File tree

• osquery
  • BUCK
  • carver
    • BUCK
    • carver.cpp
    • carver.h
    • tests
      • BUCK
      • carver_tests.cpp
  • config
    • BUCK
    • config.cpp
    • config.h
    • packs.cpp
    • parsers
      • BUCK
      • auto_constructed_tables.cpp
      • auto_constructed_tables.h
      • decorators.cpp
      • decorators.h
      • events_parser.cpp
      • feature_vectors.cpp
      • feature_vectors.h
      • file_paths.cpp
      • kafka_topics.cpp
      • kafka_topics.h
      • logger.cpp
      • logger.h
      • options.cpp
      • prometheus_targets.cpp
      • prometheus_targets.h
      • tests
        • BUCK
        • decorators_tests.cpp
        • events_parser_tests.cpp
        • file_paths_tests.cpp
        • options_tests.cpp
        • views_tests.cpp
      • views.cpp
    • plugins
      • BUCK
      • filesystem_config.cpp
      • tls_config.cpp
      • tls_config.h
    • tests
      • BUCK
      • config_tests.cpp
      • packs.cpp
      • test_utils.cpp
      • test_utils.h
    • update.cpp
  • core
    • BUCK
    • database
      • database.cpp
      • database.h
      • in_memory_database.cpp
      • in_memory_database.h
      • rocksdb_database.cpp
      • rocksdb_database.h
      • rocksdb_migration.cpp
      • rocksdb_migration.h
    • flags.cpp
    • init.cpp
    • plugins
      • BUCK
      • logger.cpp
      • logger.h
      • plugin.cpp
      • plugin.h
      • tests
        • in_memory_database_tests.cpp
        • rocksdb_database_tests.cpp
    • posix
      • initializer.cpp
    • query.cpp
    • sql
      • BUCK
      • column.cpp
      • column.h
      • diff_results.cpp
      • diff_results.h
      • query_data.cpp
      • query_data.h
      • query_performance.cpp
      • query_performance.h
      • row.cpp
      • row.h
      • scheduled_query.cpp
      • scheduled_query.h
      • table_row.h
      • table_rows.cpp
      • table_rows.h
    • system.cpp
    • tables.cpp
    • tests
      • BUCK
      • flags_tests.cpp
      • posix
        • permissions_tests.cpp
      • query_tests.cpp
      • system_test.cpp
      • tables_tests.cpp
      • watcher_tests.cpp
    • watcher.cpp
    • watcher.h
    • windows
      • handle.cpp
      • handle.h
      • initializer.cpp
      • ntapi.h
      • wmi.cpp
      • wmi.h
  • database
    • BUCK
    • benchmarks
      • database_benchmarks.cpp
    • database.cpp
    • plugins
      • BUCK
      • ephemeral.cpp
      • ephemeral.h
      • rocksdb.cpp
      • rocksdb.h
      • sqlite.cpp
      • sqlite.h
      • tests
        • BUCK
        • rocksdb.cpp
        • sqlite.cpp
        • utils.cpp
        • utils.h
    • tests
      • BUCK
      • database.cpp
      • results.cpp
  • devtools
    • BUCK
    • devtools.h
    • printer.cpp
    • tests
      • BUCK
      • printer_tests.cpp
  • dispatcher
    • BUCK
    • dispatcher.cpp
    • distributed_runner.cpp
    • distributed_runner.h
    • scheduler.cpp
    • scheduler.h
    • tests
      • BUCK
      • dispatcher.cpp
      • scheduler.cpp
  • distributed
    • BUCK
    • distributed.cpp
    • plugins
      • BUCK
      • tls_distributed.cpp
    • tests
      • distributed_tests.cpp
  • events
    • BUCK
    • benchmarks
      • events_benchmarks.cpp
    • darwin
      • diskarbitration.cpp
      • diskarbitration.h
      • event_taps.cpp
      • event_taps.h
      • fsevents.cpp
      • fsevents.h
      • iokit.cpp
      • iokit.h
      • openbsm.cpp
      • openbsm.h
