-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathqueries.yml
76 lines (76 loc) · 2.58 KB
/
queries.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
---
apiVersion: v1
kind: query
spec:
automations_enabled: false
description: ""
discard_data: false
interval: 3600
logging: snapshot
min_osquery_version: ""
name: Crowdstrike Falcon - Health Check - Cloud Connected?
observer_can_run: false
platform: ""
query: SELECT lp.address, lp.pid, lp.port, lp.protocol, p.name, p.path, p.cmdline
FROM listening_ports lp JOIN processes p ON lp.pid = p.pid WHERE p.name LIKE "falcon-sensor";
team: EDR health check
---
apiVersion: v1
kind: query
spec:
automations_enabled: false
description: Check running processes to verify the Falcon sensor is running (linux)
discard_data: false
interval: 3600
logging: snapshot
min_osquery_version: ""
name: Crowdstrike Falcon - Health Check - Kernel Module (linux)?
observer_can_run: false
platform: "linux"
query: SELECT * FROM kernel_modules WHERE name LIKE "%falcon%";
team: EDR health check
---
apiVersion: v1
kind: query
spec:
automations_enabled: false
description: Check running processes to verify the Falcon sensor is running
discard_data: false
interval: 3600
logging: snapshot
min_osquery_version: ""
name: Crowdstrike Falcon - Health Check - Running Process?
observer_can_run: false
platform: ""
query: SELECT * FROM processes WHERE name like "falcon-sensor";
team: EDR health check
---
apiVersion: v1
kind: query
spec:
automations_enabled: false
description: Check running processes to verify the Falcon sensor is running
discard_data: false
interval: 3600
logging: snapshot
min_osquery_version: ""
name: Crowdstrike Falcon - Health Check - Running Process by path (macOS)?
observer_can_run: false
platform: "darwin"
query: SELECT count(*) AS count, path, CASE WHEN path LIKE '/Library/SystemExtensions/%/com.crowdstrike.falcon.Agent.systemextension/Contents/MacOS/com.crowdstrike.falcon.Agent' THEN 'RUNNING' ELSE 'ERROR' END status, 'macOSCrowdStrikeCheckProcess' AS query_type FROM processes WHERE path LIKE '/Library/SystemExtensions/%/com.crowdstrike.falcon.Agent.systemextension/Contents/MacOS/com.crowdstrike.falcon.Agent';
team: EDR health check
---
apiVersion: v1
kind: query
spec:
automations_enabled: false
description: Check running processes to verify the Falcon sensor is running (Windows)
discard_data: false
interval: 3600
logging: snapshot
min_osquery_version: ""
name: Crowdstrike Falcon - Health Check - Running Process (Windows)?
observer_can_run: false
platform: "windows"
query: SELECT services.*, 'WindowsCrowdStrikeCheckProcess' AS query_type FROM services WHERE name LIKE 'CSFalconService';
team: EDR health check