[Osquery] Add default saved queries

packages/osquery/kibana/visualization/osquery-2d6e0760-f4ab-11e7-8647-534bb4c21040.json

@@ -11,7 +11,7 @@
             "aggs": [],
             "params": {
                 "fontSize": 10,
-                "markdown": "[Compilance](#/dashboard/osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05) | [OSSEC Rootkit](#/dashboard/osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040)"
+                "markdown": "[Compliance](#/dashboard/osquery-69f5ae20-eb02-11e7-8f04-51231daa5b05) | [OSSEC Rootkit](#/dashboard/osquery-c0a7ce90-f4aa-11e7-8647-534bb4c21040)"
             },
             "title": "Navigation [Logs Osquery]",
             "type": "markdown"

packages/osquery_manager/changelog.yml

@@ -1,4 +1,9 @@
 # newer versions go on top
+- version: "1.3.0"
+  changes:
+    - description: Add prebuilt saved queries
+      type: enhancement
+      link: https://github.com/elastic/integrations/pull/2998
 - version: "1.2.1"
   changes:
     - description: Update readme to remove exported fields

packages/osquery_manager/kibana/osquery_saved_query/osquery_manager-0796f890-b4a9-11ec-8f39-bf9c07530bbb.json

@@ -0,0 +1,45 @@
+{
+    "attributes": {
+        "created_at": "2022-04-05T06:24:21.145Z",
+        "created_by": "elastic",
+        "description": "Get all current network connections.",
+        "ecs_mapping": [
+            {
+                "key": "client.port",
+                "value": {
+                    "field": "port"
+                }
+            },
+            {
+                "key": "network.iana_number",
+                "value": {
+                    "field": "protocol"
+                }
+            },
+            {
+                "key": "network.type",
+                "value": {
+                    "field": "family"
+                }
+            },
+            {
+                "key": "client.address",
+                "value": {
+                    "field": "address"
+                }
+            }
+        ],
+        "id": "listening_ports",
+        "interval": "3600",
+        "query": "SELECT * FROM listening_ports;",
+        "updated_at": "2022-04-05T06:24:21.145Z",
+        "updated_by": "elastic",
+        "version": "1"
+    },
+    "coreMigrationVersion": "8.3.0",
+    "id": "osquery_manager-0796f890-b4a9-11ec-8f39-bf9c07530bbb",
+    "references": [],
+    "type": "osquery-saved-query",
+    "updated_at": "2022-04-05T06:24:21.147Z",
+    "version": "Wzc0OSwxXQ=="
+}

packages/osquery_manager/kibana/osquery_saved_query/osquery_manager-128b90b0-b4a6-11ec-8f39-bf9c07530bbb.json

@@ -0,0 +1,70 @@
+{
+    "attributes": {
+        "created_at": "2022-04-05T06:03:11.035Z",
+        "created_by": "elastic",
+        "description": "Recursively get info about all files within the specified path. Edit the path to narrow down the search.",
+        "ecs_mapping": [
+            {
+                "key": "file.directory",
+                "value": {
+                    "field": "directory"
+                }
+            },
+            {
+                "key": "file.name",
+                "value": {
+                    "field": "filename"
+                }
+            },
+            {
+                "key": "file.inode",
+                "value": {
+                    "field": "inode"
+                }
+            },
+            {
+                "key": "file.uid",
+                "value": {
+                    "field": "uid"
+                }
+            },
+            {
+                "key": "file.gid",
+                "value": {
+                    "field": "gid"
+                }
+            },
+            {
+                "key": "file.mode",
+                "value": {
+                    "field": "mode"
+                }
+            },
+            {
+                "key": "file.size",
+                "value": {
+                    "field": "size"
+                }
+            },
+            {
+                "key": "file.type",
+                "value": {
+                    "field": "type"
+                }
+            }
+        ],
+        "id": "file_info",
+        "interval": "3600",
+        "platform": "windows",
+        "query": "SELECT * FROM file WHERE path LIKE \"/%%\"",
+        "updated_at": "2022-04-05T06:03:11.035Z",
+        "updated_by": "elastic",
+        "version": "1"
+    },
+    "coreMigrationVersion": "8.3.0",
+    "id": "osquery_manager-128b90b0-b4a6-11ec-8f39-bf9c07530bbb",
+    "references": [],
+    "type": "osquery-saved-query",
+    "updated_at": "2022-04-05T06:03:11.036Z",
+    "version": "WzczNiwxXQ=="
+}

packages/osquery_manager/kibana/osquery_saved_query/osquery_manager-239dce60-b4a9-11ec-8f39-bf9c07530bbb.json

@@ -0,0 +1,34 @@
+{
+    "attributes": {
+        "created_at": "2022-04-05T06:25:08.166Z",
+        "created_by": "elastic",
+        "description": "Get applications and executables configured to launch when a system reboots on Windows.",
+        "ecs_mapping": [
+            {
+                "key": "file.path",
+                "value": {
+                    "field": "path"
+                }
+            },
+            {
+                "key": "file.name",
+                "value": {
+                    "field": "name"
+                }
+            }
+        ],
+        "id": "persisted_apps_executables_windows",
+        "interval": "3600",
+        "platform": "windows",
+        "query": "SELECT * FROM autoexec, startup_items;",
+        "updated_at": "2022-04-05T06:25:08.166Z",
+        "updated_by": "elastic",
+        "version": "1"
+    },
+    "coreMigrationVersion": "8.3.0",
+    "id": "osquery_manager-239dce60-b4a9-11ec-8f39-bf9c07530bbb",
+    "references": [],
+    "type": "osquery-saved-query",
+    "updated_at": "2022-04-05T06:25:08.167Z",
+    "version": "Wzc1MCwxXQ=="
+}

packages/osquery_manager/kibana/osquery_saved_query/osquery_manager-2de24900-b4a9-11ec-8f39-bf9c07530bbb.json

