
PASSWORD=$1

# Create main policy
POLICY_ID=$(curl -u elastic:$PASSWORD -s 'http://127.0.0.1/api/fleet/agent_policies?sys_monitoring=true' \
  -H 'Content-Type: application/json' -H 'kbn-xsrf: true'  \
  --data-raw '{"name":"Agent policy 1","description":"","namespace":"default","monitoring_enabled":["logs","metrics"]}' | jq -r .item.id)

# Add the integration endpoint security
curl -u elastic:$PASSWORD 'http://127.0.0.1/api/fleet/package_policies' \
-H 'Content-Type: application/json' -H 'kbn-xsrf: true' \
--data-raw "{\"name\":\"EndpointSecurity\",\"description\":\"\",\"namespace\":\"default\",\"policy_id\":\"$POLICY_ID\",\"enabled\":true,\"output_id\":\"\",\"inputs\":[],\"package\":{\"name\":\"endpoint\",\"title\":\"Endpoint Security\",\"version\":\"1.5.0\"}}"

# Add the integration security detection engine
curl -u elastic:$PASSWORD 'http://127.0.0.1/api/fleet/package_policies' \
  -H 'Content-Type: application/json' -H 'kbn-xsrf: true' \
  --data-raw "{\"name\":\"security_detection_engine-1\",\"description\":\"\",\"namespace\":\"default\",\"policy_id\":\"$POLICY_ID\",\"enabled\":true,\"output_id\":\"\",\"inputs\":[],\"package\":{\"name\":\"security_detection_engine\",\"title\":\"Prebuilt Security Detection Rules\",\"version\":\"1.0.1\"}}"

# Add the integration Windows
PAYLOAD=$(cat << EOF
{"name":"windows-1","description":"","namespace":"default","policy_id":"$POLICY_ID","enabled":true,"output_id":"","inputs":[{"type":"winlog","policy_template":"windows","enabled":true,"streams":[{"enabled":true,"data_stream":{"type":"logs","dataset":"windows.forwarded"},"vars":{"tags":{"value":["forwarded"],"type":"text"},"preserve_original_event":{"value":false,"type":"bool"},"processors":{"type":"yaml"}}},{"enabled":true,"data_stream":{"type":"logs","dataset":"windows.powershell"},"vars":{"tags":{"value":[],"type":"text"},"preserve_original_event":{"value":false,"type":"bool"},"processors":{"type":"yaml"}}},{"enabled":true,"data_stream":{"type":"logs","dataset":"windows.powershell_operational"},"vars":{"tags":{"value":[],"type":"text"},"preserve_original_event":{"value":false,"type":"bool"},"processors":{"type":"yaml"}}},{"enabled":true,"data_stream":{"type":"logs","dataset":"windows.sysmon_operational"},"vars":{"tags":{"value":[],"type":"text"},"preserve_original_event":{"value":false,"type":"bool"},"processors":{"type":"yaml"}}}]},{"type":"windows/metrics","policy_template":"windows","enabled":true,"streams":[{"enabled":true,"data_stream":{"type":"metrics","dataset":"windows.perfmon"},"vars":{"perfmon.group_measurements_by_instance":{"value":false,"type":"bool"},"perfmon.ignore_non_existent_counters":{"value":false,"type":"bool"},"perfmon.queries":{"value":"- object: 'Process'\n  instance: [\"*\"]\n  counters:\n   - name: '% Processor Time'\n     field: cpu_perc\n     format: \"float\"\n   - name: \"Working Set\"\n","type":"yaml"},"period":{"value":"10s","type":"text"}}},{"enabled":true,"data_stream":{"type":"metrics","dataset":"windows.service"},"vars":{"period":{"value":"60s","type":"text"}}}]},{"type":"httpjson","policy_template":"windows","enabled":false,"streams":[{"enabled":false,"data_stream":{"type":"logs","dataset":"windows.forwarded"},"vars":{"interval":{"value":"10s","type":"text"},"search":{"value":"search sourcetype=\"XmlWinEventLog:ForwardedEvents\"","type":"text"},"tags":{"value":["forwarded"],"type":"text"},"preserve_original_event":{"value":false,"type":"bool"},"processors":{"type":"yaml"}}},{"enabled":false,"data_stream":{"type":"logs","dataset":"windows.powershell"},"vars":{"interval":{"value":"10s","type":"text"},"search":{"value":"search sourcetype=\"XmlWinEventLog:Windows PowerShell\"","type":"text"},"tags":{"value":["forwarded"],"type":"text"},"preserve_original_event":{"value":false,"type":"bool"},"processors":{"type":"yaml"}}},{"enabled":false,"data_stream":{"type":"logs","dataset":"windows.powershell_operational"},"vars":{"interval":{"value":"10s","type":"text"},"search":{"value":"search