Add macos_rsr table from macadmins extension (#11537)
# Checklist for submitter If some of the following don't apply, delete the relevant line. - [ ] Changes file added for user-visible changes in `changes/` or `orbit/changes/`. See [Changes files](https://fleetdm.com/docs/contributing/committing-changes#changes-files) for more information. - [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or docs/Contributing/API-for-contributors.md) - [ ] Documented any permissions changes - [ ] Input data is properly validated, `SELECT *` is avoided, SQL injection is prevented (using placeholders for values in statements) - [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for new osquery data ingestion features. - [ ] Added/updated tests - [ ] Manual QA for all new/changed functionality - For Orbit and Fleet Desktop changes: - [ ] Manual QA must be performed in the three main OSs, macOS, Windows and Linux. - [ ] Auto-update manual QA, from released version of component to new version (see [tools/tuf/test](../tools/tuf/test/README.md)). --------- Co-authored-by: Roberto Dip <me@roperzh.com> Co-authored-by: Lucas Rodriguez <lucas@fleetdm.com>
This commit is contained in:
Zach Wasserman
co-authored by
Roberto Dip
Lucas Rodriguez
Roberto Dip
Lucas Rodriguez
parent
60f55fbbe9
commit
3f0111964f
@@ -56,7 +56,7 @@ require (
|
||||
github.com/kevinburke/go-bindata v3.24.0+incompatible
|
||||
github.com/kolide/kit v0.0.0-20191023141830-6312ecc11c23
|
||||
github.com/kolide/launcher v0.11.25-0.20220321235155-c3e9480037d2
|
||||
github.com/macadmins/osquery-extension v0.0.7
|
||||
github.com/macadmins/osquery-extension v0.0.14
|
||||
github.com/mattermost/xml-roundtrip-validator v0.0.0-20201213122252-bcd7e1b9601e
|
||||
github.com/mattn/go-sqlite3 v1.14.13
|
||||
github.com/micromdm/micromdm v1.9.0
|
||||
|
||||
@@ -901,6 +901,8 @@ github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ
|
||||
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0/go.mod h1:zJYVVT2jmtg6P3p1VtQj7WsuWi/y4VnjVBn7F8KPB3I=
|
||||
github.com/macadmins/osquery-extension v0.0.7 h1:iEo2eajSbG51pdXg+QH3kM5ZWhidWBBZ/YiNDEXU1lE=
|
||||
github.com/macadmins/osquery-extension v0.0.7/go.mod h1:7/zR5oT8BSw8ejmx17EJlvif1d6iGFXRhOoKgLNP12g=
|
||||
github.com/macadmins/osquery-extension v0.0.14 h1:GhTdqp5fEfD9AsIng1r9jIsYpmahelXwxVVd8by5NEk=
|
||||
github.com/macadmins/osquery-extension v0.0.14/go.mod h1:Alx7on10YHX4wE8vFbj7BLwnniDPs+lsJtgB0k0OM7w=
|
||||
github.com/magiconair/properties v1.8.0/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
|
||||
github.com/magiconair/properties v1.8.1/go.mod h1:PppfXfuXeibc/6YijjN8zIbojt8czPbwD3XqdrwzmxQ=
|
||||
github.com/magiconair/properties v1.8.4/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60=
|
||||
|
||||
@@ -18,6 +18,7 @@ import (
|
||||
"github.com/fleetdm/fleet/v4/orbit/pkg/table/user_login_settings"
|
||||
"github.com/macadmins/osquery-extension/tables/filevaultusers"
|
||||
"github.com/macadmins/osquery-extension/tables/macos_profiles"
|
||||
"github.com/macadmins/osquery-extension/tables/macosrsr"
|
||||
"github.com/macadmins/osquery-extension/tables/mdm"
|
||||
"github.com/macadmins/osquery-extension/tables/munki"
|
||||
"github.com/macadmins/osquery-extension/tables/unifiedlog"
|
||||
@@ -50,6 +51,7 @@ func PlatformTables() []osquery.OsqueryPlugin {
|
||||
table.NewPlugin("mdm", mdm.MDMInfoColumns(), mdm.MDMInfoGenerate),
|
||||
table.NewPlugin("munki_info", munki.MunkiInfoColumns(), munki.MunkiInfoGenerate),
|
||||
table.NewPlugin("munki_installs", munki.MunkiInstallsColumns(), munki.MunkiInstallsGenerate),
|
||||
table.NewPlugin("macos_rsr", macosrsr.MacOSRsrColumns(), macosrsr.MacOSRsrGenerate),
|
||||
// osquery version 5.5.0 and up ships a unified_log table in core
|
||||
// we are renaming the one from the macadmins extension to avoid collision
|
||||
table.NewPlugin("macadmins_unified_log", unifiedlog.UnifiedLogColumns(), unifiedlog.UnifiedLogGenerate),
|
||||
|
||||
+212
-175
@@ -26993,6 +26993,73 @@
|
||||
],
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yum_sources.yml"
|
||||
},
|
||||
{
|
||||
"name": "apfs_physical_stores",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"description": "Information about APFS physical stores from the `diskutil apfs list -plist` command.",
|
||||
"columns": [
|
||||
{
|
||||
"name": "container_uuid",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "The UUID of the APFS Contianer"
|
||||
},
|
||||
{
|
||||
"name": "container_designated_physical_store",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "The disk displayed as the backing store of the container. There may be multiple,\nuse `apfs_physical_stores` to see all actual physical stores\n"
|
||||
},
|
||||
{
|
||||
"name": "container_reference",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "The current reference for the APFS container, e.g. \"disk3\""
|
||||
},
|
||||
{
|
||||
"name": "container_fusion",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "Whether this container is on a \"fusion drive\" (i.e. SSHD)"
