diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index de498d1c3b..02c387f7ed 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -3642,7 +3642,7 @@ ], "evented": false, "cacheable": false, - "notes": "", + "notes": "- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n", "examples": "List Chrome extensions by user and profile which have full access to HTTPS browsing.\n```\nSELECT u.username, ce.name, ce.description, ce.version, ce.profile, ce.permissions FROM users u CROSS JOIN chrome_extensions ce USING (uid) WHERE ce.permissions LIKE '%%https://*/*%%';\n```", "columns": [ { @@ -5990,7 +5990,7 @@ ], "evented": false, "cacheable": false, - "notes": "- For ChromeOS, this table is not a core osquery table. It is included as part of the Fleetd Chrome extension. Available for Chrome 91+.", + "notes": "- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n- Available for ChromeOS 91+.\n", "examples": "``` SELECT * FROM disk_info; ```", "columns": [ { @@ -15030,7 +15030,7 @@ "evented": false, "cacheable": false, "notes": "", - "examples": "If this query returns a 1 in the enabled column, location services are enabled on this Mac.\n```\nSELECT enabled from location_services;\n```", + "examples": "Returns the drive free space in gigabytes and as percentage.\n```\nSELECT path, type, ROUND((blocks_available * blocks_size * 10e-10), 2) AS free_gb, ROUND ((blocks_available * 1.0 / blocks * 1.0) * 100, 2) AS free_pc FROM mounts WHERE path = '/';\n```", "columns": [ { "name": "device", @@ -15284,7 +15284,7 @@ }, { "name": "npm_packages", - "description": "Node packages installed in a system.", + "description": "Node.js packages globally installed on a system.", "url": "https://fleetdm.com/tables/npm_packages", "platforms": [ "darwin", @@ -15294,7 +15294,7 @@ "evented": false, "cacheable": false, "notes": "", - "examples": "List the author, description and more information about packages made by Fleet. Replace the homepage with any other distributor desired.\n```\nSELECT author, description, directory, version FROM npm_packages WHERE homepage='https://fleetdm.com';\n```", + "examples": "List the author, description and more information about the NPM package called `webpack`, if installed:\n```sql SELECT author, description, directory, version FROM npm_packages WHERE name='webpack'; ```", "columns": [ { "name": "name", @@ -15835,7 +15835,7 @@ ], "evented": false, "cacheable": false, - "notes": "", + "notes": "- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n", "examples": "See the OS version as well as the CPU architecture in use (X86 vs ARM for example)\n```\nSELECT arch, version FROM os_version;\n```", "columns": [ { @@ -16201,7 +16201,7 @@ ], "evented": false, "cacheable": false, - "notes": "", + "notes": "- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n", "examples": "See the version of the currently running osquery.\n```\nSELECT version FROM osquery_info; \n```", "columns": [ { @@ -20770,7 +20770,7 @@ ], "evented": false, "cacheable": false, - "notes": "- For macOS, this only fetches results for osquery's current logged-in user context. The user must also have recently logged in. - For ChromeOS, this table is not a core osquery table. It is included as part of the Fleetd Chrome extension. Available for Chrome 73+.", + "notes": "- For macOS, this only fetches results for osquery's current logged-in user context. The user must also have recently logged in.\n- For ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n- For ChromeOS, this table is only available for Chrome 73+.\n", "examples": [], "columns": [ { @@ -23071,7 +23071,7 @@ ], "evented": false, "cacheable": false, - "notes": "", + "notes": "- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n", "examples": "See the CPU architecture of a machine as well as who made it and what its serial number is.\n```\nSELECT CPU_type, hardware_vendor, hardware_model, hardware_serial FROM system_info;\n```", "columns": [ { @@ -24504,7 +24504,7 @@ ], "evented": false, "cacheable": false, - "notes": "", + "notes": "- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n", "examples": "List users that have interactive access via a shell that isn't false.\n```\nSELECT * FROM users WHERE shell!='/usr/bin/false';\n```", "columns": [ { @@ -27841,32 +27841,6 @@ "url": "https://fleetdm.com/tables/dscl", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dscl.yml" }, - { - "name": "filevault_users", - "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", - "description": "Information on the users able to unlock the current boot volume if protected with FileVault.", - "platforms": [ - "darwin" - ], - "evented": false, - "examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```", - "columns": [ - { - "name": "username", - "description": "Username of the FileVault user.", - "required": false, - "type": "text" - }, - { - "name": "uuid", - "description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).", - "required": false, - "type": "text" - } - ], - "url": "https://fleetdm.com/tables/filevault_users", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml" - }, { "name": "file_lines", "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", @@ -27914,6 +27888,32 @@ "url": "https://fleetdm.com/tables/filevault_prk", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_prk.yml" }, + { + "name": "filevault_users", + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Information on the users able to unlock the current boot volume if protected with FileVault.", + "platforms": [ + "darwin" + ], + "evented": false, + "examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```", + "columns": [ + { + "name": "username", + "description": "Username of the FileVault user.", + "required": false, + "type": "text" + }, + { + "name": "uuid", + "description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/filevault_users", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml" + }, { "name": "find_cmd", "platforms": [ @@ -27951,6 +27951,31 @@ "url": "https://fleetdm.com/tables/find_cmd", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/find_cmd.yml" }, + { + "name": "firmware_eficheck_integrity_check", + "platforms": [ + "darwin" + ], + "description": "Performs eficheck's integrity check on macOS Intel T1 chips (CIS 5.9).", + "columns": [ + { + "name": "chip", + "type": "text", + "required": false, + "description": "Contains the chip type, values are \"apple\", \"intel-t1\" and \"intel-t2\".