Merge branch 'develop' into journalctl

CHANGELOG.md

@@ -2,6 +2,32 @@
 
 ## DEVELOPMENT VERSION
 
+### Artifacts
+
+- files/applications/ark.yaml: Added collection of metadata about recently opened archive files in Ark, the KDE archive manager [freebsd, linux, netbsd, openbsd].
+- files/applications/dolphin.yaml: Added collection of session data for the Dolphin file manager in the KDE desktop environment. This file contains information about the state of the Dolphin application, such as the currently open directories and their paths and the last accessed locations [freebsd, linux, netbsd, openbsd].
+- files/applications/dragon_player.yaml: Added collection of paths to recently opened video files using the Dragon Player [freebsd, linux, netbsd, openbsd].
+- files/applications/geany.yaml: Added collection of metadata about recently opened files in Geany text editor [freebsd, linux, netbsd, openbsd].
+- files/applications/gedit.yaml: Added collection of metadata about recently opened files in Gedit text editor [freebsd, linux, netbsd, openbsd].
+- files/applications/gnome_text_editor.yaml: Added collection of metadata about recently opened files in Gnome Text Editor [freebsd, linux, netbsd, openbsd].
+- files/applications/katesession.yaml: Added colleection of metadata about recently opened files in Kwrite and Kate text editors [freebsd, linux, netbsd, openbsd].
+- files/applications/okular.yaml: Added collection of metadata related to documents that have been opened or interacted with using Okular, a document viewer for KDE [freebsd, linux, netbsd, openbsd].
+- files/system/gvfs_metadata.yaml: Added collection of data from the gvfs-metadata directory to retrieve user-specific metadata, such as file access details, custom properties, and interaction history [freebsd, linux, netbsd, openbsd].
+- files/system/kactivitymanagerd.yaml: Added collection of activity tracking data used by KActivityManager (part of KDE) to track and manage user activities, such as recently opened files, applications, and other resources [freebsd, linux, netbsd, openbsd].
+- files/system/upstart.yaml: Added collection of system-wide and user-session Upstart configuration files [linux].
+- files/system/xdg_autostart.yaml: Added collection of system-wide and user-specific XDG autostart files [linux].
+- live_response/packages/conary.yaml: Added collection of the list of installed packages managed by the Conary package manager [linux] (by [Pierre-Gronau-ndaal](https://github.com/Pierre-Gronau-ndaal)).
+- live_response/packages/dpkg.yaml: Updated to verify all packages to compare information about the installed files in the package with information about the files taken from the package metadata stored in the dpkg database [linux] ([mnrkbys](https://github.com/mnrkbys)).
+- live_response/packages/package_owns_file.yaml: Added collection of which installed package owns a specific file or command. Note that this artifact is resource-intensive and time-consuming to execute, so it is disabled by default in all profiles [linux] ([mnrkbys](https://github.com/mnrkbys)).
+- live_response/packages/paludis.yaml: Added collection of the list of installed packages managed by the Paludis package manager [linux] (by [Pierre-Gronau-ndaal](https://github.com/Pierre-Gronau-ndaal)).
+- live_response/packages/portage.yaml: Added the collection of installed package lists using the Portage package management system [linux] (by [Pierre-Gronau-ndaal](https://github.com/Pierre-Gronau-ndaal)).
+- live_response/storage/findmnt.yaml: Added JSON output format for listing all mounted file systems [linux] ([mnrkbys](https://github.com/mnrkbys)).
+- live_response/storage/lsblk.yaml: Added JSON output format for listing block devices [linux] ([mnrkbys](https://github.com/mnrkbys)).
+- live_response/system/coredump.yaml: Added collection of core dump files information [linux] ([mnrkbys](https://github.com/mnrkbys)).
+- live_response/system/getcap.yaml: Added functionality to collect the list of files with associated process capabilities [linux] ([mnrkbys](https://github.com/mnrkbys)).
+- live_response/system/ulimit.yaml: Added collection of all resource limits information [all] ([mnrkbys](https://github.com/mnrkbys)).
+- memory_dump/coredump.yaml: Added collection of core dump, ABRT, Apport, and kdump files [esxi, linux, netbsd] ([mnrkbys](https://github.com/mnrkbys)).
+
 ### New Artifacts Properties
 
 - Added the new 'redirect_stderr_to_stdout' property, an optional feature available exclusively for the command collector. When set to true, this property redirects all error messages (stderr) to standard output (stdout), ensuring they are written to the output file.