|
||||
},
|
||||
{
|
||||
"name": "container_capacity_ceiling",
|
||||
"type": "bigint",
|
||||
"required": false,
|
||||
"description": "The total amount of space in the container"
|
||||
},
|
||||
{
|
||||
"name": "container_capacity_free",
|
||||
"type": "bigint",
|
||||
"required": false,
|
||||
"description": "The amount of remaining free space in the container"
|
||||
},
|
||||
{
|
||||
"name": "uuid",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "The UUID of the physical store"
|
||||
},
|
||||
{
|
||||
"name": "identifier",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "The current identifier of the physical store (e.g. disk1s2)"
|
||||
},
|
||||
{
|
||||
"name": "size",
|
||||
"type": "bigint",
|
||||
"required": false,
|
||||
"description": "The size of the physical store in byptes"
|
||||
}
|
||||
],
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
"evented": false,
|
||||
"url": "https://fleetdm.com/tables/apfs_physical_stores",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_physical_stores.yml"
|
||||
},
|
||||
{
|
||||
"name": "apfs_volumes",
|
||||
"platforms": [
|
||||
@@ -27108,73 +27175,6 @@
|
||||
"url": "https://fleetdm.com/tables/apfs_volumes",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_volumes.yml"
|
||||
},
|
||||
{
|
||||
"name": "apfs_physical_stores",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"description": "Information about APFS physical stores from the `diskutil apfs list -plist` command.",
|
||||
"columns": [
|
||||
{
|
||||
"name": "container_uuid",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "The UUID of the APFS Contianer"
|
||||
},
|
||||
{
|
||||
"name": "container_designated_physical_store",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "The disk displayed as the backing store of the container. There may be multiple,\nuse `apfs_physical_stores` to see all actual physical stores\n"
|
||||
},
|
||||
{
|
||||
"name": "container_reference",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "The current reference for the APFS container, e.g. \"disk3\""
|
||||
},
|
||||
{
|
||||
"name": "container_fusion",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "Whether this container is on a \"fusion drive\" (i.e. SSHD)"
|
||||
},
|
||||
{
|
||||
"name": "container_capacity_ceiling",
|
||||
"type": "bigint",
|
||||
"required": false,
|
||||
"description": "The total amount of space in the container"
|
||||
},
|
||||
{
|
||||
"name": "container_capacity_free",
|
||||
"type": "bigint",
|
||||
"required": false,
|
||||
"description": "The amount of remaining free space in the container"
|
||||
},
|
||||
{
|
||||
"name": "uuid",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "The UUID of the physical store"
|
||||
},
|
||||
{
|
||||
"name": "identifier",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "The current identifier of the physical store (e.g. disk1s2)"
|
||||
},
|
||||
{
|
||||
"name": "size",
|
||||
"type": "bigint",
|
||||
"required": false,
|
||||
"description": "The size of the physical store in byptes"
|
||||
}
|
||||
],
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
"evented": false,
|
||||
"url": "https://fleetdm.com/tables/apfs_physical_stores",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_physical_stores.yml"
|
||||
},
|
||||
{
|
||||
"name": "authdb",
|
||||
"platforms": [
|
||||
@@ -27576,32 +27576,6 @@
|
||||
"url": "https://fleetdm.com/tables/dscl",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dscl.yml"
|
||||
},
|
||||
{
|
||||
"name": "filevault_users",
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
"description": "Information on the users able to unlock the current boot volume if protected with FileVault.",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"evented": false,
|
||||
"examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```",
|
||||
"columns": [
|
||||
{
|
||||
"name": "username",
|
||||
"description": "Username of the FileVault user.",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "uuid",
|
||||
"description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
}
|
||||
],
|
||||
"url": "https://fleetdm.com/tables/filevault_users",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml"
|
||||
},
|
||||
{
|
||||
"name": "file_lines",
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
@@ -27630,6 +27604,57 @@
|
||||
"url": "https://fleetdm.com/tables/file_lines",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/file_lines.yml"
|
||||
},
|
||||
{
|
||||
"name": "filevault_users",
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
"description": "Information on the users able to unlock the current boot volume if protected with FileVault.",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"evented": false,
|
||||
"examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```",
|
||||
"columns": [
|
||||
{
|
||||
"name": "username",
|
||||
"description": "Username of the FileVault user.",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "uuid",
|
||||