      • scnetwork.cpp
      • scnetwork.h
    • events.cpp
    • linux
      • auditdnetlink.cpp
      • auditdnetlink.h
      • auditeventpublisher.cpp
      • auditeventpublisher.h
      • inotify.cpp
      • inotify.h
      • process_events.h
      • process_file_events.h
      • selinux_events.h
      • socket_events.h
      • syslog.cpp
      • syslog.h
      • udev.cpp
      • udev.h
    • pathset.h
    • tests
      • BUCK
      • darwin
        • fsevents_tests.cpp
      • events_database_tests.cpp
      • events_tests.cpp
      • linux
        • audit_tests.cpp
        • inotify_tests.cpp
        • process_file_events_tests.cpp
        • syslog_tests.cpp
    • windows
      • windows_event_log.cpp
      • windows_event_log.h
  • examples
    • example_extension.cpp
    • example_test.cpp
    • example_writable_table.cpp
    • extension_group_example/src
      • example.cpp
      • example.h
  • extensions
    • BUCK
    • extensions.cpp
    • impl_fbthrift.cpp
    • impl_thrift.cpp
    • interface.cpp
    • interface.h
    • tests
      • BUCK
      • extensions.cpp
    • thrift
      • BUCK
  • filesystem
    • BUCK
    • darwin/benchmarks
      • plist_benchmarks.cpp
    • file_compression.cpp
    • fileops.h
    • filesystem.cpp
    • filesystem.h
    • linux
      • mem.cpp
      • proc.cpp
      • proc.h
    • mock_file_structure.cpp
    • mock_file_structure.h
    • posix
      • fileops.cpp
    • tests
      • darwin
        • plist_tests.cpp
      • fileops.cpp
      • filesystem.cpp
    • windows
      • fileops.cpp
  • hashing
    • BUCK
    • hashing.cpp
    • hashing.h
  • include/osquery
    • core.h
    • data_logger.h
    • database.h
    • dispatcher.h
    • distributed.h
    • enroll.h
    • events.h
    • extensions.h
    • flagalias.h
    • flags.h
    • killswitch.h
    • numeric_monitoring.h
    • packs.h
    • query.h
    • registry.h
    • registry_factory.h
    • registry_interface.h
    • sdk.h
    • sql.h
    • system.h
    • tables.h
  • killswitch
    • BUCK
    • killswitch.cpp
    • killswitch_plugin.cpp
    • killswitch_plugin.h
    • killswitch_refreshable_plugin.cpp
    • killswitch_refreshable_plugin.h
    • plugins
      • BUCK
      • killswitch_filesystem.cpp
      • killswitch_filesystem.h
      • killswitch_tls.cpp
      • killswitch_tls.h
      • tests
        • killswitch_filesystem_tests.cpp
    • tests
      • killswitch_tests.cpp
  • logger
    • BUCK
    • benchmarks
      • logger_benchmarks.cpp
    • logger.cpp
    • logger.h
    • plugins
      • BUCK
      • aws_firehose.cpp
      • aws_firehose.h
      • aws_kinesis.cpp
      • aws_kinesis.h
      • aws_log_forwarder.h
      • buffered.cpp
      • buffered.h
      • filesystem_logger.cpp
      • filesystem_logger.h
      • kafka_producer.cpp
      • kafka_producer.h
      • stdout.cpp
      • stdout.h
      • syslog_logger.cpp
      • syslog_logger.h
      • tests
        • aws_kinesis_logger_tests.cpp
        • buffered_tests.cpp
        • filesystem_logger.cpp
        • kafka_producer_tests.cpp
        • syslog_logger_tests.cpp
        • tls_logger_tests.cpp
      • tls_logger.cpp
      • tls_logger.h
      • windows_event_log.cpp
      • windows_event_log.h
    • tests
      • logger.cpp
  • main
    • BUCK
    • benchmarks.cpp
    • empty.cpp
    • fuzz.cpp
    • main.cpp
    • main.h
    • posix
      • main.cpp
    • tests.cpp
    • windows
      • main.cpp
  • numeric_monitoring
