github osquery/osquery 4.9.0

latest releases: 5.12.1, 5.12.0, 5.11.0...
2 years ago

Representing commits from 16 contributors! Thank you all.

Note: The linux .tar.gz includes debugging symbols. This may be larger than you expect

New Features

  • Add filesystem logrotate feature (#7015)
  • Add Non-Functional EndpointSecurity based process events to macOS (Requires updated codesigning due in 5.0) (#7046)

Table Changes

  • Add mdm_managed column to system_extensions on macOS (#6915)
  • Add prefetch table on Windows (#7076)
  • Add support for IMDSv2 to AWS tables (#7084)
  • Enable container stats on docker containers that don't have traditional networks (#7145)
  • Update homebrew_packages to include new prefix, and allow specifying alternate prefixes (#7117)
  • Update ntfs_acl_permissions to list all ACE entries (using GetAce()) (#7114)
  • Update processes table to display additional Windows attributes (secured, protected, virtual, elevated) (#7121)
  • Update how package_install_history identifies the packageIdentifiers key (#7099)
  • Update how identifier is calculated in chrome_extensions (#7124)

Under the Hood improvements

  • Improve speed of osquery shutdown procedure (#7077)
  • Improve shutdown speed during initialization (#7106)
  • Update website generators (#7136)
  • CLI flag to allow osquery to keep retrying enrollment (instead of exiting) (#7125)
  • rocksdb: Do not fsync WAL writes (#7094)
  • Move CPack packaging to a dedicated repository (#7059)
  • Restore thrift socket 5min timeout (#7072)
  • Consolidate syscalls to a single audit rule (#7063)

Bug Fixes

  • Add current WMI location for Dell BIOS info (#7103)
  • Correct RocksDB error code and subcode printing on open failure (#7069)
  • Fix pipe_channel not reading all data in a message (#7139)
  • Fix crash and deadlocks in recursive logging (#7127)
  • Fix custom curl_certificate timeouts (#7151)
  • Fix extensions crash on shutdown (#7075)
  • Handle updated paths on various macOS tables -- xprotect_entries, xprotect_meta, launchd (#7138, #7154)
  • Trigger event cleanup checks every 256 events (#7143)
  • Update generating an extension uuid to be thread safe (#7135)
  • Watchdog should wait for the worker to shutdown (#7116)

Documentation

  • Update process auditing requirements documentation (#7102)
  • Update website docs indicating windows support for YARA tables (#7130)
  • Add 4.9.0 CHANGELOG (#7152)

Build

  • Add Apple provisioning profile for distribution (#7119)
  • Add more tests for events expiration (#7071)
  • CI: Regenerate sccache cache when compiler version changes (#7081)
  • Fix flaky test test_daemon_sigint by waiting for pidfile (#7095)
  • Fix icon in Windows packaging (#7148)
  • Minor cleanup of unused variables (#7128)
  • Print extension SDK minimum version required when failing to load (#7074)
  • Remove POSIX-only -fexceptions flag on Windows (#7126)
  • Remove duplicated osquery_utils_aws_tests-test (#7078)
  • Remove flaky test decorators for python tests (#7070)
  • Update SQLite to version 3.35.5 (#7090)
  • Update librdkafka to version 1.7.0 (#7134)
  • Update libyara to version 4.1.1 (#7133)

Don't miss a new osquery release

NewReleases is sending notifications on new releases.