Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update query packs to not use deprecated fields #163

Merged
merged 4 commits into from
Sep 18, 2024
Merged

Update query packs to not use deprecated fields #163

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
0619990
Update query packs to not use deprecated fields
tas50 Sep 10, 2024
7600fdc
Update from `query` to `mql`
tas50 Sep 11, 2024
47f6404
Remove the reference to the removed check
tas50 Sep 17, 2024
ee9af28
Update spellcheck config
tas50 Sep 17, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 42 additions & 16 deletions .github/actions/spelling/line_forbidden.patterns
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,31 +12,31 @@
#

# s.b. Allow list
\s[Ww]hitelist\b
\s[Ww]hitelisting\b
\s[Ww]hitelisted\b
\s[Ww]hite list\b
\s[Ww]hite listing\b
\s[Ww]hite listed\b
\b[Ww]hitelist\b
\b[Ww]hitelisting\b
\b[Ww]hitelisted\b
\b[Ww]hite list\b
\b[Ww]hite listing\b
\b[Ww]hite listed\b

# s.b. Block list
\s[Bb]lacklist\b
\s[Bb]lacklisting\b
\s[Bb]lacklisted\b
\s[Bb]lack list\b
\s[Bb]lack listing\b
\s[Bb]lack listed\b
\b[Bb]lacklist\b
\b[Bb]lacklisting\b
\b[Bb]lacklisted\b
\b[Bb]lack list\b
\b[Bb]lack listing\b
\b[Bb]lack listed\b

#
# Our Terms
#

# s.b. Mondoo Platform
\sthe Mondoo Platform\b
\sMondoo platform\b
\bthe Mondoo Platform\b
\bMondoo platform\b

# s.b. Compliance Hub
\s[Cc]ompliance hub\b
\b[Cc]ompliance hub\b

#
# Compliance Terms
Expand All @@ -45,6 +45,9 @@
# s.b. SOC 2
\bSOC2\b

# s.b. NIS2
\bNIS 2\b

# s.b. ISO 270001
\bISO270001\b

Expand All @@ -65,6 +68,7 @@

# s.b. Docker Hub
\bDocker[Hh]ub\b
\bdocker hub\b

# s.b. REST API
\b[Rr]est API\b
Expand All @@ -86,6 +90,9 @@
# Product Names
#

# s.b. Memcached
\bMemCached\b

# s.b. Jira
\bJIRA\b

Expand Down Expand Up @@ -289,6 +296,13 @@
\bLinked In\b
\bLinkedin\b

# s.b. Microsoft IIS
\bIIS Server\b

# s.b. Microsoft SQL Server
\bSQL server\b
\bMSSQL\b

#
# VMware Products
#
Expand Down Expand Up @@ -458,7 +472,7 @@
\bWorkmail\b

#
# GCP Products
# Google Cloud Products
#

# s.b. AlloyDB
Expand All @@ -469,9 +483,11 @@

# s.b. BigLake
\bBig Lake\b
\bBiglake\b

# s.b. BigQuery
\bBig Query\b
\bBigquery\b

# s.b. Cloud Build
\bCloudBuild\b
Expand Down Expand Up @@ -530,6 +546,16 @@
\bVMware engine\b
\bVMWare Engine\b

# s.b. Bigtable
\bBigTable\b
\bBig Table\b

# s.b. Datastore
\bDataStore\b

# s.b. Memorystore
\bMemoryStore\b

#
# Azure Products
#
Expand Down
4 changes: 2 additions & 2 deletions core/mondoo-aws-inventory.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -220,7 +220,7 @@ queries:
filters: |
asset.platform == "aws"
mql: |
aws.rds.dbClusters
aws.rds.clusters



Expand All @@ -233,7 +233,7 @@ queries:
filters: |
asset.platform == "aws"
mql: |
aws.rds.dbInstances
aws.rds.instances
- uid: mondoo-asset-inventory-aws-rds-dbinstances-all-data-single
filters: |
asset.platform == "aws-rds-dbinstance"
Expand Down
6 changes: 3 additions & 3 deletions core/mondoo-linux-inventory.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ packs:
mondoo.com/category: best-practices
docs:
desc: |
The Linux Inventory Pack by Mondoo retrieves data about Linux hosts for asset inventory.
The Linux Inventory Pack by Mondoo retrieves data about Linux hosts for asset inventory.