    • BUCK
    • numeric_monitoring.cpp
    • plugin_interface.cpp
    • plugin_interface.h
    • plugins
      • BUCK
      • filesystem.cpp
      • filesystem.h
      • tests
        • BUCK
        • filesystem.cpp
    • pre_aggregation_cache.cpp
    • pre_aggregation_cache.h
    • tests
      • BUCK
      • numeric_monitoring.cpp
      • pre_aggregation_cache.cpp
  • process
    • BUCK
    • posix
      • process.cpp
      • process_ops.cpp
    • process.h
    • windows
      • process.cpp
      • process_ops.cpp
      • process_ops.h
  • profiler
    • BUCK
    • posix
      • profiler.cpp
    • profiler.h
    • windows
      • profiler.cpp
  • registry
    • BUCK
    • registry_factory.cpp
    • registry_interface.cpp
    • tests
      • BUCK
      • registry.cpp
  • remote
    • BUCK
    • enroll
      • BUCK
      • enroll.cpp
      • tests
        • enroll_tests.cpp
        • plugins
          • tls_enroll_tests.cpp
      • tls_enroll.cpp
      • tls_enroll.h
    • http_client.cpp
    • http_client.h
    • requests.cpp
    • requests.h
    • serializers
      • BUCK
      • json.cpp
      • json.h
      • tests
        • json_serializers_tests.cpp
    • tests
      • BUCK
      • requests_tests.cpp
      • test_utils.cpp
      • test_utils.h
    • transports
      • BUCK
      • tests
        • tls_transports_tests.cpp
      • tls.cpp
      • tls.h
    • uri.cpp
    • uri.h
    • utility.h
  • sql
    • BUCK
    • benchmarks
      • sql_benchmarks.cpp
    • dynamic_table_row.cpp
    • dynamic_table_row.h
    • sql.cpp
    • sqlite_encoding.cpp
    • sqlite_filesystem.cpp
    • sqlite_hashing.cpp
    • sqlite_math.cpp
    • sqlite_operations.cpp
    • sqlite_string.cpp
    • sqlite_util.cpp
    • sqlite_util.h
    • tests
      • BUCK
      • sql.cpp
      • sqlite_util_tests.cpp
      • virtual_table.cpp
    • virtual_sqlite_table.cpp
    • virtual_table.cpp
    • virtual_table.h
  • tables
    • BUCK
    • applications
      • BUCK
      • atom_packages.cpp
      • browser_chrome.cpp
      • browser_utils.cpp
      • browser_utils.h
      • darwin
        • browser_plugins.cpp
      • posix
        • browser_firefox.cpp
        • browser_opera.cpp
        • carbon_black.cpp
        • docker.cpp
        • prometheus_metrics.cpp
        • prometheus_metrics.h
        • tests
          • BUCK
          • prometheus_metrics_tests.cpp
      • windows
        • carbon_black.cpp
    • cloud
      • BUCK
      • ec2_instance_metadata.cpp
      • ec2_instance_tags.cpp
    • events
      • BUCK
      • darwin
        • disk_events.cpp
        • file_events.cpp
        • hardware_events.cpp
        • openbsm_events.cpp
        • user_interaction_events.cpp
      • event_utils.cpp
      • event_utils.h
      • linux
        • file_events.cpp
        • hardware_events.cpp
        • process_events.cpp
        • process_events.h
        • process_file_events.cpp
        • process_file_events.h
        • selinux_events.cpp
        • selinux_events.h
        • socket_events.cpp
        • socket_events.h
        • syslog_events.cpp
        • user_events.cpp
      • tests
        • BUCK
        • file_events_tests.cpp
        • linux
          • selinux_events_tests.cpp
      • windows
        • powershell_events.cpp
        • windows_events.cpp
    • forensic
      • BUCK
      • carves.cpp
    • lldpd
      • BUCK
      • lldp_neighbors.cpp
    • networking
      • BUCK
      • curl.cpp
      • curl_certificate.cpp
