Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 19 Packages Projects Releases Wiki Activity

Schema: Regenerate merged schema JSON (#13311)

Browse Source 
Changes
- Ran the `generate-merged-schema` script to regenerate
`schema/osquery_fleet_schema.json`.
This commit is contained in:
Eric
2023-08-15 18:35:19 -05:00
committed by GitHub
parent 2a02936ed6
commit 08af35d294
1 changed files with 179 additions and 178 deletions
Download Patch File Download Diff File Expand all files Collapse all files
schema/osquery_fleet_schema.json
+179 -178
View File
@@ -3642,7 +3642,7 @@
],
"evented": false,
"cacheable": false,
"notes": "",
"notes": "- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n",
"examples": "List Chrome extensions by user and profile which have full access to HTTPS browsing.\n```\nSELECT u.username, ce.name, ce.description, ce.version, ce.profile, ce.permissions FROM users u CROSS JOIN chrome_extensions ce USING (uid) WHERE ce.permissions LIKE '%%https://*/*%%';\n```",
"columns": [
{
@@ -5990,7 +5990,7 @@
],
"evented": false,
"cacheable": false,
"notes": "- For ChromeOS, this table is not a core osquery table. It is included as part of the Fleetd Chrome extension. Available for Chrome 91+.",
"notes": "- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n- Available for ChromeOS 91+.\n",
"examples": "``` SELECT * FROM disk_info; ```",
"columns": [
{
@@ -15030,7 +15030,7 @@
"evented": false,
"cacheable": false,
"notes": "",
"examples": "If this query returns a 1 in the enabled column, location services are enabled on this Mac.\n```\nSELECT enabled from location_services;\n```",
"examples": "Returns the drive free space in gigabytes and as percentage.\n```\nSELECT path, type, ROUND((blocks_available * blocks_size * 10e-10), 2) AS free_gb, ROUND ((blocks_available * 1.0 / blocks * 1.0) * 100, 2) AS free_pc FROM mounts WHERE path = '/';\n```",
"columns": [
{
"name": "device",
@@ -15284,7 +15284,7 @@
},
{
"name": "npm_packages",
"description": "Node packages installed in a system.",
"description": "Node.js packages globally installed on a system.",
"url": "https://fleetdm.com/tables/npm_packages",
"platforms": [
"darwin",
@@ -15294,7 +15294,7 @@
"evented": false,
"cacheable": false,
"notes": "",
"examples": "List the author, description and more information about packages made by Fleet. Replace the homepage with any other distributor desired.\n```\nSELECT author, description, directory, version FROM npm_packages WHERE homepage='https://fleetdm.com';\n```",
"examples": "List the author, description and more information about the NPM package called `webpack`, if installed:\n```sql SELECT author, description, directory, version FROM npm_packages WHERE name='webpack'; ```",
"columns": [
{
"name": "name",
@@ -15835,7 +15835,7 @@
],
"evented": false,
"cacheable": false,
"notes": "",
"notes": "- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n",
"examples": "See the OS version as well as the CPU architecture in use (X86 vs ARM for example)\n```\nSELECT arch, version FROM os_version;\n```",
"columns": [
{
@@ -16201,7 +16201,7 @@
],
"evented": false,
"cacheable": false,
"notes": "",
"notes": "- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n",
"examples": "See the version of the currently running osquery.\n```\nSELECT version FROM osquery_info; \n```",
"columns": [
{
@@ -20770,7 +20770,7 @@
],
"evented": false,
"cacheable": false,
"notes": "- For macOS, this only fetches results for osquery's current logged-in user context. The user must also have recently logged in. - For ChromeOS, this table is not a core osquery table. It is included as part of the Fleetd Chrome extension. Available for Chrome 73+.",
"notes": "- For macOS, this only fetches results for osquery's current logged-in user context. The user must also have recently logged in.\n- For ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n- For ChromeOS, this table is only available for Chrome 73+.\n",
"examples": [],
"columns": [
{
@@ -23071,7 +23071,7 @@
],
"evented": false,
"cacheable": false,
"notes": "",
"notes": "- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n",
"examples": "See the CPU architecture of a machine as well as who made it and what its serial number is.\n```\nSELECT CPU_type, hardware_vendor, hardware_model, hardware_serial FROM system_info;\n```",
"columns": [
{
@@ -24504,7 +24504,7 @@
],
"evented": false,
"cacheable": false,
"notes": "",
"notes": "- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n",
