diff --git a/packages/osquery_manager/changelog.yml b/packages/osquery_manager/changelog.yml index 1c43c7fffb9..85efa174c98 100644 --- a/packages/osquery_manager/changelog.yml +++ b/packages/osquery_manager/changelog.yml @@ -1,4 +1,12 @@ # newer versions go on top +- version: "1.30.1" + changes: + - description: Add `pack_name` and `query_name` fields to the result and action_responses data streams for scheduled pack queries. + type: bugfix + link: https://github.com/elastic/integrations/pull/20017 + - description: Update legacy pack dashboards and saved searches to also match scheduled queries by `pack_name` and `query_name` instead of `action_id` only. + type: bugfix + link: https://github.com/elastic/integrations/pull/20017 - version: "1.30.0" changes: - description: Add Process_open_handles query and pack diff --git a/packages/osquery_manager/data_stream/action_responses/fields/action-responses.yml b/packages/osquery_manager/data_stream/action_responses/fields/action-responses.yml index c6f2a53be83..e91f46747ee 100644 --- a/packages/osquery_manager/data_stream/action_responses/fields/action-responses.yml +++ b/packages/osquery_manager/data_stream/action_responses/fields/action-responses.yml @@ -32,6 +32,14 @@ type: keyword ignore_above: 1024 description: Pack identifier for scheduled queries that belong to a pack. +- name: pack_name + type: keyword + ignore_above: 1024 + description: Human-readable pack name for scheduled queries that belong to a pack. +- name: query_name + type: keyword + ignore_above: 1024 + description: Query name (the pack's queries config map key) for scheduled queries that belong to a pack. - name: response_id type: keyword ignore_above: 1024 diff --git a/packages/osquery_manager/data_stream/result/fields/primary-fields.yml b/packages/osquery_manager/data_stream/result/fields/primary-fields.yml index 6a20ed96834..0ccf90f9883 100644 --- a/packages/osquery_manager/data_stream/result/fields/primary-fields.yml +++ b/packages/osquery_manager/data_stream/result/fields/primary-fields.yml @@ -7,6 +7,12 @@ - name: pack_id type: keyword description: Pack identifier for scheduled queries that belong to a pack. +- name: pack_name + type: keyword + description: Human-readable pack name for scheduled queries that belong to a pack. +- name: query_name + type: keyword + description: Query name (the pack's queries config map key) for scheduled queries that belong to a pack. - name: response_id type: keyword description: Query response id. Present only for scheduled queries. diff --git a/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json index d22949c150e..07c1420f291 100644 --- a/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/dashboard/osquery_manager-69f5ae20-eb02-11e7-8f04-51231daa5b05.json @@ -428,20 +428,40 @@ }, { "meta": { - "alias": null, + "alias": "it-compliance / mounts", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_it-compliance_mounts" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_it-compliance_mounts\"}},{\"bool\":{\"filter\":[{\"match_phrase\":{\"pack_name\":\"it-compliance\"}},{\"match_phrase\":{\"query_name\":\"mounts\"}}]}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_it-compliance_mounts" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_it-compliance_mounts" + } + }, + { + "bool": { + "filter": [ + { + "match_phrase": { + "pack_name": "it-compliance" + } + }, + { + "match_phrase": { + "query_name": "mounts" + } + } + ] + } + } + ] } } } @@ -656,20 +676,40 @@ }, { "meta": { - "alias": null, + "alias": "it-compliance / kernel_integrations", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_it-compliance_kernel_integrations" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_it-compliance_kernel_integrations\"}},{\"bool\":{\"filter\":[{\"match_phrase\":{\"pack_name\":\"it-compliance\"}},{\"match_phrase\":{\"query_name\":\"kernel_integrations\"}}]}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_it-compliance_kernel_integrations" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_it-compliance_kernel_integrations" + } + }, + { + "bool": { + "filter": [ + { + "match_phrase": { + "pack_name": "it-compliance" + } + }, + { + "match_phrase": { + "query_name": "kernel_integrations" + } + } + ] + } + } + ] } } } diff --git a/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json b/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json index 6473471b675..ec542584d8e 100644 --- a/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json +++ b/packages/osquery_manager/kibana/dashboard/osquery_manager-c0a7ce90-f4aa-11e7-8647-534bb4c21040.json @@ -229,20 +229,29 @@ }, { "meta": { - "alias": null, + "alias": "ossec-rootkit", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_ossec-rootkit" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_ossec-rootkit\"}},{\"match_phrase\":{\"pack_name\":\"ossec-rootkit\"}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_ossec-rootkit" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_ossec-rootkit" + } + }, + { + "match_phrase": { + "pack_name": "ossec-rootkit" + } + } + ] } } } @@ -405,20 +414,29 @@ }, { "meta": { - "alias": null, + "alias": "ossec-rootkit", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_ossec-rootkit" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_ossec-rootkit\"}},{\"match_phrase\":{\"pack_name\":\"ossec-rootkit\"}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_ossec-rootkit" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_ossec-rootkit" + } + }, + { + "match_phrase": { + "pack_name": "ossec-rootkit" + } + } + ] } } } diff --git a/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json b/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json index 972b8d13ee8..fba7d39a2ba 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-0fe5dc00-f49b-11e7-8647-534bb4c21040.json @@ -44,20 +44,29 @@ }, { "meta": { - "alias": null, + "alias": "ossec-rootkit", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_ossec-rootkit" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_ossec-rootkit\"}},{\"match_phrase\":{\"pack_name\":\"ossec-rootkit\"}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_ossec-rootkit" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_ossec-rootkit" + } + }, + { + "match_phrase": { + "pack_name": "ossec-rootkit" + } + } + ] } } } diff --git a/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json index ef29d27b432..1fc0797335b 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-3824b080-eb02-11e7-8f04-51231daa5b05.json @@ -44,20 +44,40 @@ }, { "meta": { - "alias": null, + "alias": "it-compliance / deb_packages", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_it-compliance_deb_packages" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_it-compliance_deb_packages\"}},{\"bool\":{\"filter\":[{\"match_phrase\":{\"pack_name\":\"it-compliance\"}},{\"match_phrase\":{\"query_name\":\"deb_packages\"}}]}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_it-compliance_deb_packages" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_it-compliance_deb_packages" + } + }, + { + "bool": { + "filter": [ + { + "match_phrase": { + "pack_name": "it-compliance" + } + }, + { + "match_phrase": { + "query_name": "deb_packages" + } + } + ] + } + } + ] } } } diff --git a/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json index f19761c09b3..a37e1eadada 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-7a9482d0-eb00-11e7-8f04-51231daa5b05.json @@ -44,20 +44,40 @@ }, { "meta": { - "alias": null, + "alias": "it-compliance / mounts", "disabled": false, - "field": "action_id", "index": "logs-*", - "key": "action_id", + "key": "query", "negate": false, - "params": { - "query": "pack_it-compliance_mounts" - }, - "type": "phrase" + "type": "custom", + "value": "{\"bool\":{\"minimum_should_match\":1,\"should\":[{\"match_phrase\":{\"action_id\":\"pack_it-compliance_mounts\"}},{\"bool\":{\"filter\":[{\"match_phrase\":{\"pack_name\":\"it-compliance\"}},{\"match_phrase\":{\"query_name\":\"mounts\"}}]}}]}}" }, "query": { - "match_phrase": { - "action_id": "pack_it-compliance_mounts" + "bool": { + "minimum_should_match": 1, + "should": [ + { + "match_phrase": { + "action_id": "pack_it-compliance_mounts" + } + }, + { + "bool": { + "filter": [ + { + "match_phrase": { + "pack_name": "it-compliance" + } + }, + { + "match_phrase": { + "query_name": "mounts" + } + } + ] + } + } + ] } } } diff --git a/packages/osquery_manager/kibana/search/osquery_manager-b5d6baa0-eb02-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/search/osquery_manager-b5d6baa0-eb02-11e7-8f04-51231daa5b05.json index 931ef14b4ba..c473b160dcd 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-b5d6baa0-eb02-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-b5d6baa0-eb02-11e7-8f04-51231daa5b05.json @@ -6,7 +6,7 @@ "description": "", "hits": 0, "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:pack_it-compliance_os_version\"},\"version\":true}" + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:\\\"pack_it-compliance_os_version\\\" or (pack_name:\\\"it-compliance\\\" and query_name:\\\"os_version\\\")\"},\"version\":true}" }, "sort": [ [ diff --git a/packages/osquery_manager/kibana/search/osquery_manager-f59e21e0-eb03-11e7-8f04-51231daa5b05.json b/packages/osquery_manager/kibana/search/osquery_manager-f59e21e0-eb03-11e7-8f04-51231daa5b05.json index c23bb0dec5e..75e476ebdfa 100644 --- a/packages/osquery_manager/kibana/search/osquery_manager-f59e21e0-eb03-11e7-8f04-51231daa5b05.json +++ b/packages/osquery_manager/kibana/search/osquery_manager-f59e21e0-eb03-11e7-8f04-51231daa5b05.json @@ -8,7 +8,7 @@ "description": "", "hits": 0, "kibanaSavedObjectMeta": { - "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:pack_it-compliance_kernel_integrations\"},\"version\":true}" + "searchSourceJSON": "{\"filter\":[],\"highlightAll\":true,\"indexRefName\":\"kibanaSavedObjectMeta.searchSourceJSON.index\",\"query\":{\"language\":\"kuery\",\"query\":\"action_id:\\\"pack_it-compliance_kernel_integrations\\\" or (pack_name:\\\"it-compliance\\\" and query_name:\\\"kernel_integrations\\\")\"},\"version\":true}" }, "sort": [ [ diff --git a/packages/osquery_manager/manifest.yml b/packages/osquery_manager/manifest.yml index cf7300913e4..0a7807a4a3d 100644 --- a/packages/osquery_manager/manifest.yml +++ b/packages/osquery_manager/manifest.yml @@ -1,7 +1,7 @@ format_version: 3.5.8 name: osquery_manager title: Osquery Manager -version: 1.30.0 +version: 1.30.1 description: Deploy Osquery with Elastic Agent, then run and schedule queries in Kibana type: integration categories: