Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Update schema folder readme (#9502)

Browse Source 
Changes:
- Updated the `schema/` folder readme to have information about the
`schema/tables/` folder, and YAML overrides.
This commit is contained in:
Eric
2023-01-25 14:29:03 -06:00
committed by GitHub
parent d7f77f55ce
commit 055031e19f
1 changed files with 23 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
schema/README.md
+23 -2
View File
@@ -1,7 +1,28 @@
## Hello! Welcome to Fleet's osquery tables documentation.
This file contains additional documentation that we add on top of the existing documentation for osquery to make the documentation of each table more useful for Fleet users.
This folder contains additional documentation that we add on top of the existing documentation for osquery to make the documentation of each table more useful for Fleet users.
Fleet's schema tables live in the `tables/` folder. Each osquery table with Fleet overrides has a corresponding YAML file that will override information in the osquery schema documentation.
The existing documentation data lives in the osquery repo at: https://github.com/osquery/osquery-site/tree/source/src/data/osquery_schema_versions.
You can open PRs against either this file or the osquery schema file. Just note that the data in this file overwrites the osquery data whenever there is a conflict.
You can open PRs against a table's YAML file in the `tables/` folder or the osquery schema file. Just note that the data in a table's YAML file overwrites the osquery data whenever there is a conflict.
When adding a new YAML override to Fleet's osquery schema you can use this template:
```yaml
name: # (required) string - The name of the table.
description: >- # (required) string - The description for this table. Note: this field supports markdown
# Add description here
examples: >- # (optional) string - An example query for this table. Note: This field supports markdown
# Add examples here
notes: >- # (optional) string - Notes about this table. Note: This field supports markdown.
# Add notes here
columns: # (required) array - An array of columns in this table
- name: # (required) string - The name of the column
description: # (required) string - The column's description
type: # (required) string - the column's data type
required: # (required) boolean - whether or not this column is required to query this table.
```
Alternatively, if you want to add documentation about an osquery table for which we don't have a YAML override, you can find the table's page on the [Fleet website](https://fleetdm.com/tables) and click the "edit page" button. Clicking this button will take you to the GitHub web editor with the template pre-filled. After you add information about the table and its columns, you can open a new pull request to add the new YAML file to Fleet's overrides.