sourcetype=\"XmlWinEventLog:Microsoft-Windows-Powershell/Operational\"","type":"text"},"tags":{"value":["forwarded"],"type":"text"},"preserve_original_event":{"value":false,"type":"bool"},"processors":{"type":"yaml"}}},{"enabled":false,"data_stream":{"type":"logs","dataset":"windows.sysmon_operational"},"vars":{"interval":{"value":"10s","type":"text"},"search":{"value":"search sourcetype=\"XmlWinEventLog:Microsoft-Windows-Sysmon/Operational\"","type":"text"},"tags":{"value":["forwarded"],"type":"text"},"preserve_original_event":{"value":false,"type":"bool"},"processors":{"type":"yaml"}}}],"vars":{"url":{"value":"https://server.example.com:8089","type":"text"},"username":{"type":"text"},"password":{"type":"password"},"token":{"type":"password"},"ssl":{"value":"#certificate_authorities:\n#  - |\n#    -----BEGIN CERTIFICATE-----\n#    MIIDCjCCAfKgAwIBAgITJ706Mu2wJlKckpIvkWxEHvEyijANBgkqhkiG9w0BAQsF\n#    ADAUMRIwEAYDVQQDDAlsb2NhbGhvc3QwIBcNMTkwNzIyMTkyOTA0WhgPMjExOTA2\n#    MjgxOTI5MDRaMBQxEjAQBgNVBAMMCWxvY2FsaG9zdDCCASIwDQYJKoZIhvcNAQEB\n#    BQADggEPADCCAQoCggEBANce58Y/JykI58iyOXpxGfw0/gMvF0hUQAcUrSMxEO6n\n#    fZRA49b4OV4SwWmA3395uL2eB2NB8y8qdQ9muXUdPBWE4l9rMZ6gmfu90N5B5uEl\n#    94NcfBfYOKi1fJQ9i7WKhTjlRkMCgBkWPkUokvBZFRt8RtF7zI77BSEorHGQCk9t\n#    /D7BS0GJyfVEhftbWcFEAG3VRcoMhF7kUzYwp+qESoriFRYLeDWv68ZOvG7eoWnP\n#    PsvZStEVEimjvK5NSESEQa9xWyJOmlOKXhkdymtcUd/nXnx6UTCFgnkgzSdTWV41\n#    CI6B6aJ9svCTI2QuoIq2HxX/ix7OvW1huVmcyHVxyUECAwEAAaNTMFEwHQYDVR0O\n#    BBYEFPwN1OceFGm9v6ux8G+DZ3TUDYxqMB8GA1UdIwQYMBaAFPwN1OceFGm9v6ux\n#    8G+DZ3TUDYxqMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEBAG5D\n#    874A4YI7YUwOVsVAdbWtgp1d0zKcPRR+r2OdSbTAV5/gcS3jgBJ3i1BN34JuDVFw\n#    3DeJSYT3nxy2Y56lLnxDeF8CUTUtVQx3CuGkRg1ouGAHpO/6OqOhwLLorEmxi7tA\n#    H2O8mtT0poX5AnOAhzVy7QW0D/k4WaoLyckM5hUa6RtvgvLxOwA0U+VGurCDoctu\n#    8F4QOgTAWyh8EZIwaKCliFRSynDpv3JTUwtfZkxo6K6nce1RhCWFAsMvDZL8Dgc0\n#    yvgJ38BRsFOtkRuAGSf6ZUwTO8JJRRIFnpUzXflAnGivK9M13D5GEQMmIl6U9Pvk\n#    sxSmbIUfc2SGJGCJD4I=\n#    -----END CERTIFICATE-----\n","type":"yaml"}}}],"package":{"name":"windows","title":"Windows","version":"1.5.0"}}
EOF
)
curl -u elastic:$PASSWORD 'http://127.0.0.1/api/fleet/package_policies' \
  -H 'Content-Type: application/json' -H 'kbn-xsrf: true' \
  --data-raw $PAYLOAD

# Add the integration Osquery Manager
curl -u elastic:$PASSWORD 'http://127.0.0.1/api/fleet/package_policies' \
  -H 'Content-Type: application/json' -H 'kbn-xsrf: true' \
 --data-raw "{\"name\":\"osquery_manager-1\",\"description\":\"\",\"namespace\":\"default\",\"policy_id\":\"$POLICY_ID\",\"enabled\":true,\"output_id\":\"\",\"inputs\":[{\"type\":\"osquery\",\"enabled\":true,\"streams\":[],\"policy_template\":\"osquery_manager\"}],\"package\":{\"name\":\"osquery_manager\",\"title\":\"Osquery Manager\",\"version\":\"1.0.0\"}}"

# Add packs for Osquery
# curl -u elastic:$PASSWORD  'http://192.168.1.53/internal/osquery/packs' \
#  -H 'Content-Type: application/json' -H 'kbn-xsrf: true' \
#  --data-raw $'{"name":"Osquery","policy_ids":[],"queries":{"OpenType_Font_Driver_Vulnerability":{"interval":"3600","query":"select * from registry where path like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Windows\\\\%\' AND name = \'DisableATMFD\' AND data \u0021= \'1\';","version":"2.2.1","platform":"windows"},"Protecting_Against_Weak_Crypto_Algo":{"interval":"3600","query":"select * from registry where path like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\OID\\\\EncodingType 0\\\\CertDllCreateCertificateChainEngine\\\\Config\\\\Default\\\\%\' AND name IN (\'WeakSha1ThirdPartyFlags\',\'WeakMd5ThirdPartyFlags\') AND type = \'REG_DWORD\' AND data not