class DistributedQueryProbeMachineManager(models.Manager):
distributed_query_probes = all_probes.model_filter(
"OsqueryDistributedQueryProbe", "OsqueryFileCarveProbe")
def new_queries_for_machine(self, machine):
queries = {}
seen_probe_id = {
dqpm.probe_source_id
for dqpm in self.filter(
machine_serial_number=machine.serial_number)
}
def not_seen_probe_filter(probe):
return probe.pk not in seen_probe_id
min_age = timezone.now() - MAX_DISTRIBUTED_QUERY_AGE
def recent_probe_filter(probe):
return probe.created_at > min_age
# TODO: slow
# could filter the probes that are too old in the db
probe_list = (self.distributed_query_probes.machine_filtered(
machine).filter(not_seen_probe_filter).filter(recent_probe_filter))
for probe in probe_list:
dqpm, created = self.get_or_create(
probe_source_id=probe.pk,
machine_serial_number=machine.serial_number)
if created:
queries[probe.distributed_query_name] = probe.distributed_query
return queries
def test_all_probes(self):
probes = list(all_probes.model_filter("OsqueryProbe"))
self.assertEqual(len(probes), 3)
def test_all_probes(self):
santa_probes = list(all_probes.model_filter("SantaProbe"))
self.assertEqual(len(santa_probes), 3)
from zentral.core.probes.conf import all_probes
santa_probes = all_probes.model_filter("SantaProbe")
def build_santa_conf(machine):
"""
Build the santa conf.
The santa conf is the source of the json document that is sent to the santa
client when it connects to zentral. It is a list of all the rules found in
all the configured probes for that client.
"""
rules = []
for probe in santa_probes.machine_filtered(machine):
# TODO test duplicated rules
rules.extend(r.to_configuration() for r in probe.rules)
return {'rules': rules}
def test_all_probes(self):
santa_probes = list(all_probes.model_filter("SantaProbe"))
self.assertEqual(len(santa_probes), 3)
"bundle_version, bundle_short_version as bundle_version_str, "
"path as bundle_path "
"from apps;")
DECORATORS = {
"load": [
"SELECT computer_name FROM system_info",
"SELECT hostname FROM system_info",
"SELECT hardware_model FROM system_info",
"SELECT hardware_serial FROM system_info",
"SELECT uuid AS host_uuid FROM system_info",
"SELECT name AS os_name FROM os_version"
]
}
osquery_query_probes = all_probes.model_filter("OsqueryProbe",
"OsqueryComplianceProbe",
"OsqueryFIMProbe")
def get_inventory_queries_for_machine(machine):
yield from INVENTORY_QUERIES
if machine.platform == MACOS:
yield "apps", OSX_APP_INSTANCE_QUERY
elif machine.has_deb_packages:
yield "deb_packages", DEB_PACKAGE_QUERY
def get_inventory_query_for_machine(machine):
return "".join(q for _, q in get_inventory_queries_for_machine(machine))