      • darwin
        • interface_ip.cpp
        • routes.cpp
        • wifi.mm
        • wifi_status.mm
        • wifi_survey.mm
        • wifi_utils.h
        • wifi_utils.mm
      • etc_hosts.cpp
      • etc_protocols.cpp
      • etc_services.cpp
      • freebsd
        • interface_ip.cpp
        • process_open_sockets.cpp
        • routes.cpp
      • linux
        • arp_cache.cpp
        • inet_diag.h
        • interface_ip.cpp
        • iptables.cpp
        • iptc_proxy.c
        • iptc_proxy.h
        • process_open_sockets.cpp
        • routes.cpp
      • listening_ports.cpp
      • posix
        • dns_resolvers.cpp
        • interfaces.cpp
        • interfaces.h
        • utils.cpp
        • utils.h
      • tests
        • BUCK
        • darwin
          • wifi_tests.mm
        • linux
          • iptables_tests.cpp
        • networking_tables_tests.cpp
      • windows
        • arp_cache.cpp
        • interfaces.cpp
        • interfaces.h
        • process_open_sockets.cpp
        • routes.cpp
        • win_sockets.h
    • sleuthkit
      • BUCK
      • sleuthkit.cpp
    • smart
      • BUCK
      • tests
        • BUCK
        • smart_drives_tests.cpp
    • system
      • BUCK
      • cpuid.cpp
      • darwin
        • account_policy_data.mm
        • acpi_tables.cpp
        • ad_config.cpp
        • apps.mm
        • asl.cpp
        • asl_utils.cpp
        • asl_utils.h
        • authorizations.mm
        • battery.mm
        • block_devices.cpp
        • certificates.mm
        • cpu_time.cpp
        • crashes.cpp
        • cups_destinations.cpp
        • cups_jobs.cpp
        • disk_encryption.mm
        • event_taps.mm
        • extended_attributes.cpp
        • firewall.cpp
        • firewall.h
        • gatekeeper.cpp
        • homebrew_packages.cpp
        • iokit_registry.cpp
        • kernel_extensions.cpp
        • kernel_info.cpp
        • kernel_panics.cpp
        • keychain.h
        • keychain_acl.cpp
        • keychain_items.cpp
        • keychain_utils.cpp
        • launchd.cpp
        • managed_policies.cpp
        • mdfind.mm
        • mounts.cpp
        • nvram.cpp
        • os_version.cpp
        • packages.h
        • packages.mm
        • pci_devices.cpp
        • preferences.cpp
        • process_open_descriptors.cpp
        • processes.cpp
        • quicklook_cache.cpp
        • running_apps.mm
        • sandboxes.cpp
        • shared_folders.mm
        • sharing_preferences.cpp
        • signature.mm
        • sip_config.cpp
        • smbios_tables.cpp
        • smbios_utils.h
        • smc_keys.cpp
        • startup_items.cpp
        • sysctl_utils.cpp
        • system_info.cpp
        • time_machine.cpp
        • usb_devices.cpp
        • user_groups.mm
        • virtual_memory_info.cpp
        • xprotect.cpp
      • efi_misc.h
      • freebsd
        • fbsd_kmods.cpp
        • groups.cpp
        • mounts.cpp
        • os_version.cpp
        • pkg_packages.cpp
        • process_open_files.cpp
        • processes.cpp
        • procstat.cpp
        • procstat.h
        • sysctl_utils.cpp
        • users.cpp
      • freenux
        • cpu_time.cpp
      • hash.cpp
      • intel_me.hpp
      • linux
        • acpi_tables.cpp
        • block_devices.cpp
        • deb_packages.cpp
        • disk_encryption.cpp
        • elf_info.cpp
        • groups.cpp
        • intel_me.cpp
        • kernel_info.cpp
        • kernel_modules.cpp
        • md_tables.cpp
        • md_tables.h