\nIf chip type is \"apple\" or \"intel-t2\" then no eficheck integrity check is executed.\n" + }, + { + "name": "output", + "type": "text", + "required": false, + "description": "Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.\nThis value is only valid when chip is \"intel-t1\".\n" + } + ], + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "evented": false, + "url": "https://fleetdm.com/tables/firmware_eficheck_integrity_check", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml" + }, { "name": "geolocation", "evented": false, @@ -27984,34 +28009,10 @@ "description": "Region" } ], + "notes": "- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n", "url": "https://fleetdm.com/tables/geolocation", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/geolocation.yml" }, - { - "name": "firmware_eficheck_integrity_check", - "platforms": [ - "darwin" - ], - "description": "Performs eficheck's integrity check on macOS Intel T1 chips (CIS 5.9).", - "columns": [ - { - "name": "chip", - "type": "text", - "required": false, - "description": "Contains the chip type, values are \"apple\", \"intel-t1\" and \"intel-t2\".\nIf chip type is \"apple\" or \"intel-t2\" then no eficheck integrity check is executed.\n" - }, - { - "name": "output", - "type": "text", - "required": false, - "description": "Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.\nThis value is only valid when chip is \"intel-t1\".\n" - } - ], - "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", - "evented": false, - "url": "https://fleetdm.com/tables/firmware_eficheck_integrity_check", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml" - }, { "name": "google_chrome_profiles", "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", @@ -28286,49 +28287,6 @@ "url": "https://fleetdm.com/tables/macos_rsr", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_rsr.yml" }, - { - "name": "mdm_bridge", - "platforms": [ - "windows" - ], - "description": "Allows querying MDM enrolled devices using \"get\" commands.", - "columns": [ - { - "name": "enrollment_status", - "type": "text", - "required": false, - "description": "Contains the enrollment status of the device, possible values are \"device_enrolled\" and \"device_unenrolled\"." - }, - { - "name": "enrolled_user", - "type": "text", - "required": false, - "description": "Contains the enrollment URI of the device." - }, - { - "name": "mdm_command_input", - "type": "text", - "required": false, - "description": "The \"get\" command to execute on the device. If empty, no command is executed and the \"enrollment_status\" and \"enrolled_user\" columns are returned." - }, - { - "name": "mdm_command_output", - "type": "text", - "required": false, - "description": "Value of the \"Results\" field of the MDM command output." - }, - { - "name": "raw_mdm_command_output", - "type": "text", - "required": false, - "description": "The full raw output of the MDM command execution." - } - ], - "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", - "evented": false, - "url": "https://fleetdm.com/tables/mdm_bridge", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml" - }, { "name": "mdm", "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [Kolide](https://github.com/kolide/launcher).

Due to changes in macOS 12.3, the output of `profiles show -type enrollment` can only be generated once a day. If you are running this command with another tool, you should set the `PROFILES_SHOW_ENROLLMENT_CACHE_PATH` environment variable to the path you are caching this. The cache file should be `json` with the keys `dep_capable` and `rate_limited present`, both booleans representing whether the device is capable of DEP enrollment and whether the response from `profiles show -type enrollment` is being rate limited or not.", @@ -28421,6 +28379,49 @@ "url": "https://fleetdm.com/tables/mdm", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm.yml" }, + { + "name": "mdm_bridge", + "platforms": [ + "windows" + ], + "description": "Allows querying MDM enrolled devices using \"get\" commands.", + "columns": [ + { + "name": "enrollment_status", + "type": "text", + "required": false, + "description": "Contains the enrollment status of the device, possible values are \"device_enrolled\" and \"device_unenrolled\"." + }, + { + "name": "enrolled_user", + "type": "text", + "required": false, + "description": "Contains the enrollment URI of the device." + }, + { + "name": "mdm_command_input", + "type": "text", + "required": false, + "description": "The \"get\" command to execute on the device. If empty, no command is executed and the \"enrollment_status\" and \"enrolled_user\" columns are returned." + }, + { + "name": "mdm_command_output", + "type": "text", + "required": false, + "description": "Value of the \"Results\" field of the MDM command output." + }, + { + "name": "raw_mdm_command_output", + "type": "text", + "required": false, + "description": "The full raw output of the MDM command execution." + } + ], + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "evented": false, + "url": "https://fleetdm.com/tables/mdm_bridge", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml" + }, { "name": "munki_info", "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [Kolide](https://github.com/kolide/launcher).", @@ -28554,7 +28555,7 @@ "description": "IPv6 address (only available to extensions force-installed by enterprise policy)" } ], - "notes": "- Requires that the fleetd extension is force-installed by enterprise policy", + "notes": "- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n- Requires that the fleetd extension is force-installed by enterprise policy\n", "url": "https://fleetdm.com/tables/network_interfaces", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/network_interfaces.yml" }, @@ -28661,7 +28662,6 @@ }, { "name": "privacy_preferences", - "notes": "This table is not a core osquery table. It is included as part of the Fleetd Chrome extension.", "description": "Information on Chrome features that can affect a user's privacy, available from the [chrome.privacy APIs](https://developer.chrome.com/docs/extensions/reference/privacy/)", "platforms": [ "chrome" @@ -28789,6 +28789,7 @@ "type": "integer" } ], + "notes": "- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).\n", "url": "https://fleetdm.com/tables/privacy_preferences", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/privacy_preferences.yml" }, @@ -28910,6 +28911,58 @@ "url": "https://fleetdm.com/tables/puppet_info", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_info.yml" }, + { + "name": "puppet_logs", + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Outputs [Puppet](https://puppet.com/) logs from the last run.", + "platforms": [ + "darwin", + "windows", + "linux" + ], + "evented": false, + "examples": "List Puppet logs that are of a level of anything but informational.\n```\nSELECT * FROM puppet_logs WHERE level!='info';\n```", + "columns": [ + { + "name": "level", + "description": "The level of the log item (info, error, etc).", + "required": false, + "type": "text" + }, + { + "name": "message", + "description": "The log message content.", + "required": false, + "type": "text" + }, + { + "name": "source", + "description": "The source of the log item.", + "required": false, + "type": "text" + }, + { + "name": "time", + "description": "The time at which this item was logged.", + "required": false, + "type": "text" + }, + { + "name": "file", + "description": "The file from which osquery read this log.", + "required": false, + "type": "text" + }, + { + "name": "line", + "description": "The line from which this log item was read.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/puppet_logs", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_logs.yml" + }, { "name": "puppet_state", "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", @@ -29004,58 +29057,6 @@ "url": "https://fleetdm.com/tables/puppet_state", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_state.yml" }, - { - "name": "puppet_logs", - "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", - "description": "Outputs [Puppet](https://puppet.com/) logs from the last run.", - "platforms": [ - "darwin", - "windows", - "linux" - ], - "evented": false, - "examples": "List Puppet logs that are of a level of anything but informational.\n```\nSELECT * FROM puppet_logs WHERE level!='info';\n```", - "columns": [ - { - "name": "level", - "description": "The level of the log item (info, error, etc).", - "required": false, - "type": "text" - }, - { - "name": "message", - "description": "The log message content.", - "required": false, - "type": "text" - }, - { - "name": "source", - "description": "The source of the log item.", - "required": false, - "type": "text" - }, - { - "name": "time", - "description": "The time at which this item was logged.", - "required": false, - "type": "text" - }, - { - "name": "file", - "description": "The file from which osquery read this log.", - "required": false, - "type": "text" - }, - { - "name": "line", - "description": "The line from which this log item was read.", - "required": false, - "type": "text" - } - ], - "url": "https://fleetdm.com/tables/puppet_logs", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_logs.yml" - }, { "name": "pwd_policy", "platforms": [ @@ -29099,25 +29100,6 @@ "url": "https://fleetdm.com/tables/pwd_policy", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pwd_policy.yml" }, - { - "name": "software_update", - "platforms": [ - "darwin" - ], - "description": "Information about available Apple software updates.", - "columns": [ - { - "name": "software_update_required", - "type": "integer", - "required": false, - "description": "If true, means one of the Apple softwares installed on this machine has a new available upgrade.\n" - } - ], - "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", - "evented": false, - "url": "https://fleetdm.com/tables/software_update", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml" - }, { "name": "sntp_request", "platforms": [ @@ -29151,6 +29133,25 @@ "url": "https://fleetdm.com/tables/sntp_request", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sntp_request.yml" }, + { + "name": "software_update", + "platforms": [ + "darwin" + ], + "description": "Information about available Apple software updates.", + "columns": [ + { + "name": "software_update_required", + "type": "integer", + "required": false, + "description": "If true, means one of the Apple softwares installed on this machine has a new available upgrade.\n" + } + ], + "notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "evented": false, + "url": "https://fleetdm.com/tables/software_update", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml" + }, { "name": "sudo_info", "platforms": [ @@ -29186,7 +29187,7 @@ } ], "evented": false, - "notes": "- This table is not a core osquery table. It is included as part of the Fleetd Chrome extension.", + "notes": "- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).", "url": "https://fleetdm.com/tables/system_state", "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_state.yml" },