"examples": "List users that have interactive access via a shell that isn't false.\n```\nSELECT * FROM users WHERE shell!='/usr/bin/false';\n```",
"columns": [
{
@@ -27841,32 +27841,6 @@
"url": "https://fleetdm.com/tables/dscl",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dscl.yml"
},
{
"name": "filevault_users",
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
"description": "Information on the users able to unlock the current boot volume if protected with FileVault.",
"platforms": [
"darwin"
],
"evented": false,
"examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```",
"columns": [
{
"name": "username",
"description": "Username of the FileVault user.",
"required": false,
"type": "text"
},
{
"name": "uuid",
"description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).",
"required": false,
"type": "text"
}
],
"url": "https://fleetdm.com/tables/filevault_users",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml"
},
{
"name": "file_lines",
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
@@ -27914,6 +27888,32 @@
"url": "https://fleetdm.com/tables/filevault_prk",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_prk.yml"
},
{
"name": "filevault_users",
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
"description": "Information on the users able to unlock the current boot volume if protected with FileVault.",
"platforms": [
"darwin"
],
"evented": false,
"examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```",
"columns": [
{
"name": "username",
"description": "Username of the FileVault user.",
"required": false,
"type": "text"
},
{
"name": "uuid",
"description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).",
"required": false,
"type": "text"
}
],
"url": "https://fleetdm.com/tables/filevault_users",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml"
},
{
"name": "find_cmd",
"platforms": [
@@ -27951,6 +27951,31 @@
"url": "https://fleetdm.com/tables/find_cmd",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/find_cmd.yml"
},
{
"name": "firmware_eficheck_integrity_check",
"platforms": [
"darwin"
],
"description": "Performs eficheck's integrity check on macOS Intel T1 chips (CIS 5.9).",
"columns": [
{
"name": "chip",
"type": "text",
"required": false,
"description": "Contains the chip type, values are \"apple\", \"intel-t1\" and \"intel-t2\".\nIf chip type is \"apple\" or \"intel-t2\" then no eficheck integrity check is executed.\n"
},
{
"name": "output",
"type": "text",
"required": false,
"description": "Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.\nThis value is only valid when chip is \"intel-t1\".\n"
}
],
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
"evented": false,
"url": "https://fleetdm.com/tables/firmware_eficheck_integrity_check",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml"
},
{
"name": "geolocation",
"evented": false,
@@ -27984,34 +28009,10 @@
"description": "Region"
}
],
"notes": "- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n",
"url": "https://fleetdm.com/tables/geolocation",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/geolocation.yml"
},
{
"name": "firmware_eficheck_integrity_check",
"platforms": [
"darwin"
],
"description": "Performs eficheck's integrity check on macOS Intel T1 chips (CIS 5.9).",
"columns": [
{
"name": "chip",
"type": "text",
"required": false,
"description": "Contains the chip type, values are \"apple\", \"intel-t1\" and \"intel-t2\".\nIf chip type is \"apple\" or \"intel-t2\" then no eficheck integrity check is executed.\n"
},
{
"name": "output",
"type": "text",
"required": false,
"description": "Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.\nThis value is only valid when chip is \"intel-t1\".\n"
}
],
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
"evented": false,
"url": "https://fleetdm.com/tables/firmware_eficheck_integrity_check",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml"
},
{
"name": "google_chrome_profiles",
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
@@ -28286,49 +28287,6 @@
"url": "https://fleetdm.com/tables/macos_rsr",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_rsr.yml"
},
{
"name": "mdm_bridge",
"platforms": [
"windows"
],
"description": "Allows querying MDM enrolled devices using \"get\" commands.",
"columns": [
{
"name": "enrollment_status",
"type": "text",
"required": false,
"description": "Contains the enrollment status of the device, possible values are \"device_enrolled\" and \"device_unenrolled\"."