        • memory_info.cpp
        • memory_map.cpp
        • model_specific_register.cpp
        • mounts.cpp
        • npm_packages.cpp
        • os_version.cpp
        • pci_devices.cpp
        • pci_devices.h
        • portage.cpp
        • process_open_files.cpp
        • processes.cpp
        • rpm_packages.cpp
        • shadow.cpp
        • shared_memory.cpp
        • smbios_tables.cpp
        • smbios_utils.h
        • sysctl_utils.cpp
        • system_info.cpp
        • usb_devices.cpp
        • user_groups.cpp
        • users.cpp
      • posix
        • apt_sources.cpp
        • augeas.cpp
        • authorized_keys.cpp
        • crontab.cpp
        • known_hosts.cpp
        • known_hosts.h
        • last.cpp
        • load_average.cpp
        • logged_in_users.cpp
        • magic.cpp
        • shell_history.cpp
        • shell_history.h
        • smbios_utils.cpp
        • ssh_configs.cpp
        • ssh_keys.cpp
        • sudoers.cpp
        • sudoers.h
        • suid_bin.cpp
        • sysctl_utils.h
        • system_controls.cpp
        • ulimit_info.cpp
        • yum_sources.cpp
      • python_packages.cpp
      • smbios_utils.h
      • system_utils.cpp
      • system_utils.h
      • tests
        • BUCK
        • darwin
          • apps_tests.cpp
          • asl_tests.cpp
          • certificates_tests.cpp
          • extended_attributes_tests.cpp
          • firewall_tests.cpp
          • launchd_tests.cpp
          • mdfind_tests.cpp
          • processes_tests.cpp
          • signature_tests.mm
          • smc_tests.cpp
          • startup_items_tests.cpp
        • linux
          • md_tables_tests.cpp
          • pci_devices_tests.cpp
          • portage_tests.cpp
          • users_tests.cpp
        • posix
          • known_hosts_tests.cpp
          • shell_history_tests.cpp
          • sudoers_tests.cpp
          • yum_sources_tests.cpp
        • system_tables_tests.cpp
      • uptime.cpp
      • user_groups.h
      • windows
        • appcompat_shims.cpp
        • authenticode.cpp
        • autoexec.cpp
        • bitlocker_info.cpp
        • certificates.cpp
        • chocolatey_packages.cpp
        • cpu_info.cpp
        • disk_info.cpp
        • drivers.cpp
        • groups.cpp
        • ie_extensions.cpp
        • intel_me.cpp
        • kernel_info.cpp
        • kva_speculative_info.cpp
        • logged_in_users.cpp
        • logical_drives.cpp
        • logon_sessions.cpp
        • ntdomains.cpp
        • ntfs_acl_permissions.cpp
        • objects.cpp
        • os_version.cpp
        • patches.cpp
        • physical_disk_performance.cpp
        • pipes.cpp
        • processes.cpp
        • programs.cpp
        • registry.cpp
        • registry.h
        • scheduled_tasks.cpp
        • services.cpp
        • shared_resources.cpp
        • smbios_tables.cpp
        • startup_items.cpp
        • system_info.cpp
        • user_groups.cpp
        • users.cpp
        • video_info.cpp
        • wmi_bios_info.cpp
        • wmi_cli_event_consumers.cpp
        • wmi_event_filters.cpp
        • wmi_filter_consumer_binding.cpp
        • wmi_script_event_consumers.cpp
    • utility
      • BUCK
      • file.cpp
      • osquery.cpp
      • time.cpp
    • yara
      • BUCK
      • tests
        • BUCK
        • yara_tests.cpp
        • yara_tests_win_empty.cpp
      • yara.cpp
      • yara_events.cpp
      • yara_utils.cpp
      • yara_utils.h
  • utils
    • BUCK
    • attribute.h
