": 300,
"description": "Description"
}
},
"file_paths": {
"category": ["/etc/%%", "/usr/bin/%%"]
}
}
Key Osquery Tables
| Table | Description |
|---|---|
| processes | Running processes (pid, name, path, cmdline, uid) |
| listening_ports | Open listening ports (pid, port, protocol) |
| process_open_sockets | Active network connections |
| crontab | Cron job entries |
| suid_bin | SUID/SGID binaries |
| file | File metadata (path, size, mtime, sha256) |
| kernel_modules | Loaded kernel modules |
| authorized_keys | SSH authorized keys |
| startup_items | Startup/login items |
| shell_history | Shell command history |
Result Log Format (JSON Lines)
{"name":"query_name","action":"added","columns":{"pid":"1234","name":"suspicious"},"unixTime":"1705312200"}
action: "added" (new row) or "removed" (row disappeared)columns: query result columns as key-value pairs
osquery CLI
osqueryi "SELECT * FROM processes WHERE name = 'nc';"
osqueryctl start # Start daemon
osqueryctl config-check # Validate config