osquery

v5.22.1 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 5mo Forensics & Incident Response

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

intrusion-detection monitoring security sql

Affected surfaces

breaking_upgrade

Summary

AI summary

Updates Build & Dependencies, build, and lib across a mixed release.

Full changelog

5.22.0 macOS binaries will not execute because the signing certificate is out of sync with the provisioning profile. 5.22.1 replaces it.

Make escapeNonPrintableBytes UTF-8 aware by @nulmete in https://github.com/osquery/osquery/pull/8777
- Note: This changes some query results that formerly were rendered as raw unicode bytes and will now be rendered as the corresponding characters.
Update virtual sql functions to support multiple constraints by @brian-mckinney in https://github.com/osquery/osquery/pull/8746
- This allows SELECT * FROM vscode_extensions WHERE uid in (SELECT uid FROM users WHERE include_remote = 1) and similar queries that join or subquery to the users table to include results for remote users.
Add support for retries in carver by @zwass in https://github.com/osquery/osquery/pull/8740
Preserve file metadata in carver archives by @zwass in https://github.com/osquery/osquery/pull/8752
Add machine-wide provisioned MSIX packages to programs table (#8001) by @getvictor in https://github.com/osquery/osquery/pull/8772

Update osquery-toolchain to 1.2.0 (LLVM 11.0.0, zlib 1.2.13) by @zwass in https://github.com/osquery/osquery/pull/8773
Update Apple provisioning profile for new developer certificates by @zwass in https://github.com/osquery/osquery/pull/8780
build: suppress enum-constexpr-conversion error for boost mpl on macos by @sharvilshah in https://github.com/osquery/osquery/pull/8742
lib: Update openssl to 3.6.1 by @sharvilshah in https://github.com/osquery/osquery/pull/8766

Quit carving when sending a block fails by @zwass in https://github.com/osquery/osquery/pull/8733
Fix SMBIOS CPU count by @agiacomolli in https://github.com/osquery/osquery/pull/8737
Fix systemd unit: use .target instead of .service by @ideologysec in https://github.com/osquery/osquery/pull/8771
Fix typo in winbaseobj.table description by @SquidCooki2 in https://github.com/osquery/osquery/pull/8768
Fix JSON handling copy vs. ref semantics by @zwass in https://github.com/osquery/osquery/pull/8738
Fix memory leak in logon_sessions by @directionless in https://github.com/osquery/osquery/pull/8779

@ideologysec made their first contribution in https://github.com/osquery/osquery/pull/8771
@SquidCooki2 made their first contribution in https://github.com/osquery/osquery/pull/8768
@nulmete made their first contribution in https://github.com/osquery/osquery/pull/8777
@brian-mckinney made their first contribution in https://github.com/osquery/osquery/pull/8746

Full Changelog: https://github.com/osquery/osquery/compare/5.21.0...5.22.1

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track osquery

Get notified when new releases ship.

About osquery

SQL powered operating system instrumentation, monitoring, and analytics