[Osquery] OSQuery DFIR Saved Queries

[w0rk3r]

What does this PR do?

Adds DFIR-related saved queries to the OSQuery manager integration

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Start Time: 2022-08-12T13:56:43.443+0000

• Duration: 13 min 25 sec

Test stats 🧪

Test	Results
Failed	0
Passed	15
Skipped	0
Total	15

🤖 GitHub comments

To re-run your PR in the CI, just comment with:

• /test : Re-trigger the build.

[tomsonpl]

Left one comment, besides that - LGTM from Asset management :)

[melissaburpo]

I just had one small suggested change to update the id.

Also, a question: should we add ECS mappings for any fields returned in the results? I tried testing the query to see what the results look like, but I wasn't able to run it successfully - I suspect that's because in its current form the query has some extra formatting for the json version of the saved object.

[w0rk3r]

@melissaburpo did it returned any error? Because it will return null if no exceptions exist

Screenshot of the result on my Windows Server:

[melissaburpo]

The issue was that I tried to copy/paste the query directly from the PR to try running it, so it had some syntax issues (like the \nr characters).

Thanks for sharing the screenshot though, that helps! Looking at the results, I don't think there are any ECS mappings needed for the defender_exclusions query, so that helps to answer that question. Appreciate it!

[w0rk3r]

Here are a few screenshots on the queries returning the desired results:

defender_exclusions_windows_elastic

posh_logging_windows_elastic

unsigned_services_vt_windows_elastic

unsigned_processes_vt_windows_elastic

unsigned_startup_items_vt_windows_elastic

unsigned_dlls_on_system_folders_vt_windows_elastic

winbaseobj_mutex_search_windows_elastic

executables_or_drivers_in_temp_folder_vt_windows_elastic

wdigest_uselogoncredential_windows_elastic

Let me know if I can help with anything around these ;)

[elasticmachine]

🌐 Coverage report

Name	Metrics % (covered/total)	Diff
Packages	100.0% (0/0)	💚
Files	100.0% (0/0)	💚 2.857
Classes	100.0% (0/0)	💚 2.857
Methods	33.333% (1/3)	👎 -55.881
Lines	100.0% (0/0)	💚 9.347
Conditionals	100.0% (0/0)	💚

[tomsonpl]

LGTM

[tomsonpl]

@w0rk3r I think you can merge it. Let's then test the integration on staging before going on production :)
Great work! Thanks for adding more saved queries 🥇

[tomsonpl]

https://beats-ci.elastic.co/blue/organizations/jenkins/Ingest-manager%2Fintegrations/detail/main/1201/pipeline/ this is a job triggered from this PR. Let's see what happens next 🤞