Skip to content

Commit

Permalink
Remove Retrieve from more query names
Browse files Browse the repository at this point in the history
This makes this display better in the data queries tab

Signed-off-by: Tim Smith <[email protected]>
  • Loading branch information
tas50 committed Dec 1, 2023
1 parent 6484f5d commit 34ffc69
Show file tree
Hide file tree
Showing 9 changed files with 69 additions and 69 deletions.
24 changes: 12 additions & 12 deletions core/mondoo-gcp-inventory.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ packs:
- asset.platform == "gcp" || asset.platform == "gcp-project"
queries:
- uid: mondoo-asset-inventory-gcp-project-info
title: Retrieve GCP Project Information
title: GCP Project Information
mql: |
gcp.project {
name
Expand All @@ -29,68 +29,68 @@ packs:
labels
}
- uid: mondoo-asset-inventory-gcp-project-owners
title: Retrieve data for all owners of the GCP project
title: GCP project owners
docs:
desc: |
This query retrieves data for all owners of the GCP project
mql: gcp.project.iamPolicy.where( role == "roles/owner" )
- uid: mondoo-asset-inventory-gcp-project-editors
title: Retrieve data for all editors of the GCP project
title: GCP project editors
docs:
desc: |
This query retrieves data for all editors of the GCP project
mql: gcp.project.iamPolicy.where( role == "roles/editors" )
- uid: mondoo-asset-inventory-gcp-iam-roles
title: Retrieve all IAM Policy roles for the GCP project
title: IAM Policy roles
docs:
desc: |
This query retrieves all roles defined for a GCP project
mql: gcp.project.iamPolicy { role }
- uid: mondoo-asset-inventory-gcp-enabled-services
title: Retrieve all services enabled in the GCP project
title: Services enabled in the GCP project
docs:
desc: |
This query retrieves all services enabled in the GCP Project
mql: gcp.project.services.where( enabled == true )
- uid: mondoo-asset-inventory-gcp-gke-clusters-count
title: Retrieve count of GKE clusters in a GCP project
title: GKE clusters count
docs:
desc: |
This query retrieves a count of GKE clusters running in a GCP project
mql: gcp.project.gke.clusters.length
- uid: mondoo-asset-inventory-gcp-gke-clusters-data
title: Retrieve data on GKE clusters
title: GKE clusters configuration
docs:
desc: |
This query retrieves all of the configuration data for GKE clusters within a project
mql: gcp.project.gke.clusters
- uid: mondoo-asset-inventory-gcp-compute-instances-count
title: Retrieve a count of GCP compute instances in a GCP project
title: GCP compute instances count
docs:
desc: |
This query retrieves a count of running GCP compute instances in a GCP project
mql: gcp.compute.instances.where( status == "RUNNING" ).length
- uid: mondoo-asset-inventory-gcp-compute-instances-data
title: Retrieve data from all running GCP compute instances in a GCP project
title: GCP compute instances
docs:
desc: |
This query retrieves the data for all running GCP compute instances in a GCP project
mql: gcp.compute.instances.where( status == "RUNNING" )
- uid: mondoo-asset-inventory-gcp-compute-instances-public
title: Retrieve data on public GCP Compute Engine instances
title: GCP Compute Engine instances
docs:
desc: |
This query retrieves the data for all GCP Compute Engine instances that have been configured with an external IP address.
mql: |
gcp.compute.instances.where( networkInterfaces[0]['accessConfigs'][0]['name'] == "External NAT" )
- uid: mondoo-asset-inventory-gcp-compute-networks-count
title: Retrieve a count of GCP Compute Engine networks in a GCP project
title: GCP Compute Engine networks count
docs:
desc: |
This query retrieves a count of GCP Compute Engine networks configured in a GCP project
mql: gcp.compute.networks.length
- uid: mondoo-asset-inventory-gcp-compute-networks-data
title: Retrieve data for all GCP Compute Engine networks in a GCP project
title: GCP Compute Engine networks
docs:
desc: |
This query retrieves the data for all GCP Compute Engine networks configured in a GCP project.
Expand Down
34 changes: 17 additions & 17 deletions core/mondoo-kubernetes-incident-response.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -18,11 +18,11 @@ packs:
- asset.platform == "kubernetes" || asset.platform == "k8s-cluster"
queries:
- uid: mondoo-kubernetes-incident-response-cluster-version
title: Retrieve Kubernetes Cluster Version
title: Kubernetes Cluster Version
mql: |
k8s.serverVersion
- uid: mondoo-kubernetes-incident-response-role-bindings-with-cluster-admin-permissions
title: Retrieve role bindings with cluster-admin permissions
title: Role bindings with cluster-admin permissions
mql: |
k8s.rolebindings.where(roleRef["kind"] == "ClusterRole" && roleRef["name"] == "cluster-admin") {
