@cdxgen/cdxgen 0.0.1 → 13.0.0

package/data/python-stdlib.json

@@ -0,0 +1,308 @@
+[
+  "_abc",
+  "_ast",
+  "_codecs",
+  "_collections",
+  "_functools",
+  "_imp",
+  "_io",
+  "_locale",
+  "_operator",
+  "_peg_parser",
+  "_signal",
+  "_sre",
+  "_stat",
+  "_string",
+  "_symtable",
+  "_thread",
+  "_tracemalloc",
+  "_warnings",
+  "_weakref",
+  "atexit",
+  "basehttpserver",
+  "simplehttpserver",
+  "builtins",
+  "errno",
+  "faulthandler",
+  "gc",
+  "itertools",
+  "marshal",
+  "posix",
+  "pwd",
+  "sys",
+  "time",
+  "xxsubtype",
+  "__future__",
+  "_aix_support",
+  "_bootlocale",
+  "_bootsubprocess",
+  "_collections_abc",
+  "_compat_pickle",
+  "_compression",
+  "_markupbase",
+  "_osx_support",
+  "_py_abc",
+  "_pydecimal",
+  "_pyio",
+  "_sitebuiltins",
+  "_strptime",
+  "_sysconfigdata__linux_x86_64-linux-gnu",
+  "_sysconfigdata_d_linux_x86_64-linux-gnu",
+  "_threading_local",
+  "_weakrefset",
+  "abc",
+  "aifc",
+  "antigravity",
+  "argparse",
+  "ast",
+  "asynchat",
+  "asyncio",
+  "asyncore",
+  "base64",
+  "bdb",
+  "binhex",
+  "bisect",
+  "bz2",
+  "cprofile",
+  "calendar",
+  "cgi",
+  "cgitb",
+  "chunk",
+  "cmd",
+  "code",
+  "codecs",
+  "codeop",
+  "collections",
+  "colorsys",
+  "compileall",
+  "concurrent",
+  "configparser",
+  "contextlib",
+  "contextvars",
+  "copy",
+  "copyreg",
+  "crypt",
+  "csv",
+  "ctypes",
+  "curses",
+  "dataclasses",
+  "datetime",
+  "dbm",
+  "decimal",
+  "dummy_threading",
+  "difflib",
+  "dis",
+  "distutils",
+  "doctest",
+  "email",
+  "encodings",
+  "ensurepip",
+  "enum",
+  "filecmp",
+  "fileinput",
+  "fnmatch",
+  "formatter",
+  "fractions",
+  "ftplib",
+  "functools",
+  "genericpath",
+  "getopt",
+  "getpass",
+  "gettext",
+  "glob",
+  "graphlib",
+  "gzip",
+  "hashlib",
+  "heapq",
+  "hmac",
+  "html",
+  "http",
+  "imaplib",
+  "imghdr",
+  "imp",
+  "importlib",
+  "inspect",
+  "io",
+  "ipaddress",
+  "json",
+  "keyword",
+  "lib2to3",
+  "linecache",
+  "locale",
+  "logging",
+  "lzma",
+  "mailbox",
+  "mailcap",
+  "mimetypes",
+  "modulefinder",
+  "msvcrt",
+  "multiprocessing",
+  "netrc",
+  "nntplib",
+  "ntpath",
+  "nturl2path",
+  "numbers",
+  "openssl",
+  "opcode",
+  "operator",
+  "optparse",
+  "os",
+  "pathlib",
+  "pdb",
+  "pickle",
+  "pickletools",
+  "pipes",
+  "pkgutil",
+  "platform",
+  "plistlib",
+  "poplib",
+  "posixpath",
+  "pprint",
+  "profile",
+  "pstats",
+  "pty",
+  "py_compile",
+  "pyclbr",
+  "pydoc",
+  "pydoc_data",
+  "queue",
+  "quopri",
+  "random",
+  "re",
+  "reprlib",
+  "rlcompleter",
+  "runpy",
+  "sched",
+  "secrets",
+  "selectors",
+  "shelve",
+  "shlex",
+  "shutil",
+  "signal",
+  "site",
+  "smtpd",
+  "smtplib",
+  "sndhdr",
+  "socket",
+  "socketserver",
+  "sqlite3",
+  "sre_compile",
+  "sre_constants",
+  "sre_parse",
+  "ssl",
+  "stat",
+  "statistics",
+  "string",
+  "stringio",
+  "cstringio",
+  "stringprep",
+  "struct",
+  "subprocess",
+  "sunau",
+  "symbol",
+  "symtable",
+  "sysconfig",
+  "tabnanny",
+  "tarfile",
+  "telnetlib",
+  "tempfile",
+  "textwrap",
+  "this",
+  "threading",
+  "timeit",
+  "token",
+  "tokenize",
+  "trace",
+  "traceback",
+  "tracemalloc",
+  "tty",
+  "types",
+  "typing",
+  "unittest",
+  "urllib",
+  "uu",
+  "uuid",
+  "venv",
+  "warnings",
+  "wave",
+  "weakref",
+  "webbrowser",
+  "wsgiref",
+  "winreg",
+  "xdrlib",
+  "xml",
+  "xmlrpc",
+  "zipapp",
+  "zipfile",
+  "zipimport",
+  "zoneinfo",
+  "_asyncio",
+  "_bisect",
+  "_blake2",
+  "_bz2",
+  "_codecs_cn",
+  "_codecs_hk",
+  "_codecs_iso2022",
+  "_codecs_jp",
+  "_codecs_kr",
+  "_codecs_tw",
+  "_contextvars",
+  "_crypt",
+  "_csv",
+  "_ctypes",
+  "_curses",
+  "_curses_panel",
+  "_datetime",
+  "_dbm",
+  "_decimal",
+  "_elementtree",
+  "_gdbm",
+  "_hashlib",
+  "_heapq",
+  "_json",
+  "_lsprof",
+  "_lzma",
+  "_multibytecodec",
+  "_multiprocessing",
+  "_opcode",
+  "_pickle",
+  "_posixshmem",
+  "_posixsubprocess",
+  "_queue",
+  "_random",
+  "_socket",
+  "_sqlite3",
+  "_ssl",
+  "_statistics",
+  "_struct",
+  "_uuid",
+  "_xxsubinterpreters",
+  "_zoneinfo",
+  "array",
+  "audioop",
+  "binascii",
+  "cmath",
+  "fcntl",
+  "grp",
+  "math",