"description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
}
|
||||
],
|
||||
"url": "https://fleetdm.com/tables/filevault_users",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml"
|
||||
},
|
||||
{
|
||||
"name": "firmware_eficheck_integrity_check",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"description": "Performs eficheck's integrity check on macOS Intel T1 chips (CIS 5.9).",
|
||||
"columns": [
|
||||
{
|
||||
"name": "chip",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "Contains the chip type, values are \"apple\", \"intel-t1\" and \"intel-t2\".\nIf chip type is \"apple\" or \"intel-t2\" then no eficheck integrity check is executed.\n"
|
||||
},
|
||||
{
|
||||
"name": "output",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.\nThis value is only valid when chip is \"intel-t1\".\n"
|
||||
}
|
||||
],
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
"evented": false,
|
||||
"url": "https://fleetdm.com/tables/firmware_eficheck_integrity_check",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml"
|
||||
},
|
||||
{
|
||||
"name": "google_chrome_profiles",
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
@@ -27670,31 +27695,6 @@
|
||||
"url": "https://fleetdm.com/tables/google_chrome_profiles",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/google_chrome_profiles.yml"
|
||||
},
|
||||
{
|
||||
"name": "firmware_eficheck_integrity_check",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"description": "Performs eficheck's integrity check on macOS Intel T1 chips (CIS 5.9).",
|
||||
"columns": [
|
||||
{
|
||||
"name": "chip",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "Contains the chip type, values are \"apple\", \"intel-t1\" and \"intel-t2\".\nIf chip type is \"apple\" or \"intel-t2\" then no eficheck integrity check is executed.\n"
|
||||
},
|
||||
{
|
||||
"name": "output",
|
||||
"type": "text",
|
||||
"required": false,
|
||||
"description": "Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.\nThis value is only valid when chip is \"intel-t1\".\n"
|
||||
}
|
||||
],
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
"evented": false,
|
||||
"url": "https://fleetdm.com/tables/firmware_eficheck_integrity_check",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml"
|
||||
},
|
||||
{
|
||||
"name": "icloud_private_relay",
|
||||
"platforms": [
|
||||
@@ -27892,6 +27892,43 @@
|
||||
"url": "https://fleetdm.com/tables/macos_profiles",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_profiles.yml"
|
||||
},
|
||||
{
|
||||
"name": "macos_rsr",
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
"description": "Returns information about installed Rapid Security Responses (RSRs).",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"evented": false,
|
||||
"columns": [
|
||||
{
|
||||
"name": "full_macos_version",
|
||||
"description": "Full macOS version string (including the RSR suffix)",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "macos_version",
|
||||
"description": "The macOS version string (excluding the RSR suffix)",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "rsr_supported",
|
||||
"description": "Whether this macOS version supports RSRs (>= 13). Possible values are 'true' or 'false'.",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "rsr_version",
|
||||
"description": "RSR version string suffix (with parenthesis included)",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
}
|
||||
],
|
||||
"url": "https://fleetdm.com/tables/macos_rsr",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_rsr.yml"
|
||||
},
|
||||
{
|
||||
"name": "mdm",
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).<p> Code based on work by [Kolide](https://github.com/kolide/launcher). <p> Due to changes in macOS 12.3, the output of `profiles show -type enrollment` can only be generated once a day. If you are running this command with another tool, you should set the `PROFILES_SHOW_ENROLLMENT_CACHE_PATH` environment variable to the path you are caching this. The cache file should be `json` with the keys `dep_capable` and `rate_limited present`, both booleans representing whether the device is capable of DEP enrollment and whether the response from `profiles show -type enrollment` is being rate limited or not.",
|
||||
@@ -28027,6 +28064,44 @@
|
||||
"url": "https://fleetdm.com/tables/mdm_bridge",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml"
|
||||
},
|
||||
{
|
||||
"name": "munki_installs",
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).<p> Code based on work by [Kolide](https://github.com/kolide/launcher).",
|
||||
"description": "Software packages and other items [Munki](https://github.com/munki/munki) is managing.",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"evented": false,
|
||||
"examples": "See the version of software that has been deployed by Munki.\n```\nSELECT name, installed_version FROM munki_installs WHERE installed='true';\n```",
|
||||
"columns": [
|
||||
{
|
||||
"name": "end_time",
|
||||