},
{
"name": "enrolled_user",
"type": "text",
"required": false,
"description": "Contains the enrollment URI of the device."
},
{
"name": "mdm_command_input",
"type": "text",
"required": false,
"description": "The \"get\" command to execute on the device. If empty, no command is executed and the \"enrollment_status\" and \"enrolled_user\" columns are returned."
},
{
"name": "mdm_command_output",
"type": "text",
"required": false,
"description": "Value of the \"Results\" field of the MDM command output."
},
{
"name": "raw_mdm_command_output",
"type": "text",
"required": false,
"description": "The full raw output of the MDM command execution."
}
],
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
"evented": false,
"url": "https://fleetdm.com/tables/mdm_bridge",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml"
},
{
"name": "mdm",
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).<p> Code based on work by [Kolide](https://github.com/kolide/launcher). <p> Due to changes in macOS 12.3, the output of `profiles show -type enrollment` can only be generated once a day. If you are running this command with another tool, you should set the `PROFILES_SHOW_ENROLLMENT_CACHE_PATH` environment variable to the path you are caching this. The cache file should be `json` with the keys `dep_capable` and `rate_limited present`, both booleans representing whether the device is capable of DEP enrollment and whether the response from `profiles show -type enrollment` is being rate limited or not.",
@@ -28421,6 +28379,49 @@
"url": "https://fleetdm.com/tables/mdm",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm.yml"
},
{
"name": "mdm_bridge",
"platforms": [
"windows"
],
"description": "Allows querying MDM enrolled devices using \"get\" commands.",
"columns": [
{
"name": "enrollment_status",
"type": "text",
"required": false,
"description": "Contains the enrollment status of the device, possible values are \"device_enrolled\" and \"device_unenrolled\"."
},
{
"name": "enrolled_user",
"type": "text",
"required": false,
"description": "Contains the enrollment URI of the device."
},
{
"name": "mdm_command_input",
"type": "text",
"required": false,
"description": "The \"get\" command to execute on the device. If empty, no command is executed and the \"enrollment_status\" and \"enrolled_user\" columns are returned."
},
{
"name": "mdm_command_output",
"type": "text",
"required": false,
"description": "Value of the \"Results\" field of the MDM command output."
},
{
"name": "raw_mdm_command_output",
"type": "text",
"required": false,
"description": "The full raw output of the MDM command execution."