name
Expand All @@ -31,7 +31,7 @@ packs:
roleRef
}
- uid: mondoo-kubernetes-incident-response-clusterrole-bindings-with-cluster-admin-permissions
title: Retrieve ClusterRoleBindings with cluster-admin permissions
title: ClusterRoleBindings with cluster-admin permissions
mql: |
k8s.clusterrolebindings.where(roleRef["kind"] == "ClusterRole" && roleRef["name"] == "cluster-admin") {
name
Expand All @@ -43,7 +43,7 @@ packs:
- asset.platform == "k8s-pod"
queries:
- uid: mondoo-kubernetes-incident-response-pod-security-context
title: Retrieve Pod Security Context
title: Pod Security Context
mql: |
k8s.pod {
ephemeralContainers {
Expand All @@ -57,7 +57,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-pod-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.pod {
name
Expand Down Expand Up @@ -105,7 +105,7 @@ packs:
- asset.platform == "k8s-deployment"
queries:
- uid: mondoo-kubernetes-incident-response-deployment-security-context
title: Retrieve Deployment Security Context
title: Deployment Security Context
mql: |
k8s.deployment {
initContainers {
Expand All @@ -116,7 +116,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-deployment-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.deployment {
name
Expand Down Expand Up @@ -151,7 +151,7 @@ packs:
- asset.platform == "k8s-cronjob"
queries:
- uid: mondoo-kubernetes-incident-response-cronjob-security-context
title: Retrieve CronJob Security Context
title: CronJob Security Context
mql: |
k8s.cronjob {
initContainers {
Expand All @@ -162,7 +162,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-cronjob-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.cronjob {
name
Expand Down Expand Up @@ -197,7 +197,7 @@ packs:
- asset.platform == "k8s-job"
queries:
- uid: mondoo-kubernetes-incident-response-job-security-context
title: Retrieve Job Security Context
title: Job Security Context
mql: |
k8s.job {
initContainers {
Expand All @@ -208,7 +208,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-job-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.job {
name
Expand Down Expand Up @@ -243,7 +243,7 @@ packs:
- asset.platform == "k8s-daemonset"
queries:
- uid: mondoo-kubernetes-incident-response-daemonset-security-context
title: Retrieve DaemonSet Security Context
title: DaemonSet Security Context
mql: |
k8s.daemonset {
initContainers {
Expand All @@ -254,7 +254,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-daemonset-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.daemonset {
name
Expand Down Expand Up @@ -289,7 +289,7 @@ packs:
- asset.platform == "k8s-statefulset"
queries:
- uid: mondoo-kubernetes-incident-response-statefulset-security-context
title: Retrieve StatefulSet Security Context
title: StatefulSet Security Context
mql: |
k8s.statefulset {
initContainers {
Expand All @@ -300,7 +300,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-statefulset-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.statefulset {
name
Expand Down Expand Up @@ -335,7 +335,7 @@ packs:
- asset.platform == "k8s-replicaset"
queries:
- uid: mondoo-kubernetes-incident-response-replicaset-security-context
title: Retrieve ReplicaSet Security Context
title: ReplicaSet Security Context
mql: |
k8s.replicaset {
initContainers {
Expand All @@ -346,7 +346,7 @@ packs:
}
}
- uid: mondoo-kubernetes-incident-response-replicaset-container
title: Retrieve container image information
title: Container image information
mql: |
k8s.replicaset {
name
Expand Down
18 changes: 9 additions & 9 deletions core/mondoo-linux-incident-response.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,34 +16,34 @@ packs:
- asset.family.contains("linux")
queries:
- uid: mondoo-linux-incident-response-installed-kernel
title: Retrieve installed Linux kernels
title: Installed Linux kernels
filters: mondoo.capabilities.contains("run-command")
mql: kernel.installed
- uid: mondoo-linux-kernel-info
title: Retrieve the running Linux kernel
title: Running Linux kernel
filters: mondoo.capabilities.contains("run-command")
mql: kernel.info
- uid: mondoo-linux-kernel-modules
title: Retrieve Linux kernel modules
title: Linux kernel modules
mql: kernel.modules { name loaded }
- uid: mondoo-linux-incident-response-processes
title: Retrieve running processes
title: Running processes
filters: mondoo.capabilities.contains("run-command")
mql: processes { pid command }
- uid: mondoo-linux-mounts
title: Retrieve mounted devices
title: Mounted devices
mql: mount.list { path fstype device options }
- uid: mondoo-linux-listening-ports
title: Retrieve all listening ports
title: All listening ports