@@ -0,0 +1,51 @@
+{
+    "attributes": {
+        "created_at": "2022-04-05T06:25:25.392Z",
+        "created_by": "elastic",
+        "description": "Get applications configured to launch when a system reboots.",
+        "ecs_mapping": [
+            {
+                "key": "file.name",
+                "value": {
+                    "field": "name"
+                }
+            },
+            {
+                "key": "file.path",
+                "value": {
+                    "field": "path"
+                }
+            },
+            {
+                "key": "process.args",
+                "value": {
+                    "field": "args"
+                }
+            },
+            {
+                "key": "file.directory",
+                "value": {
+                    "field": "source"
+                }
+            },
+            {
+                "key": "user.name",
+                "value": {
+                    "field": "username"
+                }
+            }
+        ],
+        "id": "persisted_apps",
+        "interval": "3600",
+        "query": "SELECT * FROM startup_items;",
+        "updated_at": "2022-04-05T06:25:25.392Z",
+        "updated_by": "elastic",
+        "version": "1"
+    },
+    "coreMigrationVersion": "8.3.0",
+    "id": "osquery_manager-2de24900-b4a9-11ec-8f39-bf9c07530bbb",
+    "references": [],
+    "type": "osquery-saved-query",
+    "updated_at": "2022-04-05T06:25:25.395Z",
+    "version": "Wzc1MSwxXQ=="
+}

packages/osquery_manager/kibana/osquery_saved_query/osquery_manager-363d6a30-b4a9-11ec-8f39-bf9c07530bbb.json

@@ -0,0 +1,87 @@
+{
+    "attributes": {
+        "created_at": "2022-04-05T06:25:39.411Z",
+        "created_by": "elastic",
+        "description": "Get all running processes.",
+        "ecs_mapping": [
+            {
+                "key": "process.pid",
+                "value": {
+                    "field": "pid"
+                }
+            },
+            {
+                "key": "process.name",
+                "value": {
+                    "field": "name"
+                }
+            },
+            {
+                "key": "process.executable",
+                "value": {
+                    "field": "path"
+                }
+            },
+            {
+                "key": "process.args",
+                "value": {
+                    "field": "cmdline"
+                }
+            },
+            {
+                "key": "process.working_directory",
+                "value": {
+                    "field": "cwd"
+                }
+            },
+            {
+                "key": "user.id",
+                "value": {
+                    "field": "uid"
+                }
+            },
+            {
+                "key": "group.id",
+                "value": {
+                    "field": "gid"
+                }
+            },
+            {
+                "key": "process.start",
+                "value": {
+                    "field": "start_time"
+                }
+            },
+            {
+                "key": "process.parent.pid",
+                "value": {
+                    "field": "parent"
+                }
+            },
+            {
+                "key": "process.pgid",
+                "value": {
+                    "field": "pgroup"
+                }
+            },
+            {
+                "key": "process.uptime",
+                "value": {
+                    "field": "elapsed_time"
+                }
+            }
+        ],
+        "id": "processes",
+        "interval": "3600",
+        "query": "SELECT * FROM processes;",
+        "updated_at": "2022-04-05T06:25:39.411Z",
+        "updated_by": "elastic",
+        "version": "1"
+    },
+    "coreMigrationVersion": "8.3.0",
+    "id": "osquery_manager-363d6a30-b4a9-11ec-8f39-bf9c07530bbb",
+    "references": [],
+    "type": "osquery-saved-query",
+    "updated_at": "2022-04-05T06:25:39.412Z",
+    "version": "Wzc1MiwxXQ=="
+}

packages/osquery_manager/kibana/osquery_saved_query/osquery_manager-5c144ac0-b4a5-11ec-8f39-bf9c07530bbb.json

@@ -0,0 +1,40 @@
+{
+    "attributes": {
+        "created_at": "2022-04-05T05:58:04.908Z",
+        "created_by": "elastic",
+        "description": "Get all installed applications on MacOS.",
+        "ecs_mapping": [
+            {
+                "key": "package.name",
+                "value": {
+                    "field": "name"
+                }
+            },
+            {
+                "key": "package.path",
+                "value": {
+                    "field": "path"
+                }
+            },
+            {
+                "key": "file.accessed",
+                "value": {
+                    "field": "last_opened_time"
+                }
+            }
+        ],
+        "id": "applications_mac",
+        "interval": 3600,
+        "platform": "darwin",
+        "query": "SELECT * FROM apps;",
+        "updated_at": "2022-04-05T05:59:52.293Z",
+        "updated_by": "elastic",
+        "version": "1"
+    },
+    "coreMigrationVersion": "8.3.0",
+    "id": "osquery_manager-5c144ac0-b4a5-11ec-8f39-bf9c07530bbb",
+    "references": [],
+    "type": "osquery-saved-query",
+    "updated_at": "2022-04-05T05:59:52.297Z",
+    "version": "WzcyMiwxXQ=="
+}