diff --git a/changes/23967-doc-firefox_preferences-linux-windows b/changes/23967-doc-firefox_preferences-linux-windows new file mode 100644 index 0000000000..3faa0f6980 --- /dev/null +++ b/changes/23967-doc-firefox_preferences-linux-windows @@ -0,0 +1 @@ +* doc: document firefox_preferences table for Linux and Windows platforms diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index 0a72676a8c..3a12aee973 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -10971,14 +10971,17 @@ "name": "firefox_preferences", "description": "Get the filepath where the host's Firefox preferences live.", "evented": false, + "examples": "Check if a preference is enabled:\n\n```\nSELECT * FROM firefox_preferences WHERE path IN (SELECT path FROM file WHERE path LIKE '/home/%/.mozilla/firefox/%/prefs.js') AND fullkey = 'network.dns.disablePrefetch' and value = 'true';\n```", "notes": "This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).", "platforms": [ - "darwin" + "darwin", + "linux", + "windows" ], "columns": [ { "name": "path", - "description": "The path to the host's Firefox preferences.", + "description": "The absolute path to the host's Firefox preferences.", "type": "text", "required": true }, diff --git a/schema/tables/firefox_preferences.yml b/schema/tables/firefox_preferences.yml index f83bf45ea3..1f79fb8bd2 100644 --- a/schema/tables/firefox_preferences.yml +++ b/schema/tables/firefox_preferences.yml @@ -1,12 +1,20 @@ name: firefox_preferences -description: Get the filepath where the host's Firefox preferences live. +description: Get the filepath where the host's Firefox preferences live. evented: false +examples: |- + Check if a preference is enabled: + + ``` + SELECT * FROM firefox_preferences WHERE path IN (SELECT path FROM file WHERE path LIKE '/home/%/.mozilla/firefox/%/prefs.js') AND fullkey = 'network.dns.disablePrefetch' and value = 'true'; + ``` notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher). platforms: - darwin + - linux + - windows columns: - name: path - description: The path to the host's Firefox preferences. + description: The absolute path to the host's Firefox preferences. type: text required: true - name: key @@ -29,4 +37,4 @@ columns: description: The query is printed in this column. For example the SQL `SELECT * FROM firefox_preferences WHERE path = 'testdata/prefs.js'` will print "*" in the query column. type: text required: false - \ No newline at end of file +