Example #1
0
QueryData EventSubscriberPlugin::get(EventTime start, EventTime stop) {
  QueryData results;

  // Get the records for this time range.
  auto indexes = getIndexes(start, stop);
  auto records = getRecords(indexes);

  std::string events_key = "data." + dbNamespace();
  std::vector<std::string> mapped_records;
  for (const auto& record : records) {
    if (record.second >= start && (record.second <= stop || stop == 0)) {
      mapped_records.push_back(events_key + "." + record.first);
    }
  }

  if (FLAGS_events_optimize && !records.empty()) {
    // If records were returned save the ordered-last as the optimization EID.
    unsigned long int eidr = 0;
    if (safeStrtoul(records.back().first, 10, eidr)) {
      optimize_eid_ = static_cast<size_t>(eidr);
      auto index_key = "optimize_id." + dbNamespace();
      setDatabaseValue(kEvents, index_key, records.back().first);
    }
  }

  // Select mapped_records using event_ids as keys.
  std::string data_value;
  for (const auto& record : mapped_records) {
    Row r;
    auto status = getDatabaseValue(kEvents, record, data_value);
    if (data_value.length() == 0) {
      // There is no record here, interesting error case.
      continue;
    }
    status = deserializeRowJSON(data_value, r);
    data_value.clear();
    if (status.ok()) {
      results.push_back(std::move(r));
    }
  }

  if (getEventsExpiry() > 0) {
    // Set the expire time to NOW - "configured lifetime".
    // Index retrieval will apply the constraints checking and auto-expire.
    expire_time_ = getUnixTime() - getEventsExpiry();
  }

  return results;
}
Example #2
0
Status Distributed::acceptWork(const std::string& work) {
  try {
    pt::ptree tree;
    {
      std::stringstream ss(work);
      pt::read_json(ss, tree);
    }
    std::set<std::string> queries_to_run;
    // Check for and run discovery queries first
    if (tree.count("discovery") > 0) {
      auto& queries = tree.get_child("discovery");

      for (const auto& node : queries) {
        auto query = queries.get<std::string>(node.first, "");
        if (query.empty() || node.first.empty()) {
          return Status(
              1,
              "Distributed discovery query does not have complete attributes");
        }
        SQL sql(query);
        if (!sql.getStatus().ok()) {
          return Status(1, "Distributed discovery query has an SQL error");
        }
        if (sql.rows().size() > 0) {
          queries_to_run.insert(node.first);
        }
      }
    }

    auto& queries = tree.get_child("queries");
    for (const auto& node : queries) {
      auto query = queries.get<std::string>(node.first, "");
      if (query.empty() || node.first.empty()) {
        return Status(1, "Distributed query does not have complete attributes");
      }
      if (queries_to_run.empty() || queries_to_run.count(node.first)) {
        setDatabaseValue(kQueries, kDistributedQueryPrefix + node.first, query);
      }
    }

    if (tree.count("accelerate") > 0) {
      auto new_time = tree.get<std::string>("accelerate", "");
      unsigned long duration;
      Status conversion = safeStrtoul(new_time, 10, duration);
      if (conversion.ok()) {
        LOG(INFO) << "Accelerating distributed query checkins for " << duration
                  << " seconds";
        setDatabaseValue(kPersistentSettings,
                         "distributed_accelerate_checkins_expire",
                         std::to_string(getUnixTime() + duration));
      } else {
        LOG(WARNING) << "Failed to Accelerate: Timeframe is not an integer";
      }
    }

  } catch (const pt::ptree_error& e) {
    return Status(1, "Error parsing JSON: " + std::string(e.what()));
  }

  return Status(0, "OK");
}
Example #3
0
QueryData genSystemInfo(QueryContext& context) {
  Row r;
  r["hostname"] = osquery::getFqdn();
  r["computer_name"] = osquery::getHostname();
  r["local_hostname"] = r["computer_name"];
  getHostUUID(r["uuid"]);

  auto qd = SQL::selectAllFrom("cpuid");
  for (const auto& row : qd) {
    if (row.at("feature") == "product_name") {
      r["cpu_brand"] = row.at("value");
      boost::trim(r["cpu_brand"]);
    }
  }

  WmiRequest wmiSystemReq("select * from Win32_ComputerSystem");
  WmiRequest wmiSystemReqProc("select * from Win32_Processor");
  std::vector<WmiResultItem>& wmiResults = wmiSystemReq.results();
  std::vector<WmiResultItem>& wmiResultsProc = wmiSystemReqProc.results();
  if (!wmiResults.empty() && !wmiResultsProc.empty()) {
    long numProcs = 0;
    wmiResults[0].GetLong("NumberOfLogicalProcessors", numProcs);
    r["cpu_logical_cores"] = INTEGER(numProcs);
    wmiResultsProc[0].GetLong("NumberOfCores", numProcs);
    r["cpu_physical_cores"] = INTEGER(numProcs);
    wmiResults[0].GetString("TotalPhysicalMemory", r["physical_memory"]);
    wmiResults[0].GetString("Manufacturer", r["hardware_vendor"]);
    wmiResults[0].GetString("Model", r["hardware_model"]);
  } else {
    r["cpu_logical_cores"] = "-1";
    r["cpu_physical_cores"] = "-1";
    r["physical_memory"] = "-1";
    r["hardware_vendor"] = "-1";
    r["hardware_model"] = "-1";
  }

  QueryData regResults;
  queryKey(
      "HKEY_LOCAL_MACHINE\\"
      "HARDWARE\\DESCRIPTION\\System\\CentralProcessor\\0\\",
      regResults);
  for (const auto& key : regResults) {
    if (key.at("name") == "Update Revision") {
      if (key.at("data").size() >= 16) {
        unsigned long int revision = 0;
        safeStrtoul(key.at("data").substr(8, 2), 16, revision);
        r["cpu_microcode"] = std::to_string(revision);
      }
      break;
    }
  }

  WmiRequest wmiBiosReq("select * from Win32_Bios");
  std::vector<WmiResultItem>& wmiBiosResults = wmiBiosReq.results();
  if (wmiBiosResults.size() != 0) {
    wmiBiosResults[0].GetString("SerialNumber", r["hardware_serial"]);
  } else {
    r["hardware_serial"] = "-1";
  }

  SYSTEM_INFO systemInfo;
  GetSystemInfo(&systemInfo);
  switch (systemInfo.wProcessorArchitecture) {
  case PROCESSOR_ARCHITECTURE_AMD64:
    r["cpu_type"] = "x86_64";
    break;
  case PROCESSOR_ARCHITECTURE_ARM:
    r["cpu_type"] = "ARM";
    break;
  case PROCESSOR_ARCHITECTURE_IA64:
    r["cpu_type"] = "x64 Itanium";
    break;
  case PROCESSOR_ARCHITECTURE_INTEL:
    r["cpu_type"] = "x86";
    break;
  case PROCESSOR_ARCHITECTURE_UNKNOWN:
    r["cpu_type"] = "Unknown";
  default:
    break;
  }

  r["cpu_subtype"] = "-1";
  r["hardware_version"] = "-1";
  return {r};
}