}
],
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
"evented": false,
"url": "https://fleetdm.com/tables/mdm_bridge",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml"
},
{
"name": "munki_info",
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).<p> Code based on work by [Kolide](https://github.com/kolide/launcher).",
@@ -28554,7 +28555,7 @@
"description": "IPv6 address (only available to extensions force-installed by enterprise policy)"
}
],
"notes": "- Requires that the fleetd extension is force-installed by enterprise policy",
"notes": "- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n- Requires that the fleetd extension is force-installed by enterprise policy\n",
"url": "https://fleetdm.com/tables/network_interfaces",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/network_interfaces.yml"
},
@@ -28661,7 +28662,6 @@
},
{
"name": "privacy_preferences",
"notes": "This table is not a core osquery table. It is included as part of the Fleetd Chrome extension.",
"description": "Information on Chrome features that can affect a user's privacy, available from the [chrome.privacy APIs](https://developer.chrome.com/docs/extensions/reference/privacy/)",
"platforms": [
"chrome"
@@ -28789,6 +28789,7 @@
"type": "integer"
}
],
"notes": "- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n",
"url": "https://fleetdm.com/tables/privacy_preferences",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/privacy_preferences.yml"
},
@@ -28910,6 +28911,58 @@
"url": "https://fleetdm.com/tables/puppet_info",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_info.yml"
},
{
"name": "puppet_logs",
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
"description": "Outputs [Puppet](https://puppet.com/) logs from the last run.",
"platforms": [
"darwin",
"windows",
"linux"
],
"evented": false,
"examples": "List Puppet logs that are of a level of anything but informational.\n```\nSELECT * FROM puppet_logs WHERE level!='info';\n```",
"columns": [
{
"name": "level",
"description": "The level of the log item (info, error, etc).",
"required": false,
"type": "text"
},
{
"name": "message",
"description": "The log message content.",
"required": false,
"type": "text"
},
{
"name": "source",
"description": "The source of the log item.",
"required": false,
"type": "text"
},
{
"name": "time",
"description": "The time at which this item was logged.",
"required": false,
"type": "text"
},
{
"name": "file",
"description": "The file from which osquery read this log.",
"required": false,
"type": "text"
},
{
"name": "line",
"description": "The line from which this log item was read.",
"required": false,
"type": "text"
}
],
"url": "https://fleetdm.com/tables/puppet_logs",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_logs.yml"
},
{
"name": "puppet_state",
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
@@ -29004,58 +29057,6 @@
"url": "https://fleetdm.com/tables/puppet_state",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_state.yml"
},
{
"name": "puppet_logs",
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
"description": "Outputs [Puppet](https://puppet.com/) logs from the last run.",
"platforms": [
"darwin",
"windows",
"linux"
],
"evented": false,
"examples": "List Puppet logs that are of a level of anything but informational.\n```\nSELECT * FROM puppet_logs WHERE level!='info';\n```",
"columns": [
{
"name": "level",
"description": "The level of the log item (info, error, etc).",
"required": false,
"type": "text"
},
{
"name": "message",
"description": "The log message content.",
"required": false,
"type": "text"
},
{
"name": "source",
"description": "The source of the log item.",
"required": false,
"type": "text"
},
{
"name": "time",
"description": "The time at which this item was logged.",
"required": false,
"type": "text"
},
{
"name": "file",
"description": "The file from which osquery read this log.",
"required": false,
"type": "text"
},
{
"name": "line",
"description": "The line from which this log item was read.",
"required": false,
"type": "text"
}
],
"url": "https://fleetdm.com/tables/puppet_logs",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_logs.yml"
},
{
"name": "pwd_policy",
"platforms": [
@@ -29099,25 +29100,6 @@
"url": "https://fleetdm.com/tables/pwd_policy",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pwd_policy.yml"
},
{
"name": "software_update",
"platforms": [
"darwin"
],
"description": "Information about available Apple software updates.",
"columns": [
{
"name": "software_update_required",
"type": "integer",
"required": false,
"description": "If true, means one of the Apple softwares installed on this machine has a new available upgrade.\n"
}
],
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
"evented": false,
"url": "https://fleetdm.com/tables/software_update",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml"
},
{
"name": "sntp_request",
"platforms": [
@@ -29151,6 +29133,25 @@
"url": "https://fleetdm.com/tables/sntp_request",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sntp_request.yml"
},
{
"name": "software_update",
"platforms": [
"darwin"
],
"description": "Information about available Apple software updates.",
"columns": [
{
"name": "software_update_required",
"type": "integer",
"required": false,
"description": "If true, means one of the Apple softwares installed on this machine has a new available upgrade.\n"
}
],
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
"evented": false,
"url": "https://fleetdm.com/tables/software_update",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml"
},
{
"name": "sudo_info",
"platforms": [
@@ -29186,7 +29187,7 @@
}
],
"evented": false,
"notes": "- This table is not a core osquery table. It is included as part of the Fleetd Chrome extension.",
"notes": "- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).",
"url": "https://fleetdm.com/tables/system_state",
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_state.yml"
},