Merge pull request #238 from Herbert-Karl/thesis

BSD related artifacts

artifacts/files/logs/openbsd.yaml

@@ -0,0 +1,8 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect kernel relink log file.
+    supported_os: [openbsd]
+    collector: file
+    path: /usr/share/relink/kernel
+    path_pattern: ["*/relink.log"]

artifacts/files/system/acct.yaml

@@ -0,0 +1,20 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect system accounting files.
+    supported_os: [freebsd, netbsd, openbsd]
+    collector: file
+    path: /var/account/acct*
+    ignore_date_range: true
+  -
+    description: Collect system accounting user based summary file.
+    supported_os: [freebsd, netbsd, openbsd]
+    collector: file
+    path: /var/account/usracct
+    ignore_date_range: true
+  -
+    description: Collect system accounting command based summary file.
+    supported_os: [freebsd, netbsd, openbsd]
+    collector: file
+    path: /var/account/savacct
+    ignore_date_range: true

artifacts/files/system/device_db.yaml

@@ -0,0 +1,12 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect database file used for device lookups.
+    supported_os: [openbsd]
+    collector: file
+    path: /var/run/dev.db
+  -
+    description: Collect database file used for device lookups.
+    supported_os: [netbsd]
+    collector: file
+    path: /var/run/dev.cdb

artifacts/files/system/locate_db.yaml

@@ -0,0 +1,7 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect database file used by locate command, representing a snapshot of the virtual file system accessible with minimal permissions.
+    supported_os: [freebsd, netbsd, openbsd]
+    collector: file
+    path: /var/db/locate.database

artifacts/files/system/security_backups.yaml

@@ -0,0 +1,10 @@
+version: 1.0
+artifacts:
+  -
+    description: Collect file backups and hashes created by the integrated security script of BSDs.
+    supported_os: [freebsd, netbsd, openbsd]
+    collector: file
+    path: /var/backups
+    name_pattern: ["*.current", "*.backup", "*.current.sha256", "*.backup.sha256"]
+    exclude_name_pattern: ["master.passwd.current", "master.passwd.backup"]
+    ignore_date_range: true

artifacts/live_response/hardware/dmesg.yaml

@@ -1,8 +1,20 @@
-version: 1.0
+version: 1.1
 artifacts:
   -
     description: Display the system/kernel message buffer.
     supported_os: [android, freebsd, linux, macos, netbsd, netscaler, openbsd, solaris]
     collector: command
     command: dmesg
     output_file: dmesg.txt
+  -
+    description: Display the console message buffer.
+    supported_os: [openbsd]
+    collector: command
+    command: dmesg -s
+    output_file: dmesg_-s.txt
+  -
+    description: Display all data from the message buffer, including syslog records and console output.
+    supported_os: [freebsd]
+    collector: command
+    command: dmesg -a
+    output_file: dmesg_-a.txt

artifacts/live_response/system/lastcomm.yaml

@@ -0,0 +1,16 @@
+version: 1.0
+artifacts:
+  -
+    description: Shows the last commands executed in a reverse order based on the default accounting file.
+    supported_os: [freebsd, netbsd, openbsd]
+    collector: command
+    command: lastcomm
+    output_file: lastcomm.txt
+  -
+    description: Shows the last commands executed in a reverse order from the historic accounting files.
+    supported_os: [freebsd, netbsd, openbsd]
+    collector: command
+    foreach: for acctfile in /var/account/acct.[0123]; do echo ${acctfile} | sed -e 's:/var/account/acct.::'; done
+    command: lastcomm -f /var/account/acct.%line%
+    output_file: lastcomm_%line%.txt
+