+  "mmap",
+  "ossaudiodev",
+  "parser",
+  "pyexpat",
+  "readline",
+  "resource",
+  "select",
+  "spwd",
+  "syslog",
+  "termios",
+  "unicodedata",
+  "xxlimited",
+  "zlib",
+  "_distutils_hack",
+  "pip",
+  "pkg_resources",
+  "setuptools",
+  "_info",
+  "_registry",
+  "tomllib"
+]

package/data/queries-darwin.json

@@ -0,0 +1,193 @@
+{
+  "os_version": {
+    "query": "select * from os_version;",
+    "description": "Retrieves the current version of the running osquery in the target system and where the configuration was loaded from.",
+    "purlType": "swid",
+    "componentType": "operating-system"
+  },
+  "safari_extensions": {
+    "query": "select safari_extensions.* from users join safari_extensions using (uid);",
+    "description": "Safari browser extension details for all users. This table requires Full Disk Access (FDA) permission.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "chrome_extensions": {
+    "query": "select chrome_extensions.* from users join chrome_extensions using (uid);",
+    "description": "Retrieves the list of extensions for Chrome in the target system.",
+    "purlType": "chrome-extension",
+    "componentType": "application"
+  },
+  "firefox_addons": {
+    "query": "select firefox_addons.* from users join firefox_addons using (uid);",
+    "description": "Retrieves the list of addons for Firefox in the target system.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "vscode_extensions": {
+    "query": "select vscode_extensions.* from users join vscode_extensions using (uid);",
+    "description": "Lists all vscode extensions.",
+    "purlType": "vscode-extension",
+    "componentType": "application"
+  },
+  "apps": {
+    "query": "select * from apps;",
+    "description": "macOS applications installed in known search paths (e.g., /Applications).",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "gatekeeper": {
+    "query": "SELECT 'gatekeeper' as name, COALESCE(NULLIF(version, ''), opaque_version) as version, opaque_version as description, assessments_enabled, dev_id_enabled FROM gatekeeper;",
+    "description": "macOS Gatekeeper policy status, including assessment enforcement and identified-developer allowance.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "system_extensions": {
+    "query": "select * from system_extensions;",
+    "description": "macOS (>= 10.15) system extension table.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "certificates": {
+    "query": "SELECT * FROM certificates WHERE path != 'Other People';",
+    "description": "List all certificates in the trust store.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "users_snapshot": {
+    "query": "SELECT username as name, uuid as version, description, directory, shell, uid, gid, is_hidden FROM users;",
+    "description": "Local account inventory including hidden-user attributes on macOS.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "logged_in_users_snapshot": {
+    "query": "SELECT user as name, '' as version, type as description, pid, host, tty, time FROM logged_in_users;",
+    "description": "Interactive and remote user sessions currently active on the host.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "shell_history_snapshot": {
+    "query": "SELECT users.username as name, '' as version, shell_history.command as description, shell_history.time, shell_history.history_file, shell_history.uid FROM users JOIN shell_history USING (uid);",
+    "description": "User shell command history metadata for investigation support.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "homebrew_packages": {
+    "query": "SELECT * FROM homebrew_packages;",
+    "description": "Homebrew formula and cask inventory including auto-update behavior.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "npm_packages": {
+    "query": "SELECT * FROM npm_packages;",
+    "description": "Node packages installed on the system, including recursively discovered modern package manager layouts.",
+    "purlType": "npm"
+  },
+  "launchd_services": {
+    "query": "SELECT name, label, path, program, run_at_load, keep_alive, disabled, username, groupname, stdout_path, stderr_path, start_interval, program_arguments, watch_paths, queue_directories, start_on_mount, working_directory, process_type FROM launchd;",
