# osquery 5.15.0

- Product: osquery (https://whatsnew.fyi/product/osquery)
- Vendor: osquery
- Date: 2024-12-30
- Version: 5.15.0
- Original notes: https://github.com/osquery/osquery/releases/tag/5.15.0
- Permalink: https://whatsnew.fyi/product/osquery/releases/5.15.0

What's New is an index, not a publisher: every entry below links to the vendor's own release notes, which are the authoritative source. Entries are labelled where they are hand-curated sample data, pre-releases, or drawn from a secondary source such as a developer blog.

Reuse: the summaries, labels and curation here are © What's New. Quote freely with attribution and a link back; wholesale republication of the corpus is not permitted — terms: https://whatsnew.fyi/terms. The vendors' own release notes remain their publishers'.

---

- **added** — Add arc path to chrome_extensions table on macOS
- **added** — Add support for accept to macOS table socket_events
- **added** — Add all-platform user-based optimized columns
- **added** — Add columns to es_process_events
- **added** — Add Darwin platform optimized miscellaneous columns
- **added** — Add all-platform path-based optimized columns
- **added** — Add Windows platform optimized columns
- **added** — Add hash_executable column to signature table
- **added** — Include VSCode Insiders extensions in vscode_extensions table
- **added** — Add POSIX platforms optimized columns
- **added** — Add Linux platform optimized columns
- **added** — Add all platform process based and curl optimized columns
- **added** — Add Darwin platform optimized system-related columns
- **added** — Add Darwin platform optimized path columns
- **changed** — Use empty columns instead of zeroes when undefined in socket_events
- **changed** — Update the browser_firefox table to exclude Crash Reports and Pending Pings folders
- **changed** — Move status column to extended_schema for linux socket_events
- **fixed** — Fix incorrect SID in logged_in_users table on windows when username and domain/device name are the same
- **fixed** — Fix a leak in genAarch64PlatformInfo

<a name="5.15.0"></a>
##### [5.15.0](https://github.com/osquery/osquery/releases/tag/5.15.0)

[Git Commits](https://github.com/osquery/osquery/compare/5.14.1...5.15.0)

Representing commits from 17 contributors! Thank you all.

###### Table Changes

- Add arc path to `chrome_extensions` on macOS ([#8473](https://github.com/osquery/osquery/pull/8473))
- Use empty columns instead of zeroes when undefined in `socket_events` ([#8510](https://github.com/osquery/osquery/pull/8510))
- Add support for accept to macOS table `socket_events` ([#8508](https://github.com/osquery/osquery/pull/8508))
- Add all-platform user-based optimized columns ([#8496](https://github.com/osquery/osquery/pull/8496))
- Add columns to `es_process_events` ([#8506](https://github.com/osquery/osquery/pull/8506))
- Add Darwin platform optimized miscellaneous columns ([#8484](https://github.com/osquery/osquery/pull/8484))
- Add all-platform path-based optimized columns ([#8497](https://github.com/osquery/osquery/pull/8497))
- Add Windows platform optimized columns ([#8495](https://github.com/osquery/osquery/pull/8495))
- Add `hash_executable` column to `signature` table ([#8471](https://github.com/osquery/osquery/pull/8471))
- Include VSCode Insiders extensions in `vscode_extensions` table ([#8396](https://github.com/osquery/osquery/pull/8396))
- Add POSIX platforms optimized columns ([#8494](https://github.com/osquery/osquery/pull/8494))
- Add Linux platform optimized columns ([#8493](https://github.com/osquery/osquery/pull/8493))
- Add all platform process based and curl optimized columns ([#8498](https://github.com/osquery/osquery/pull/8498))
- Add Darwin platform optimized system-related columns ([#8483](https://github.com/osquery/osquery/pull/8483))
- Add Darwin platform optimized path columns ([#8482](https://github.com/osquery/osquery/pull/8482))
- Fix incorrect SID in `logged_in_users` table on windows when username and domain/device name are the same ([#8486](https://github.com/osquery/osquery/pull/8486))
- Update the `browser_firefox` table to exclude "Crash Reports" and "Pending Pings" folders ([#8478](https://github.com/osquery/osquery/pull/8478))
- Move status column to `extended_schema` for linux `socket_events` ([#8503](https://github.com/osquery/osquery/pull/8503))

###### Under the Hood improvements

- Utils: Optimize default status message constructor ([#8489](https://github.com/osquery/osquery/pull/8489))

###### Bug Fixes

- Fix a leak in `genAarch64PlatformInfo` ([#8462](https://github.com/osquery/osquery/pull/8462))
- Fix a leak in `DiskArbitrationEventPublisher::getProperty` ([#8463](https://github.com/osquery/osquery/pull/8463))
- Catching generic exception in order to avoid crashing when parsing windows events logs ([#8513](https://github.com/osquery/osquery/pull/8513))
- Fix leak in `windows_events` by using `scope_guard` ([#8511](https://github.com/osquery/osquery/pull/8511))
- Fixed eBPF's parsing of parent pid ([#8501](https://github.com/osquery/osquery/pull/8501))
- Fix IO objects refcounting ([#8481](https://github.com/osquery/osquery/pull/8481))

###### Documentation

- Add documentation for testing macOS EndpointSecurity ([#8509](https://github.com/osquery/osquery/pull/8509))
- Add double quotes in Windows installation documentation ([#8492](https://github.com/osquery/osquery/pull/8492))
- Update expired Slack invite ([#8488](https://github.com/osquery/osquery/pull/8488))
- Update docs to correctly define `conditional_to_base64` ([#8460](https://github.com/osquery/osquery/pull/8460))

###### Build

- build(deps): bump jinja2 from 3.1.4 to 3.1.5 ([#8507](https://github.com/osquery/osquery/pull/8507))
- Remove yara schema subdirectory ([#8461](https://github.com/osquery/osquery/pull/8461))
- Added chrono header file ([#8512](https://github.com/osquery/osquery/pull/8512))
- Replace usage of libaudit function removed in v3.0.7 ([#8401](https://github.com/osquery/osquery/pull/8401))

_[Truncated at 4000 characters — full notes: https://github.com/osquery/osquery/releases/tag/5.15.0]_