-
-
Notifications
You must be signed in to change notification settings - Fork 2.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Support for Background Activity Moderator #6585
Support for Background Activity Moderator #6585
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Just a few recommendations and nitpicks then this looks good to go.
osquery/tables/system/windows/background_activities_moderator.cpp
Outdated
Show resolved
Hide resolved
osquery/tables/system/windows/background_activities_moderator.cpp
Outdated
Show resolved
Hide resolved
@theopolis and @directionless thanks for the feedback and review |
osquery/tables/system/windows/background_activities_moderator.cpp
Outdated
Show resolved
Hide resolved
Co-authored-by: seph <seph@kolide.co>
…ycid/osquery into background_activity_manager
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If builds pass this looks good to merge.
…0 to master * commit 'ab092654b8b027e35a91ef19feb74f9eeec0fc2b': (98 commits) osquery-4.5.0: merge updates and fix conflicts osquery-4.5.0: merge updates and fix conflicts Add 4.5.0 CHANGELOG (osquery#6646) Add sigurl column to pass yara signatures with the queries (osquery#6607) Update process auditing docs schema link (osquery#6645) Support for Background Activity Moderator (osquery#6585) database: Remove read only concept (osquery#6637) Parsing of user data in Windows event log (osquery#6643) events: Remove selectAllFrom from linux process events callback (osquery#6638) libs: Set glog and gflags includes as SYSTEM (osquery#6635) tests: Fix flaky test_2_daemon_with_option (osquery#6634) tests: Improve the reliability of TLSServerRunner (osquery#6632) database: Move initialization retry logic into DB API (osquery#6633) libs/smartmontools: Add aarch64 support libs/lzma: Add aarch64 support libs/lldpd: Add aarch64 support libs/librdkafka: Add aarch64 support libs/libgpg-error: Add aarch64 support libs/libgcrypt: Add aarch64 support libs/libdpkg: Add aarch64 support ...
This PR adds a Background Activity Moderator (BAM) table to osquery for Windows systems.
#5831 is the initial PR for this table.
All comments should be addressed.
In addition, this PR also reorganizes the ROT13 and little endian FILTETIME to UNIX epoch functions in userassist.h to proper locations/files.
Let me know if there are any issues or additional fixes are needed