+    "description": "LaunchAgents and LaunchDaemons configuration used for macOS persistence.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "launchd_overrides": {
+    "query": "SELECT label as name, key as version, value as description, uid, path FROM launchd_overrides;",
+    "description": "Per-user launchd override state that can alter startup behavior.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "alf": {
+    "query": "SELECT 'alf' as name, global_state as version, version as description, allow_signed_enabled, firewall_unload, logging_enabled, logging_option, stealth_enabled FROM alf;",
+    "description": "Application Layer Firewall (ALF) configuration and enforcement posture.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "alf_exceptions": {
+    "query": "SELECT path as name, state as version FROM alf_exceptions;",
+    "description": "Firewall allow/block exception list for specific executables or bundle identifiers.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "xprotect_entries": {
+    "query": "SELECT * FROM xprotect_entries;",
+    "description": "Built-in XProtect malware signature entries on macOS.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "xprotect_meta": {
+    "query": "SELECT identifier as name, min_version as version, type as description, developer_id FROM xprotect_meta;",
+    "description": "XProtect browser extension/plugin policy metadata.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "package_bom": {
+    "query": "SELECT * FROM package_bom WHERE path IN (SELECT REPLACE(package_receipts.path, '.plist', '.bom') FROM package_receipts JOIN file ON file.path = REPLACE(package_receipts.path, '.plist', '.bom') WHERE package_receipts.path LIKE '%.plist' AND file.size <= 52428800);",
+    "description": "macOS package bill of materials (BOM) file list.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "package_install_history": {
+    "query": "SELECT * FROM package_install_history;",
+    "description": "macOS package install history.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "package_receipts": {
+    "query": "SELECT * FROM package_receipts;",
+    "description": "macOS package receipt details.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "running_apps": {
+    "query": "SELECT * FROM running_apps;",
+    "description": "macOS applications currently running on the host system.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "sandboxes": {
+    "query": "SELECT * FROM sandboxes;",
+    "description": "macOS application sandboxes container details.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "startup_items": {
+    "query": "SELECT * FROM startup_items;",
+    "description": "List all startup_items.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "listening_ports": {
+    "query": "SELECT DISTINCT process.name, listening.port, listening.protocol, listening.family, listening.address, process.pid, process.path, process.cmdline, process.cwd, process.uid, process.on_disk, process.parent, process.start_time FROM processes AS process JOIN listening_ports AS listening ON process.pid = listening.pid;",
+    "description": "List all processes and their listening_ports.",
+    "purlType": "swid",
+    "componentType": "application"
+  },
+  "interface_addresses": {
+    "query": "SELECT * FROM interface_addresses;",
+    "description": "List all interface_addresses.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "docker_container_ports": {
+    "query": "SELECT * FROM docker_container_ports;",
+    "description": "List all docker_container_ports.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "docker_containers": {
+    "query": "SELECT * FROM docker_containers;",
+    "description": "List all docker_containers.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "docker_networks": {
+    "query": "SELECT * FROM docker_networks;",
+    "description": "List all docker_networks.",
+    "purlType": "swid",
+    "componentType": "data"
+  },
+  "docker_volumes": {
+    "query": "SELECT * FROM docker_volumes;",
+    "description": "List all docker_volumes.",
+    "purlType": "swid",
+    "componentType": "data"
+  }
+}