## Local scan
To run this pack locally on a Linux host:
Expand All @@ -31,7 +31,7 @@ packs:
```

## Join the community!
Our goal is to build query packs that are simple to deploy and provide accurate and useful data.
Our goal is to build query packs that are simple to deploy and provide accurate and useful data.

If you have any suggestions for improving this query pack, or if you need support, [join the Mondoo community](https://github.com/orgs/mondoohq/discussions) in GitHub Discussions.
filters:
Expand Down Expand Up @@ -78,7 +78,7 @@ packs:
- uid: mondoo-linux-active-connections
title: Active network connections
filters: mondoo.capabilities.contains("run-command")
query: ports.where(state != "close") { user state port address protocol process remoteAddress remotePort }
mql: ports.where(state != "close") { user state port address protocol process remoteAddress remotePort }
- uid: mondoo-linux-uptime
title: Operating system uptime
filters: mondoo.capabilities.contains("run-command")
Expand Down
2 changes: 1 addition & 1 deletion core/mondoo-macos-inventory.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ packs:
- uid: mondoo-macos-active-connections
title: Active network connections
filters: mondoo.capabilities.contains("run-command")
query: ports.where(state != "close") { user state port address protocol process remoteAddress remotePort }
mql: ports.where(state != "close") { user state port address protocol process remoteAddress remotePort }
- uid: mondoo-macos-interface-configuration
title: Network interface configuration
filters: mondoo.capabilities.contains("run-command")
Expand Down
2 changes: 1 addition & 1 deletion core/mondoo-windows-inventory.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,7 +74,7 @@ packs:
- uid: mondoo-windows-active-connections
title: Active connections of the system
filters: mondoo.capabilities.contains("run-command")
query: ports.where(state != "close") { user state port address protocol process remoteAddress remotePort }
mql: ports.where(state != "close") { user state port address protocol process remoteAddress remotePort }
- uid: mondoo-windows-interface-configuration
title: Network interfaces
mql: windows.computerInfo['CsNetworkAdapters']
Expand Down
9 changes: 2 additions & 7 deletions extra/mondoo-asset-count.mql.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,6 @@ packs:
- uid: mondoo-asset-count-aws-efs-filesystems
- uid: mondoo-asset-count-aws-eks-clusters
- uid: mondoo-asset-count-aws-elasticache-cache-clusters
- uid: mondoo-asset-count-aws-elasticache-clusters
- uid: mondoo-asset-count-aws-elb-application
- uid: mondoo-asset-count-aws-elb-classic
- uid: mondoo-asset-count-aws-emr-clusters
Expand Down Expand Up @@ -302,7 +301,7 @@ queries:

- uid: mondoo-asset-count-aws-rds-dbclusters
title: AWS RDS Database Clusters
mql: aws.rds.dbClusters.length
mql: aws.rds.clusters.length

- uid: mondoo-asset-count-aws-cloudtrails
title: AWS CloudTrails
Expand Down Expand Up @@ -332,10 +331,6 @@ queries:
title: AWS EFS Filesystems
mql: aws.efs.filesystems.length

- uid: mondoo-asset-count-aws-elasticache-clusters
title: AWS ElastiCache Clusters
mql: aws.elasticache.clusters.length

- uid: mondoo-asset-count-aws-elasticache-cache-clusters
title: AWS ElastiCache Cache Clusters
mql: aws.elasticache.cacheClusters.length
Expand Down Expand Up @@ -479,4 +474,4 @@ queries:

- uid: mondoo-asset-count-k8s-pods
title: K8s PODs count
mql: k8s.pods.length
mql: k8s.pods.length
Loading