like \'-2%\';","version":"2.2.1","platform":"windows"},"UAC_Disabled":{"interval":"3600","query":"SELECT * FROM registry WHERE path=\'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Policies\\\\System\\\\EnableLUA\' AND data=0;","version":"2.2.1","platform":"windows"},"SecureBoot":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SecureBoot\\\\State\\\\UEFISecureBootEnabled\'","platform":"windows"},"FontBlocking":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows NT\\\\MitigationOptions\\\\MitigationOptions_FontBlocking\'","platform":"windows"},"DepPolicy":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\SystemStartOptions\'","platform":"windows"},"MitigationOptions":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\Kernel\\\\MitigationOptions\'","platform":"windows"},"MoveImages":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\Memory Management\\\\moveImages\'","platform":"windows"},"KernelSehopEnabled":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\Kernel\\\\KernelSEHOPEnabled\'","platform":"windows"},"EnableCertPaddingCheck":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Cryptography\\\\WinTrust\\\\Config\\\\EnableCertPaddingCheck\'","platform":"windows"},"EnableCertPaddingCheck_wow64":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Wow6432Node\\\\Microsoft\\\\Cryptography\\\\WinTrust\\\\Config\\\\EnableCertPaddingCheck\'","platform":"windows"},"CwdIllegalInDllSearch":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\CWDIllegalInDllSearch\'","platform":"windows"},"DisabledExceptionChainValidation":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\kernel\\\\DisableExceptionChainValidation\'","platform":"windows"},"EnableLowVaAccess":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\Memory Management\\\\EnableLowVaAccess\'","platform":"windows"},"ControlFlowGuard":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Session Manager\\\\Memory Management\\\\EnableCfg\'","platform":"windows"},"App_ExecuteOptions":{"interval":"86400","query":"select * from registry where key like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\%Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\%\\\\executeOptions\'","platform":"windows"},"App_MitigationOptions":{"interval":"86400","query":"select * from registry where key like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\%Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\%\\\\MitigationOptions\'","platform":"windows"},"AppCompat":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\%Microsoft\\\\Windows NT\\\\CurrentVersion\\\\AppCompatFlags\\\\Layers\'","platform":"windows"},"App_disabledExceptionChainValidation":{"interval":"86400","query":"select * from registry where key like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\%Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\%\\\\DisableExceptionChainValidation\'","platform":"windows"},"DefaultLevelMachine":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\DefaultLevel\'","platform":"windows"},"DefaultLevelUser":{"interval":"86400","query":"select * from registry where key like \'HKEY_USERS\\\\%\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\DefaultLevel\'","platform":"windows"},"PolicyScopeMachine":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\PolicyScope\'","platform":"windows"},"PolicyScopeUser":{"interval":"86400","query":"select * from registry where key like \'HKEY_USERS\\\\%\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\PolicyScope\'","platform":"windows"},"ExecutableTryMachine":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\ExecutableTry\'","platform":"windows"},"ExecutableTryUser":{"interval":"86400","query":"select * from registry where key like \'HKEY_USERS\\\\%\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\ExecutableTry\'","platform":"windows"},"TransparentEnabledMachine":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\TransparentEnabled\'","platform":"windows"},"TransparentEnabledUser":{"interval":"86400","query":"select * from registry where key like \'HKEY_USERS\\\\%\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\TransparentEnabled\'","platform":"windows"},"Unrestricted":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\262144\'","platform":"windows"},"Unrestricted_Paths":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\262144\\\\Paths\'","platform":"windows"},"Unrestricted_Paths_ItemData":{"interval":"86400","query":"select * from registry where key like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\262144\\\\Paths\\\\%\\\\ItemData\'","platform":"windows"},"Disallowed":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\0\'","platform":"windows"},"Disallowed_Paths":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\0\\\\Paths\'","platform":"windows"},"Disallowed_Paths_ItemData":{"interval":"86400","query":"select * from registry where key like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\0\\\\Paths\\\\%\\\\ItemData\'","platform":"windows"},"SaferFlags":{"interval":"86400","query":"select * from registry where key like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\Safer\\\\CodeIdentifiers\\\\%\\\\%\\\\%\\\\SaferFlags\'","platform":"windows"},"RuleSetEnforcementMode":{"interval":"86400","query":"select * from registry where key like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\SrpV2\\\\%\\\\EnforcementMode\'","platform":"windows"},"Rule":{"interval":"86400","query":"select * from registry where key like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Policies\\\\Microsoft\\\\Windows\\\\SrpV2\\\\%\\\\%\\\\Value\'","platform":"windows"},"AuditSpecialGroups":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\Audit\'","platform":"windows"},"SysmonConfig":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SYSTEM\\\\CCS\\\\Services\\\\SysmonDrv\\\\Parameters\'","platform":"windows"},"DeveloperMode":{"interval":"86400","query":"select * from registry where key=\'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\AppModelUnlock\'","platform":"windows"},"CCleaner_Trojan.Floxif":{"interval":"3600","query":"select * from registry where path like \'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Piriform\\\\Agomo%\';","version":"2.2.1","platform":"windows"},"CCleaner_Trojan_stage2.Floxif":{"interval":"3600","query":"select h.md5, h.sha1, h.sha256, s.name, s.service_type, s.display_name, s.module_path, s.user_account from services s, hash h where h.path = s.module_path and ((s.module_path like \'%GeeSetup_x86%\' and h.sha256 = \'dc9b5e8aa6ec86db8af0a7aa897ca61db3e5f3d2e0942e319074db1aaccfdc83\') or (s.module_path like \'%EFACli64%\' and h.sha256 = \'128aca58be325174f0220bd7ca6030e4e206b4378796e82da460055733bb6f4f\') or (s.module_path like \'%TSMSISrv%\' and h.sha256 = \'07fb252d2e853a9b1b32f30ede411f2efbb9f01e4a7782db5eacf3f55cf34902\'));","version":"2.1.0","platform":"windows"},"Winsecurity_info_1":{"interval":"3600","query":"select * from programs where name = \'Winsecurity.info\';","version":"2.2.1","platform":"windows"},"Winsecurity_info_2":{"interval":"3600","query":"select * from chrome_extensions join users using (uid) where name = \'Winsecurity.info\';","version":"2.2.1","platform":"windows"},"unTabs_1":{"interval":"3600","query":"select * from programs where name like \'unTabs%\';","version":"2.2.1","platform":"windows"},"unTabs_2":{"interval":"3600","query":"select * from chrome_extensions join users using (uid) where name like \'unTabs%\';","version":"2.2.1","platform":"windows"},"StickyKeys_File_Replace_Backdoor":{"interval":"3600","query":"SELECT * FROM hash WHERE (path=\'c:\\\\windows\\\\system32\\\\osk.exe\' OR