mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-08-31 21:50:50 +03:00
mukul975
c47eed6a64
- Fix 25 shell=True subprocess calls with list-based commands - Fix 49 verify=False in defensive skills (env-var override) - Add timeout to 231 HTTP/subprocess/socket calls - Fix 6 SQL injection patterns with whitelist validation - Replace 8 __import__() with standard imports - Remove 701 unused imports across 442 files - Add authorized-testing disclaimers to all offensive skills - Complete 11 incomplete skill directories - Expand 10 stub SKILL.md files with full content - Fix 2 YAML parse errors in frontmatter - Fix 5 pre-existing syntax errors - Convert 22 hardcoded paths/ports to environment variables - Back up 21 redundant skill pairs to .bak - Fix 2 global declaration errors - 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE) - 0 compile errors across all 724 agent.py files
52 lines
1.4 KiB
Markdown
52 lines
1.4 KiB
Markdown
# API Reference: Osquery Endpoint Monitoring
|
|
|
|
## osquery.conf Structure
|
|
```json
|
|
{
|
|
"options": {
|
|
"logger_plugin": "filesystem",
|
|
"logger_path": "/var/log/osquery",
|
|
"database_path": "/var/osquery/osquery.db",
|
|
"worker_threads": "2"
|
|
},
|
|
"schedule": {
|
|
"query_name": {
|
|
"query": "SELECT * FROM processes;",
|
|
"interval": 300,
|
|
"description": "Description"
|
|
}
|
|
},
|
|
"file_paths": {
|
|
"category": ["/etc/%%", "/usr/bin/%%"]
|
|
}
|
|
}
|
|
```
|
|
|
|
## Key Osquery Tables
|
|
| Table | Description |
|
|
|-------|-------------|
|
|
| processes | Running processes (pid, name, path, cmdline, uid) |
|
|
| listening_ports | Open listening ports (pid, port, protocol) |
|
|
| process_open_sockets | Active network connections |
|
|
| crontab | Cron job entries |
|
|
| suid_bin | SUID/SGID binaries |
|
|
| file | File metadata (path, size, mtime, sha256) |
|
|
| kernel_modules | Loaded kernel modules |
|
|
| authorized_keys | SSH authorized keys |
|
|
| startup_items | Startup/login items |
|
|
| shell_history | Shell command history |
|
|
|
|
## Result Log Format (JSON Lines)
|
|
```json
|
|
{"name":"query_name","action":"added","columns":{"pid":"1234","name":"suspicious"},"unixTime":"1705312200"}
|
|
```
|
|
- `action`: "added" (new row) or "removed" (row disappeared)
|
|
- `columns`: query result columns as key-value pairs
|
|
|
|
## osquery CLI
|
|
```bash
|
|
osqueryi "SELECT * FROM processes WHERE name = 'nc';"
|
|
osqueryctl start # Start daemon
|
|
osqueryctl config-check # Validate config
|
|
```
|