artifacts/files/applications/ark.yaml

@@ -0,0 +1,28 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect metadata about recently opened archive files in Ark, the KDE archive manager.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.local/share
+    name_pattern: ["ark_recentfiles"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect metadata about recently opened archive files in Ark, the KDE archive manager (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    name_pattern: ["ark_recentfiles"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect metadata about recently opened archive files in Ark, the KDE archive manager (Snap version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/snap
+    name_pattern: ["ark_recentfiles"]
+    file_type: [f]
+    exclude_nologin_users: true
+
+

artifacts/files/applications/dolphin.yaml

@@ -0,0 +1,27 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect session data for the Dolphin file manager in the KDE desktop environment. This file contains information about the state of the Dolphin application, such as the currently open directories and their paths and the last accessed locations.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.config
+    name_pattern: ["dolphin_dolphin_dolphin"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect session data for the Dolphin file manager in the KDE desktop environment. This file contains information about the state of the Dolphin application, such as the currently open directories and their paths and the last accessed locations (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    name_pattern: ["dolphin_dolphin_dolphin"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect session data for the Dolphin file manager in the KDE desktop environment. This file contains information about the state of the Dolphin application, such as the currently open directories and their paths and the last accessed locations (Snap version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/snap
+    name_pattern: ["dolphin_dolphin_dolphin"]
+    file_type: [f]
+    exclude_nologin_users: true
+

artifacts/files/applications/dragon_player.yaml

@@ -0,0 +1,27 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect the paths to recently opened video files using the Dragon Player.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.config
+    name_pattern: ["dragonplayerrc"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect the paths to recently opened video files using the Dragon Player (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    name_pattern: ["dragonplayerrc"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect the paths to recently opened video files using the Dragon Player (Snap version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/snap
+    name_pattern: ["dragonplayerrc"]
+    file_type: [f]
+    exclude_nologin_users: true
+

artifacts/files/applications/geany.yaml

@@ -0,0 +1,32 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect metadata about recently opened files in Geany text editor.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.config/geany
+    name_pattern: ["session.conf"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect metadata about recently opened files in Geany text editor (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    path_pattern: ["*/config/geany/*"]
+    name_pattern: ["session.conf"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect metadata about recently opened files in Geany text editor (Snap version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/snap
+    path_pattern: ["*/.config/geany/*"]
+    name_pattern: ["session.conf"]
+    file_type: [f]
+    exclude_nologin_users: true
+
+
+
+

artifacts/files/applications/gedit.yaml

@@ -0,0 +1,30 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect metadata about recently opened files in Gedit text editor.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.local/share
+    name_pattern: ["gedit-metadata.xml"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect metadata about recently opened files in Gedit text editor (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    name_pattern: ["gedit-metadata.xml"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect metadata about recently opened files in Gedit text editor (Snap version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/snap
+    name_pattern: ["gedit-metadata.xml"]
+    file_type: [f]
+    exclude_nologin_users: true
+
+
+
+

artifacts/files/applications/gnome_text_editor.yaml

@@ -0,0 +1,27 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect metadata about recently opened files in Gnome Text Editor.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.local/share
+    name_pattern: ["session.gvariant"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect metadata about recently opened files in Gnome Text Editor (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    name_pattern: ["session.gvariant"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect metadata about recently opened files in Gnome Text Editor (Snap version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/snap
+    name_pattern: ["session.gvariant"]
+    file_type: [f]
+    exclude_nologin_users: true
+

artifacts/files/applications/google_earth.yaml

@@ -7,6 +7,13 @@ artifacts:
     path: /%user_home%/.googleearth
     name_pattern: ["*.kml"]
     exclude_nologin_users: true
+  -
+    description: Collect Google Earth KML files (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    name_pattern: ["*.kml"]
+    exclude_nologin_users: true
   -
     description: Collect Google Earth KML files.
     supported_os: [macos]

artifacts/files/applications/gwenview.yaml

@@ -0,0 +1,27 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect the paths to recently viewed or edited images using Gwenview image viewer.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.config
+    name_pattern: ["gwenviewrc"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect the paths to recently viewed or edited images using Gwenview image viewer (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    name_pattern: ["gwenviewrc"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect the paths to recently viewed or edited images using Gwenview image viewer (Snap version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/snap
+    name_pattern: ["gwenviewrc"]
+    file_type: [f]
+    exclude_nologin_users: true
+

