Add Osquery CC

[np5]

No description provided.

[github-actions]

Terraform Plan Output

Click to expand

Terraform used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
  + create

Terraform will perform the following actions:

  # zentral_osquery_configuration_pack.default-compliance-checks will be created
  + resource "zentral_osquery_configuration_pack" "default-compliance-checks" {
      + configuration_id = 1
      + id               = (known after apply)
      + pack_id          = (known after apply)
      + tag_ids          = (known after apply)
    }

  # zentral_osquery_pack.compliance-checks will be created
  + resource "zentral_osquery_pack" "compliance-checks" {
      + description       = "The compliance checks for our macOS client"
      + discovery_queries = (known after apply)
      + id                = (known after apply)
      + name              = "Compliance checks"
      + slug              = (known after apply)
        # (1 unchanged attribute hidden)
    }

  # zentral_osquery_query.santa-sysext-cc will be created
  + resource "zentral_osquery_query" "santa-sysext-cc" {
      + compliance_check_enabled = true
      + description              = "Check if the Santa system extension is activated, running and up-to-date"
      + id                       = (known after apply)
      + name                     = "Santa system extension check"
      + platforms                = [
          + "darwin",
        ]
      + scheduling               = {
          + can_be_denylisted   = true
          + interval            = 3600
          + log_removed_actions = false
          + pack_id             = (known after apply)
          + snapshot_mode       = true
        }
      + sql                      = <<-EOT
            WITH expected_sysexts(team, identifier, min_version) AS (
              VALUES ('EQHXZ8M8AV', 'com.google.santa.daemon', '2024.5')
            ), found_sysexts AS (
              SELECT expected_sysexts.*, system_extensions.version, system_extensions.state,
              CASE
                WHEN system_extensions.version >= expected_sysexts.min_version
                  AND system_extensions.state == 'activated_enabled'
                THEN 'OK'
                ELSE 'FAILED'
              END individual_ztl_status
              FROM expected_sysexts
              LEFT JOIN system_extensions ON (
                system_extensions.team = expected_sysexts.team
                AND system_extensions.identifier = expected_sysexts.identifier
              )
            ) SELECT team, identifier, version, state, MAX(individual_ztl_status) OVER () ztl_status
            FROM found_sysexts
        EOT
      + value                    = ""
      + version                  = (known after apply)
    }

Plan: 3 to add, 0 to change, 0 to destroy.

[whoami-np5]

LGTM