filters: mondoo.capabilities.contains("run-command")
mql: ports.listening
- uid: mondoo-linux-uptime
title: Retrieve operating system uptime
title: Operating system uptime
filters: mondoo.capabilities.contains("run-command")
mql: os.uptime
- uid: mondoo-linux-installed-packages
title: Retrieve installed packages
title: Installed packages
mql: packages { name version arch installed }
- uid: mondoo-linux-running-services
title: Retrieve running services
title: Running services
mql: services { name running enabled masked type }
22 changes: 11 additions & 11 deletions core/mondoo-macos-incident-response.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,35 +16,35 @@ packs:
- asset.platform == "macos"
queries:
- uid: mondoo-macos-incident-response-platform-info
title: Retrieve platform information
title: Platform information
mql: asset { platform title version arch }
- uid: mondoo-macos-incident-response-regular-users
title: Retrieve regular users
title: Regular users
mql: users.where( name != /^_/ && shell != /\/usr\/bin\/false/ )
- uid: mondoo-macos-incident-response-kernel-info
title: Retrieve the running macOS kernel
title: Running macOS kernel
mql: kernel.info["version"]
- uid: mondoo-macos-incident-response-kernel-modules
title: Retrieve macOS kernel modules
title: macOS kernel modules
mql: kernel.modules { name loaded }
- uid: mondoo-macos-incident-response-processes
title: Retrieve running processes
title: Running processes
mql: processes.list { pid command }
- uid: mondoo-macos-incident-response-mounts
title: Retrieve mounted devices
title: Mounted devices
mql: mount.list
- uid: mondoo-macos-incident-response-uptime
title: Retrieve operating system uptime
title: Operating system uptime
mql: os.uptime
- uid: mondoo-macos-incident-response-installed-packages
title: Retrieve installed packages
title: Installed packages
mql: packages
- uid: mondoo-macos-incident-response-running-services
title: Retrieve running services
title: Running services
mql: services
- uid: mondoo-macos-incident-response-alf-extensions
title: Retrieve exceptions from the Application Layer Firewall
title: Exceptions from the Application Layer Firewall
mql: macos.alf.exceptions
- uid: mondoo-macos-incident-response-check-recommended-updates
title: Retrieve any recommended updates
title: Recommended OS and application updates
mql: parse.plist('/Library/Preferences/com.apple.SoftwareUpdate.plist').params['RecommendedUpdates']
6 changes: 3 additions & 3 deletions core/mondoo-openssl-incident-response.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -16,18 +16,18 @@ packs:
- asset.family.contains("linux")
queries:
- uid: mondoo-openssl-incident-response-platform
title: Retrieve platform details
title: Platform details
mql: |
asset {
platform
version
arch
}
- uid: mondoo-openssl-incident-response-installed-version
title: Retrieve installed ssl libraries
title: Installed ssl libraries
mql: packages.where(name == /ssl/)
- uid: mondoo-openssl-incident-response-listening-ports
title: Retrieve listening ports from running systems
title: Listening ports from running systems
mql: |
if ( mondoo.capabilities.contains('run-command') ) {
ports.listening {
Expand Down
10 changes: 5 additions & 5 deletions core/mondoo-vmware-incident-response.mql.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -35,27 +35,27 @@ packs:
- asset.platform == "vmware-esxi"
queries:
- uid: mondoo-vmware-incident-response-kernel-modules
title: Retrieve kernel modules
title: Kernel modules
mql: vsphere.host.kernelModules
- uid: mondoo-vmware-incident-response-installed-packages
title: Retrieve installed packages
title: Installed packages
mql: vsphere.host.packages
- uid: mondoo-vmware-incident-response-running-services
title: Retrieve all services
title: All services
mql: vsphere.host.services
refs:
- title: VMSA-2021-0002
url: https://www.vmware.com/security/advisories/VMSA-2021-0002.html
- title: How to Disable/Enable the SLP Service on VMware ESXi (76372)
url: https://kb.vmware.com/s/article/76372
- uid: mondoo-vmware-incident-response-acceptance-level
title: Retrieve host acceptance level
title: Host acceptance level
docs:
desc: The host acceptance level determines which VIBs can be installed on a host.
mql: vsphere.host.acceptanceLevel
refs:
- title:
url: https://docs.vmware.com/en/VMware-vSphere/6.5/com.vmware.vsphere.upgrade.doc/GUID-27BBBAB8-01EA-4238-8140-1C3C3EFC0AA6.html
- uid: mondoo-vmware-incident-response-ntp-servers
title: Retrieve all configured NTP servers
title: Configured NTP servers
mql: vsphere.host.ntp.server
Loading

0 comments on commit 34ffc69

Please sign in to comment.