artifacts/files/applications/katesession.yaml

@@ -0,0 +1,28 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect metadata about recently opened files in Kwrite and Kate text editors.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.local/share
+    name_pattern: ["anonymous.katesession"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect metadata about recently opened files in Kwrite and Kate text editors (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    name_pattern: ["anonymous.katesession"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect metadata about recently opened files in Kwrite and Kate text editors (Snap version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/snap
+    name_pattern: ["anonymous.katesession"]
+    file_type: [f]
+    exclude_nologin_users: true
+
+

artifacts/files/applications/okular.yaml

@@ -0,0 +1,54 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect metadata related to documents that have been opened or interacted with using Okular, a document viewer for KDE.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.local/share
+    path_pattern: ["*/okular/docdata/*"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect Okular configuration file.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.config
+    name_pattern: ["okularrc"]
+    file_type: [f]
+    ignore_date_range: true
+    exclude_nologin_users: true
+  -
+    description: Collect metadata related to documents that have been opened or interacted with using Okular, a document viewer for KDE (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    path_pattern: ["*/okular/docdata/*"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect Okular configuration file (Flatpak version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/.var/app
+    name_pattern: ["okularrc"]
+    file_type: [f]
+    ignore_date_range: true
+    exclude_nologin_users: true
+  -
+    description: Collect metadata related to documents that have been opened or interacted with using Okular, a document viewer for KDE (Snap version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/snap
+    path_pattern: ["*/okular/docdata/*"]
+    file_type: [f]
+    exclude_nologin_users: true
+  -
+    description: Collect Okular configuration file (Snap version).
+    supported_os: [linux]
+    collector: file
+    path: /%user_home%/snap
+    name_pattern: ["okularrc"]
+    file_type: [f]
+    ignore_date_range: true
+    exclude_nologin_users: true
+

artifacts/files/browsers/firefox.yaml

@@ -1,11 +1,11 @@
-version: 4.0
+version: 4.1
 artifacts:
   -
     description: Collect Firefox browser files.
     supported_os: [freebsd, linux]
     collector: file
     path: /%user_home%/.mozilla/firefox
-    name_pattern: ["addons.*", "bookmarks.sqlite*", "cookies.sqlite*", "downloads.sqlite*", "extensions.json", "favicons.sqlite*", "firefox_cookies.sqlite*", "formhistory.sqlite*", "key*.db", "logins.json", "permissions.sqlite*", "places.sqlite*", "prefs.js", "protections.sqlite*", "search.sqlite*", "signon*.*", "signons.sqlite*", "storage-sync*.sqlite*", "webappstore.sqlite*"]
+    name_pattern: ["addons.*", "bookmarks.sqlite*", "cookies.sqlite*", "downloads.rdf", "downloads.sqlite*", "extensions.json", "favicons.sqlite*", "firefox_cookies.sqlite*", "formhistory.sqlite*", "key*.db", "logins.json", "permissions.sqlite*", "places.sqlite*", "prefs.js", "protections.sqlite*", "search.sqlite*", "signon*.*", "signons.sqlite*", "storage-sync*.sqlite*", "webappstore.sqlite*"]
     ignore_date_range: true
     exclude_nologin_users: true
   -

artifacts/files/packages/dpkg.yaml

@@ -1,9 +1,14 @@
-version: 1.0
+version: 1.1
 artifacts:
   -
     description: Collect dpkg packages status file.
     supported_os: [linux]
     collector: file
     path: /var/lib/dpkg/status
     ignore_date_range: true
-
+  -
+    description: Collect dpkg packages log file.
+    supported_os: [linux]
+    collector: file
+    path: /var/log/dpkg.log
+    ignore_date_range: true

artifacts/files/system/etc.yaml

@@ -23,3 +23,7 @@ artifacts:
     exclude_name_pattern: ["shadow", "shadow-"]
     file_type: [f]
     ignore_date_range: true
+
+# References:
+# https://www.elastic.co/security-labs/primer-on-persistence-mechanisms
+# https://www.elastic.co/security-labs/sequel-on-persistence-mechanisms

artifacts/files/system/gvfs_metadata.yaml

@@ -0,0 +1,10 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect data from the gvfs-metadata directory to retrieve user-specific metadata, such as local and remote file access details, custom properties, and interaction history.
+    supported_os: [freebsd, linux, netbsd, openbsd]
+    collector: file
+    path: /%user_home%/.local/share/gvfs-metadata
+    file_type: [f]
+    exclude_nologin_users: true
+