Add references to rules (osquery_rules) (#1026)

* Add references to rules (osquery_rules) * Add references to rules (osquery_rules) --------- Co-authored-by: Evan Gibler <[email protected]>
panther-labs · Dec 12, 2023 · 1692899 · 1692899
1 parent 550c7ac
commit 1692899
Show file tree

Hide file tree

Showing 7 changed files with 9 additions and 3 deletions.
diff --git a/rules/osquery_rules/osquery_mac_enable_auto_update.yml b/rules/osquery_rules/osquery_mac_enable_auto_update.yml
@@ -21,6 +21,7 @@ Description: >
   Verifies that MacOS has automatic software updates enabled.
 Runbook: >
   Enable the auto updates on the host.
+Reference: https://support.apple.com/en-gb/guide/mac-help/mchlpx1065/mac
 SummaryAttributes:
   - name
   - action

diff --git a/rules/osquery_rules/osquery_mac_unwanted_chrome_extensions.yml b/rules/osquery_rules/osquery_mac_unwanted_chrome_extensions.yml
@@ -17,6 +17,7 @@ Severity: Medium
 Description: >
   Monitor for chrome extensions that could lead to a credential compromise.
 Runbook: Uninstall the unwanted extension
+Reference: https://securelist.com/threat-in-your-browser-extensions/107181/
 SummaryAttributes:
   - action
   - hostIdentifier

diff --git a/rules/osquery_rules/osquery_ossec.yml b/rules/osquery_rules/osquery_ossec.yml
@@ -17,6 +17,7 @@ Description: >
   Checks if any results are returned for the Osquery OSSEC Rootkit pack.
 Runbook: >
   Verify the presence of the rootkit and re-image the machine.
+Reference: https://panther.com/blog/osquery-log-analysis/
 SummaryAttributes:
   - name
   - hostIdentifier

diff --git a/rules/osquery_rules/osquery_outdated.py b/rules/osquery_rules/osquery_outdated.py
@@ -1,6 +1,6 @@
 from panther_base_helpers import deep_get
 
-LATEST_VERSION = "4.2.0"
+LATEST_VERSION = "5.10.2"
 
 
 def rule(event):

diff --git a/rules/osquery_rules/osquery_outdated.yml b/rules/osquery_rules/osquery_outdated.yml
@@ -9,8 +9,9 @@ Tags:
   - Osquery
   - Compliance
 Severity: Info
-Description: Keep track of osquery versions, current is 4.1.2.
+Description: Keep track of osquery versions, current is 5.10.2.
 Runbook: Update the osquery agent.
+Reference: https://www.osquery.io/downloads/official/5.10.2
 SummaryAttributes:
   - name
   - hostIdentifier
@@ -74,7 +75,7 @@ Tests:
               "system_time": "12472",
               "user_time": "31800",
               "uuid": "37821E12-CC8A-5AA3-A90C-FAB28A5BF8F9",
-              "version": "4.2.0",
+              "version": "5.10.2",
               "watcher": "92"
           },
           "counter": "255",

diff --git a/rules/osquery_rules/osquery_outdated_macos.yml b/rules/osquery_rules/osquery_outdated_macos.yml
@@ -12,6 +12,7 @@ Severity: Low
 Description: >
   Check that all laptops on the corporate environment are on a version of MacOS supported by IT.
 Runbook: Update the MacOs version
+Reference: https://support.apple.com/en-eg/HT201260
 SummaryAttributes:
   - name
   - hostIdentifier

diff --git a/rules/osquery_rules/osquery_ssh_listener.yml b/rules/osquery_rules/osquery_ssh_listener.yml
@@ -16,6 +16,7 @@ Description: >
   Check if SSH is listening in a non-production environment. This could be an indicator of persistent access within an environment.
 Runbook: >
   Terminate the SSH daemon, investigate for signs of compromise.
+Reference: https://medium.com/uptycs/osquery-what-it-is-how-it-works-and-how-to-use-it-ce4e81e60dfc
 SummaryAttributes:
   - action
   - hostIdentifier