    • aws
      • BUCK
      • aws_util.cpp
      • aws_util.h
      • tests
        • aws_util_tests.cpp
    • base64.cpp
    • base64.h
    • chars.cpp
    • chars.h
    • config
      • BUCK
      • default_paths.cpp
      • default_paths.h
    • conversions
      • BUCK
      • darwin
        • cfdata.cpp
        • cfdata.h
        • cfnumber.cpp
        • cfnumber.h
        • cfstring.cpp
        • cfstring.h
        • cftime.cpp
        • cftime.h
        • iokit.cpp
        • iokit.h
        • tests
          • cfstring.cpp
      • join.h
      • split.cpp
      • split.h
      • tests
        • join.cpp
        • split.cpp
        • tryto.cpp
      • tryto.cpp
      • tryto.h
      • windows
        • strings.cpp
        • strings.h
    • darwin
      • plist.h
      • plist.mm
    • debug
      • BUCK
      • debug_only.h
      • tests
        • debug_only.cpp
    • error
      • BUCK
      • error.h
      • tests
        • error.cpp
    • expected
      • BUCK
      • expected.h
      • tests
        • expected.cpp
    • info
      • BUCK
      • platform_type.cpp
      • platform_type.h
      • tool_type.cpp
      • tool_type.h
      • version.cpp
      • version.h
    • json
      • BUCK
      • json.cpp
      • json.h
      • tests
        • json.cpp
    • macros
      • BUCK
      • macros.h
    • mutex.h
    • only_movable.cpp
    • only_movable.h
    • status
      • BUCK
      • status.cpp
      • status.h
      • tests
        • status.cpp
    • system
      • BUCK
      • env.h
      • errno.h
      • filepath.h
      • linux
        • ebpf
          • BUCK
          • ebpf.cpp
          • ebpf.h
          • map.cpp
          • map.h
          • program.cpp
          • program.h
          • tests
            • BUCK
            • ebpf.cpp
            • empty.cpp
            • map.cpp
            • program.cpp
        • tracing
          • BUCK
          • native_event.cpp
          • native_event.h
          • tests
            • BUCK
            • empty.cpp
            • native_event.cpp
          • types.h
      • posix
        • env.cpp
        • errno.cpp
        • filepath.cpp
        • system.cpp
        • system.h
        • time.cpp
      • tests
        • cpu.cpp
        • time.cpp
      • time.cpp
      • time.h
      • uptime.cpp
      • uptime.h
      • windows
        • env.cpp
        • errno.cpp
        • system.cpp
        • system.h
        • time.cpp
    • tests
      • base64.cpp
      • chars.cpp
    • versioning
      • BUCK
      • semantic.cpp
      • semantic.h
      • tests
        • BUCK
        • semantic.cpp
• specs
  • BUCK
• tests
  • BUCK
  • integration/tables
    • BUCK
    • account_policy_data.cpp
    • acpi_tables.cpp
    • ad_config.cpp
    • alf.cpp
    • alf_exceptions.cpp
    • alf_explicit_auths.cpp
    • alf_services.cpp
    • app_schemes.cpp
    • appcompat_shims.cpp
    • apps.cpp
    • apt_sources.cpp
    • arp_cache.cpp
    • asl.cpp
    • atom_packages.cpp
    • augeas.cpp
    • authenticode.cpp
    • authorization_mechanisms.cpp
    • authorizations.cpp
    • authorized_keys.cpp
    • autoexec.cpp
    • battery.cpp
    • bitlocker_info.cpp
    • block_devices.cpp
    • browser_plugins.cpp
    • carbon_black_info.cpp
    • carves.cpp
    • certificates.cpp
    • chocolatey_packages.cpp
    • chrome_extensions.cpp
    • cpu_info.cpp
    • cpu_time.cpp
    • cpuid.cpp
    • crashes.cpp
    • crontab.cpp
    • cups_destinations.cpp
    • cups_jobs.cpp
    • curl.cpp
    • curl_certificate.cpp
    • deb_packages.cpp
    • device_file.cpp
    • device_firmware.cpp
    • device_hash.cpp
    • device_partitions.cpp
    • disk_encryption.cpp
    • disk_events.cpp
    • disk_info.cpp
    • dns_resolvers.cpp
    • docker_container_labels.cpp
    • docker_container_mounts.cpp
    • docker_container_networks.cpp
    • docker_container_ports.cpp
    • docker_container_processes.cpp
    • docker_container_stats.cpp
    • docker_containers.cpp
    • docker_image_labels.cpp
    • docker_images.cpp
    • docker_info.cpp
    • docker_network_labels.cpp
    • docker_networks.cpp
    • docker_version.cpp
    • docker_volume_labels.cpp
    • docker_volumes.cpp
    • drivers.cpp
    • ec2_instance_metadata.cpp
    • ec2_instance_tags.cpp
    • elf_dynamic.cpp
    • elf_info.cpp
    • elf_sections.cpp
    • elf_segments.cpp
    • elf_symbols.cpp
    • etc_hosts.cpp
    • etc_protocols.cpp
    • etc_services.cpp
    • event_taps.cpp
    • example.cpp
    • extended_attributes.cpp
    • fan_speed_sensors.cpp
    • fbsd_kmods.cpp
    • file.cpp
    • file_events.cpp
    • firefox_addons.cpp
    • gatekeeper.cpp
    • gatekeeper_approved_apps.cpp
    • groups.cpp
    • hardware_events.cpp
    • hash.cpp
    • helper.cpp
    • helper.h
    • homebrew_packages.cpp
    • ie_extensions.cpp
    • intel_me_info.cpp
    • interface_addresses.cpp
    • interface_details.cpp
    • interface_ipv6.cpp
    • iokit_devicetree.cpp
    • iokit_registry.cpp
    • iptables.cpp
    • kernel_extensions.cpp
    • kernel_info.cpp
    • kernel_integrity.cpp
    • kernel_modules.cpp
    • kernel_panics.cpp
    • keychain_acls.cpp
    • keychain_items.cpp
    • known_hosts.cpp
    • kva_speculative_info.cpp
    • last.cpp
    • launchd.cpp
    • launchd_overrides.cpp
    • listening_ports.cpp
    • lldp_neighbors.cpp
    • load_average.cpp
    • logged_in_users.cpp
    • logical_drives.cpp
    • logon_sessions.cpp
    • magic.cpp
    • managed_policies.cpp
    • md_devices.cpp
    • md_drives.cpp
    • md_personalities.cpp
    • mdfind.cpp
    • memory_array_mapped_addresses.cpp
    • memory_arrays.cpp
    • memory_device_mapped_addresses.cpp
    • memory_devices.cpp
    • memory_error_info.cpp
    • memory_info.cpp
    • memory_map.cpp
    • mounts.cpp
    • msr.cpp
    • nfs_shares.cpp
    • npm_packages.cpp
    • ntdomains.cpp
    • ntfs_acl_permissions.cpp
    • nvram.cpp
    • oem_strings.cpp
    • opera_extensions.cpp
    • os_version.cpp
    • osquery_events.cpp
    • osquery_extensions.cpp
    • osquery_flags.cpp
    • osquery_info.cpp
    • osquery_packs.cpp
    • osquery_registry.cpp
    • osquery_schedule.cpp
    • package_bom.cpp
    • package_install_history.cpp
    • package_receipts.cpp
    • patches.cpp
    • pci_devices.cpp
    • physical_disk_performance.cpp
    • pipes.cpp
    • pkg_packages.cpp
    • platform_info.cpp
    • plist.cpp
    • portage_keywords.cpp
    • portage_packages.cpp
    • portage_use.cpp
    • power_sensors.cpp
    • powershell_events.cpp
    • preferences.cpp
    • process_envs.cpp
    • process_events.cpp
    • process_file_events.cpp
    • process_memory_map.cpp
    • process_namespaces.cpp
    • process_open_files.cpp
    • process_open_sockets.cpp
    • processes.cpp
    • programs.cpp
    • prometheus_metrics.cpp
    • python_packages.cpp
    • quicklook_cache.cpp
    • registry.cpp
    • routes.cpp
    • rpm_package_files.cpp
    • rpm_packages.cpp
