OSQuery v4.9.0 Release Notes
-
Representing commits from 16 contributors! Thank you all.
๐ New Features
- โ Add filesystem logrotate feature (#7015)
- โ Add Non-Functional EndpointSecurity based process events to macOS (Requires updated codesigning due in 5.0) (#7046)
Table Changes
- Add
mdm_managed
column tosystem_extensions
on macOS (#6915) - โ Add
prefetch
table on Windows (#7076) - โ Add support for IMDSv2 to AWS tables (#7084)
- ๐ณ Enable container stats on docker containers that don't have traditional networks (#7145)
- โก๏ธ Update
homebrew_packages
to include new prefix, and allow specifying alternate prefixes (#7117) - Update
ntfs_acl_permissions
to list all ACE entries (usingGetAce()
) (#7114) - โก๏ธ Update
processes
table to display additional Windows attributes (secured
,protected
,virtual
,elevated
) (#7121) - Update how
package_install_history
identifies the packageIdentifiers key (#7099) - โก๏ธ Update how
identifier
is calculated inchrome_extensions
(#7124)
Under the Hood improvements
- ๐ Improve speed of osquery shutdown procedure (#7077)
- ๐ Improve shutdown speed during initialization (#7106)
- โก๏ธ Update website generators (#7136)
- CLI flag to allow osquery to keep retrying enrollment (instead of exiting) (#7125)
- rocksdb: Do not fsync WAL writes (#7094)
- ๐ Move CPack packaging to a dedicated repository (#7059)
- โช Restore thrift socket 5min timeout (#7072)
- Consolidate syscalls to a single audit rule (#7063)
๐ Bug Fixes
- โ Add current WMI location for Dell BIOS info (#7103)
- ๐จ Correct RocksDB error code and subcode printing on open failure (#7069)
- ๐ Fix
pipe_channel
not reading all data in a message (#7139) - ๐ Fix crash and deadlocks in recursive logging (#7127)
- ๐ Fix custom
curl_certificate
timeouts (#7151) - ๐ Fix extensions crash on shutdown (#7075)
- Handle updated paths on various macOS tables --
xprotect_entries
,xprotect_meta
,launchd
(#7138, #7154) - Trigger event cleanup checks every 256 events (#7143)
- โก๏ธ Update generating an extension uuid to be thread safe (#7135)
- ๐ท Watchdog should wait for the worker to shutdown (#7116)
๐ Documentation
- ๐ Update process auditing requirements documentation (#7102)
- โก๏ธ Update website docs indicating windows support for YARA tables (#7130)
- โ Add 4.9.0 CHANGELOG (#7152)
๐ Build
- โ Add Apple provisioning profile for distribution (#7119)
- โ Add more tests for events expiration (#7071)
- CI: Regenerate sccache cache when compiler version changes (#7081)
- Fix flaky test test_daemon_sigint by waiting for pidfile (#7095)
- ๐ Fix icon in Windows packaging (#7148)
- Minor cleanup of unused variables (#7128)
- ๐จ Print extension SDK minimum version required when failing to load (#7074)
- โ Remove POSIX-only
-fexceptions
flag on Windows (#7126) - Remove duplicated osquery_utils_aws_tests-test (#7078)
- โ Remove flaky test decorators for python tests (#7070)
- โก๏ธ Update SQLite to version 3.35.5 (#7090)
- โก๏ธ Update librdkafka to version 1.7.0 (#7134)
- โก๏ธ Update libyara to version 4.1.1 (#7133)