OSQuery v5.5.1 Release Notes
-
โก๏ธ Osquery 5.5.1 has some really exciting table updates! There is a much ๐ anticipated
unified_log
for macOS, this table is the replacement forasl
, and uses the current Apple APIs. Additionally, several tables ๐ have improved their cross-platform support.Representing commits from 14 contributors! Thank you all.
๐ New Features
- โ Add denylist mechanism to distributed queries (#7675)
Table Changes
- โ Add
cgroup_path
column toprocesses
table on Linux (#7728) - Add
firmware_type
column toplatform_info
table on Windows. (#7710) - โ Add
unified_log
table for macOS (UAL) (#7598, #7713) - ๐ Port
memory_devices
table to Windows (#7633) - Port
platform_info
table to M1 Macs (#7660) - ๐ Restore macOS
kernel_panics
table on modern macOS (#7585) - โก๏ธ Update
battery
table on macOS m1 with correct raw battery max and current capacity (#7721) - โก๏ธ Update
mdfind
query timeout to 30 seconds (#7725) - โก๏ธ Update macos
password_policy
table to use use-1
as sentinel value foruid
column (#7699) - โก๏ธ Update parsing of
authorized_keys
file (#7560) - โก๏ธ Update the
registry
table to be case insensitive forkey
(#7708)
Under the Hood improvements
- โ Add a mechanism to reduce memory retained on Linux (#7502)
- โ Add denylist mechanism to distributed queries (#7675)
- โ Add table spec support for
COLLATE NOCASE
(#7680) - ๐ Improve Pidfile handling (#7304)
- Prevent the audit event system from using too much memory (#7329)
- carves: use full pathnames while creating an archive (#7681)
๐ Bug Fixes
- ๐ Fix
GetMemorySize
for Windowsmemory_devices
table (#7711) - ๐ Fix
tpm_info
bug where values were out of date (#7686) - ๐ Fix a crash when parsing ATC config with no columns (#7693)
- ๐ Fix bug in GetHomeDirectories filesystem function (#7705)
๐ Documentation
- โ Add core to the type column description of osquery_extensions schema (#7716)
- โ Add documentation about 3rd-party dependency security (#7684)
- โ Add example for hostname form in
curl_certificate
table (#7706) - โ Adds info on how to use GTEST_FILTER on windows (#7696)
- ๐ Changelog 5.4.0 (#7678)
- Describe user-context-related caveat for screenlock table (#7649)
- Update schema for
process_open_sockets.state
(#7733) - โก๏ธ Update schema to reflect
platform_info
columns not available in Windows (#7732)
๐ Build
- โ Add validation integration test for memory_devices (#7722)
- โ Temporarily disable memory_devices integration test (#7717)
- โก๏ธ Update minimum macOS support from 10.12 to 10.14 (#7707)
- โก๏ธ ci: Update and temporarily disable the macOS Catalina test job (#7700)
- ๐ง cmake: Prevent defining some Linux only targets on other platforms (#7672)
- โก๏ธ libs: Update libxml2 to v2.9.14 (#7729)
- โก๏ธ libs: Update sqlite to version 3.39.2 (#7736)
- โ test: Fix Mdfind.test_sanity flakyness (#7701)