path=\'c:\\\\windows\\\\system32\\\\sethc.exe\' OR path=\'c:\\\\windows\\\\system32\\\\narrator.exe\' OR path=\'c:\\\\windows\\\\system32\\\\magnify.exe\' OR path=\'c:\\\\windows\\\\system32\\\\displayswitch.exe\') AND sha256 IN (SELECT sha256 FROM hash WHERE path=\'c:\\\\windows\\\\system32\\\\cmd.exe\' OR path=\'c:\\\\windows\\\\system32\\\\WindowsPowerShell\\\\v1.0\\\\powershell.exe\' OR path=\'c:\\\\windows\\\\system32\\\\explorer.exe\') AND sha256\u0021=\'e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855\';","version":"2.2.1","platform":"windows"},"StickyKeys_Registry_Backdoor":{"interval":"3600","query":"SELECT * FROM registry WHERE key LIKE \'HKEY_LOCAL_MACHINE\\\\Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Image File Execution Options\\\\%%\' and name=\'Debugger\';","version":"2.2.1","platform":"windows"},"conhost.exe_incorrect_path":{"interval":"3600","query":"SELECT * FROM processes WHERE LOWER(name)=\'conhost.exe\' AND LOWER(path)\u0021=\'c:\\\\windows\\\\system32\\\\conhost.exe\' AND path\u0021=\'\';","version":"2.2.1","platform":"windows"},"dllhost.exe_incorrect_path":{"interval":"3600","query":"SELECT * FROM processes WHERE LOWER(name)=\'dllhost.exe\' AND LOWER(path)\u0021=\'c:\\\\windows\\\\system32\\\\dllhost.exe\' AND LOWER(path)\u0021=\'c:\\\\windows\\\\syswow64\\\\dllhost.exe\' AND path\u0021=\'\';","version":"2.2.1","platform":"windows"},"lsass.exe_incorrect_path":{"interval":"3600","query":"SELECT * FROM processes WHERE LOWER(name)=\'lsass.exe\' AND LOWER(path)\u0021=\'c:\\\\windows\\\\system32\\\\lsass.exe\' AND path\u0021=\'\';","version":"2.2.1","platform":"windows"},"services.exe_incorrect_parent_process":{"interval":"3600","query":"SELECT name FROM processes WHERE pid=(SELECT parent FROM processes WHERE LOWER(name)=\'services.exe\') AND LOWER(name)\u0021=\'wininit.exe\';","version":"2.2.1","platform":"windows"},"svchost.exe_incorrect_path":{"interval":"3600","query":"SELECT * FROM processes WHERE LOWER(name)=\'svchost.exe\' AND LOWER(path)\u0021=\'c:\\\\windows\\\\system32\\\\svchost.exe\' AND LOWER(path)\u0021=\'c:\\\\windows\\\\syswow64\\\\svchost.exe\' AND path\u0021=\'\';","version":"2.2.1","platform":"windows"},"svchost.exe_incorrect_parent_process":{"interval":"3600","query":"SELECT name FROM processes WHERE pid=(SELECT parent FROM processes WHERE LOWER(name)=\'svchost.exe\') AND LOWER(name)\u0021=\'services.exe\';","version":"2.2.1","platform":"windows"},"launchd":{"interval":"3600","query":"select * from launchd;","version":"1.4.5","platform":"darwin"},"startup_items":{"interval":"86400","query":"select * from startup_items;","version":"1.4.5","platform":"darwin"},"crontab":{"interval":"3600","query":"select * from crontab;","version":"1.4.5","platform":"darwin,linux"},"loginwindow1":{"interval":"86400","query":"select key, subkey, value from plist where path = \'/Library/Preferences/com.apple.loginwindow.plist\';","version":"1.4.5","platform":"darwin"},"loginwindow2":{"interval":"86400","query":"select key, subkey, value from plist where path = \'/Library/Preferences/loginwindow.plist\';","version":"1.4.5","platform":"darwin"},"loginwindow3":{"interval":"86400","query":"select username, key, subkey, value from plist p, (select * from users where directory like \'/Users/%\') u where p.path = u.directory || \'/Library/Preferences/com.apple.loginwindow.plist\';","version":"1.4.5","platform":"darwin"},"loginwindow4":{"interval":"86400","query":"select username, key, subkey, value from plist p, (select * from users where directory like \'/Users/%\') u where p.path = u.directory || \'/Library/Preferences/loginwindow.plist\';","version":"1.4.5","platform":"darwin"},"alf":{"interval":"3600","query":"select * from alf;","version":"1.4.5","platform":"darwin"},"alf_exceptions":{"interval":"3600","query":"select * from alf_exceptions;","version":"1.4.5","platform":"darwin"},"alf_services":{"interval":"3600","query":"select * from alf_services;","version":"1.4.5","platform":"darwin"},"alf_explicit_auths":{"interval":"3600","query":"select * from alf_explicit_auths;","version":"1.4.5","platform":"darwin"},"etc_hosts":{"interval":"86400","query":"select * from etc_hosts;","version":"1.4.5","platform":"darwin,linux"},"kextstat":{"interval":"3600","query":"select * from kernel_extensions;","version":"1.4.5","platform":"darwin"},"kernel_modules":{"interval":"3600","query":"select * from kernel_modules;","version":"1.4.5","platform":"linux"},"last":{"interval":"3600","query":"select * from last;","version":"1.4.5","platform":"darwin,linux"},"installed_applications":{"interval":"3600","query":"select * from apps;","version":"1.4.5","platform":"darwin"},"open_sockets":{"interval":"86400","query":"select distinct pid, family, protocol, local_address, local_port, remote_address, remote_port, path from process_open_sockets where path <> \'\' or remote_address <> \'\';","version":"1.4.5","platform":"darwin,linux"},"open_files":{"interval":"86400","query":"select distinct pid, path from process_open_files where path not like \'/private/var/folders%\' and path not like \'/System/Library/%\' and path not in (\'/dev/null\', \'/dev/urandom\', \'/dev/random\');","version":"1.4.5","platform":"darwin,linux"},"logged_in_users":{"interval":"3600","query":"select liu.*, p.name, p.cmdline, p.cwd, p.root from logged_in_users liu, processes p where liu.pid = p.pid;","version":"1.4.5","platform":"darwin,linux"},"ip_forwarding":{"interval":"3600","query":"select * from system_controls where oid = \'4.30.41.1\' union select * from system_controls where oid = \'4.2.0.1\';","version":"1.4.5","platform":"darwin,linux"},"process_env":{"interval":"86400","query":"select * from process_envs;","version":"1.4.5","platform":"darwin,linux"},"mounts":{"interval":"3600","query":"select * from mounts;","version":"1.4.5","platform":"darwin,linux"},"nfs_shares":{"interval":"3600","query":"select * from nfs_shares;","version":"1.4.5","platform":"darwin"},"shell_history":{"interval":"86400","query":"select * from users join shell_history using (uid);","version":"1.4.5","platform":"darwin,linux"},"recent_items":{"interval":"86400","query":"select username, key, value from plist p, (select * from users where directory like \'/Users/%\') u where p.path = u.directory || \'/Library/Preferences/com.apple.recentitems.plist\';","version":"1.4.5","platform":"darwin"},"ramdisk":{"interval":"3600","query":"select * from block_devices where type = \'Virtual Interface\';","version":"1.4.5","platform":"darwin,linux"},"listening_ports":{"interval":"3600","query":"select * from listening_ports;","version":"1.4.5","platform":"darwin,linux"},"suid_bin":{"interval":"3600","query":"select * from suid_bin;","version":"1.4.5","platform":"darwin,linux"},"process_memory":{"interval":"86400","query":"select * from process_memory_map;","version":"1.4.5","platform":"linux"},"arp_cache":{"interval":"3600","query":"select * from arp_cache;","version":"1.4.5"},"wireless_networks":{"interval":"3600","query":"select ssid, network_name, security_type, last_connected, captive_portal, possibly_hidden, roaming, roaming_profile from wifi_networks;","version":"1.6.0","platform":"darwin"},"disk_encryption":{"interval":"86400","query":"select * from disk_encryption;","version":"1.4.5","platform":"darwin,linux"},"iptables":{"interval":"3600","query":"select * from iptables;","version":"1.4.5","platform":"linux"},"app_schemes":{"interval":"86400","query":"select * from app_schemes;","version":"1.4.7","platform":"darwin"},"sandboxes":{"interval":"86400","query":"select * from sandboxes;","version":"1.4.7","platform":"darwin"}},"enabled":true}' \