diff --git a/schema/README.md b/schema/README.md index 795a3aa47e..6a1f120991 100644 --- a/schema/README.md +++ b/schema/README.md @@ -1,7 +1,28 @@ ## Hello! Welcome to Fleet's osquery tables documentation. -This file contains additional documentation that we add on top of the existing documentation for osquery to make the documentation of each table more useful for Fleet users. +This folder contains additional documentation that we add on top of the existing documentation for osquery to make the documentation of each table more useful for Fleet users. + +Fleet's schema tables live in the `tables/` folder. Each osquery table with Fleet overrides has a corresponding YAML file that will override information in the osquery schema documentation. The existing documentation data lives in the osquery repo at: https://github.com/osquery/osquery-site/tree/source/src/data/osquery_schema_versions. -You can open PRs against either this file or the osquery schema file. Just note that the data in this file overwrites the osquery data whenever there is a conflict. +You can open PRs against a table's YAML file in the `tables/` folder or the osquery schema file. Just note that the data in a table's YAML file overwrites the osquery data whenever there is a conflict. + +When adding a new YAML override to Fleet's osquery schema you can use this template: + +```yaml +name: # (required) string - The name of the table. +description: >- # (required) string - The description for this table. Note: this field supports markdown + # Add description here +examples: >- # (optional) string - An example query for this table. Note: This field supports markdown + # Add examples here +notes: >- # (optional) string - Notes about this table. Note: This field supports markdown. + # Add notes here +columns: # (required) array - An array of columns in this table + - name: # (required) string - The name of the column + description: # (required) string - The column's description + type: # (required) string - the column's data type + required: # (required) boolean - whether or not this column is required to query this table. +``` + +Alternatively, if you want to add documentation about an osquery table for which we don't have a YAML override, you can find the table's page on the [Fleet website](https://fleetdm.com/tables) and click the "edit page" button. Clicking this button will take you to the GitHub web editor with the template pre-filled. After you add information about the table and its columns, you can open a new pull request to add the new YAML file to Fleet's overrides.