    • running_apps.cpp
    • safari_extensions.cpp
    • sandboxes.cpp
    • scheduled_tasks.cpp
    • selinux_events.cpp
    • services.cpp
    • shadow.cpp
    • shared_folders.cpp
    • shared_memory.cpp
    • shared_resources.cpp
    • sharing_preferences.cpp
    • shell_history.cpp
    • signature.cpp
    • sip_config.cpp
    • smart_drive_info.cpp
    • smbios_tables.cpp
    • smc_keys.cpp
    • socket_events.cpp
    • ssh_configs.cpp
    • startup_items.cpp
    • sudoers.cpp
    • suid_bin.cpp
    • syslog_events.cpp
    • system_controls.cpp
    • system_info.cpp
    • temperature_sensors.cpp
    • time.cpp
    • time_machine_backups.cpp
    • time_machine_destinations.cpp
    • ulimit_info.cpp
    • uptime.cpp
    • usb_devices.cpp
    • user_events.cpp
    • user_groups.cpp
    • user_interaction_events.cpp
    • user_ssh_keys.cpp
    • users.cpp
    • video_info.cpp
    • virtual_memory_info.cpp
    • wifi_networks.cpp
    • wifi_status.cpp
    • wifi_survey.cpp
    • winbaseobj.cpp
    • windows_crashes.cpp
    • windows_events.cpp
    • wmi_bios_info.cpp
    • wmi_cli_event_consumers.cpp
    • wmi_event_filters.cpp
    • wmi_filter_consumer_binding.cpp
    • wmi_script_event_consumers.cpp
    • xprotect_entries.cpp
    • xprotect_meta.cpp
    • xprotect_reports.cpp
    • yara.cpp
    • yara_events.cpp
    • yum_sources.cpp
  • test_util.cpp
  • test_util.h
  • unit
    • config/plugins
      • tls_config_tests.cpp
    • core
      • process_tests.cpp
    • events/windows
      • windows_event_log_tests.cpp
    • tables/system
      • posix
        • augeas_tests.cpp
      • windows
        • registry_tests.cpp
• tools
  • analysis
    • fuzz.py
    • profile.py
    • stress.py
    • system_stress.py
  • audit.sh
  • benchmark.sh
  • build.ps1
  • build.sh
  • codegen
    • BUCK
    • amalgamate.py
    • genapi.py
    • gentable.py
    • genwebsitejson.py
    • genwebsitemetadata.py
    • substitute.py
    • templates
      • amalgamation.cpp.in
      • blacklist.cpp.in
      • default.cpp.in
      • foreign.cpp.in
      • osquery_extension_group_main.cpp.in
      • typed_row.h.in
  • deployment
    • chocolatey/tools
      • chocolateyBeforeModify.ps1
      • chocolateyinstall.ps1
      • chocolateyuninstall.ps1
    • getfiles.py
    • make_linux_package.sh
    • make_osx_package.sh
    • make_windows_package.ps1
    • osqueryctl
  • formatting
    • format-check.py
  • get_platform.py
  • lib.sh
  • manage-osqueryd.ps1
  • provision.ps1
  • provision.sh
  • provision
    • amazon.sh
    • arch.sh
    • centos.sh
    • chocolatey
      • aws-sdk-cpp.ps1
      • boost-msvc14.ps1
      • gflags-dev.ps1
      • glog.ps1
      • llvm-clang.ps1
      • openssl.ps1
      • osquery_utils.ps1
      • rapidjson.ps1
      • rocksdb.ps1
      • thrift-dev.ps1
      • zstd.ps1
    • darwin.sh
    • debian.sh
    • fedora.sh
    • freebsd.sh
    • lib.sh
    • manjaro.sh
    • oracle.sh
    • rhel.sh
    • scientific.sh
    • suse.sh
    • ubuntu.sh
  • release
    • build_release.sh
    • commit_schema.sh
    • deps_release.sh
    • new_release.sh
    • sign_release.sh
  • sync.sh
  • tests
    • BUCK
    • plist_benchmark.cpp
    • test.cpp
    • test_additional.py
    • test_base.py
    • test_example_queries.py
    • test_extensions.py
    • test_http_server.py
    • test_osqueryd.py
    • test_osqueryi.py
    • test_release.py
    • test_windows_service.py
    • utils.py
    • winexpect.py