"description": "The end time of the last Munki run.",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "installed",
|
||||
"description": "Shows if Munki installed an item (true) or if it is simply available but not installed (false).",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "installed_version",
|
||||
"description": "The version number of installed items.",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "name",
|
||||
"description": "The name of items managed by Munki.",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
}
|
||||
],
|
||||
"url": "https://fleetdm.com/tables/munki_installs",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_installs.yml"
|
||||
},
|
||||
{
|
||||
"name": "munki_info",
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).<p> Code based on work by [Kolide](https://github.com/kolide/launcher).",
|
||||
@@ -28095,44 +28170,6 @@
|
||||
"url": "https://fleetdm.com/tables/munki_info",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_info.yml"
|
||||
},
|
||||
{
|
||||
"name": "munki_installs",
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).<p> Code based on work by [Kolide](https://github.com/kolide/launcher).",
|
||||
"description": "Software packages and other items [Munki](https://github.com/munki/munki) is managing.",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"evented": false,
|
||||
"examples": "See the version of software that has been deployed by Munki.\n```\nSELECT name, installed_version FROM munki_installs WHERE installed='true';\n```",
|
||||
"columns": [
|
||||
{
|
||||
"name": "end_time",
|
||||
"description": "The end time of the last Munki run.",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "installed",
|
||||
"description": "Shows if Munki installed an item (true) or if it is simply available but not installed (false).",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "installed_version",
|
||||
"description": "The version number of installed items.",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
},
|
||||
{
|
||||
"name": "name",
|
||||
"description": "The name of items managed by Munki.",
|
||||
"required": false,
|
||||
"type": "text"
|
||||
}
|
||||
],
|
||||
"url": "https://fleetdm.com/tables/munki_installs",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_installs.yml"
|
||||
},
|
||||
{
|
||||
"name": "orbit_info",
|
||||
"platforms": [
|
||||
@@ -28541,6 +28578,25 @@
|
||||
"url": "https://fleetdm.com/tables/pwd_policy",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pwd_policy.yml"
|
||||
},
|
||||
{
|
||||
"name": "software_update",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"description": "Information about available Apple software updates.",
|
||||
"columns": [
|
||||
{
|
||||
"name": "software_update_required",
|
||||
"type": "integer",
|
||||
"required": false,
|
||||
"description": "If true, means one of the Apple softwares installed on this machine has a new available upgrade.\n"
|
||||
}
|
||||
],
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
"evented": false,
|
||||
"url": "https://fleetdm.com/tables/software_update",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml"
|
||||
},
|
||||
{
|
||||
"name": "sntp_request",
|
||||
"platforms": [
|
||||
@@ -28593,25 +28649,6 @@
|
||||
"url": "https://fleetdm.com/tables/sudo_info",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sudo_info.yml"
|
||||
},
|
||||
{
|
||||
"name": "software_update",
|
||||
"platforms": [
|
||||
"darwin"
|
||||
],
|
||||
"description": "Information about available Apple software updates.",
|
||||
"columns": [
|
||||
{
|
||||
"name": "software_update_required",
|
||||
"type": "integer",
|
||||
"required": false,
|
||||
"description": "If true, means one of the Apple softwares installed on this machine has a new available upgrade.\n"
|
||||
}
|
||||
],
|
||||
"notes": "This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).",
|
||||
"evented": false,
|
||||
"url": "https://fleetdm.com/tables/software_update",
|
||||
"fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml"
|
||||
},
|
||||
{
|
||||
"name": "user_login_settings",
|
||||
"platforms": [
|
||||
|
||||
@@ -0,0 +1,23 @@
|
||||
name: macos_rsr
|
||||
notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
|
||||
description: Returns information about installed Rapid Security Responses (RSRs).
|
||||
platforms:
|
||||
- darwin
|
||||
evented: false
|
||||
columns:
|
||||
- name: full_macos_version
|
||||
description: Full macOS version string (including the RSR suffix)
|
||||
required: false
|
||||
type: text
|
||||
- name: macos_version
|
||||
description: The macOS version string (excluding the RSR suffix)
|
||||
required: false
|
||||
type: text
|
||||
- name: rsr_supported
|
||||
description: Whether this macOS version supports RSRs (>= 13). Possible values are 'true' or 'false'.
|
||||
required: false
|
||||
type: text
|
||||
- name: rsr_version
|
||||
description: RSR version string suffix (with parenthesis included)
|
||||
required: false
|
||||
type: text
|
||||
Reference in New Issue
Block a user