From 403663e1ce21e1cc99ed3f28eb40993fc67c20dc Mon Sep 17 00:00:00 2001 From: Eric Date: Mon, 31 Oct 2022 16:05:01 -0500 Subject: [PATCH] regenerate osquery_fleet_schema.json (#8446) --- schema/osquery_fleet_schema.json | 2331 ++++++++++++++++++++++-------- 1 file changed, 1751 insertions(+), 580 deletions(-) diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index 74f2f68480..37de16f234 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -2,7 +2,7 @@ { "name": "account_policy_data", "description": "Additional macOS user account data from the AccountPolicy section of OpenDirectory.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/account_policy_data.table", + "url": "https://fleetdm.com/tables/account_policy_data", "platforms": [ "darwin" ], @@ -50,12 +50,13 @@ "index": false } ], - "examples": "Query the creation date of user accounts. You could also query the date of the last failed login attempt or password change.\n```\nSELECT strftime('%Y-%m-%d %H:%M:%S',creation_time,'unixepoch') AS creationdate FROM account_policy_data;\n```\n\nSee each user's last password set date and number of failed logins since last successful login to detect any intrusion attempts.\n```\nSELECT u.username u.uid, strftime('%Y-%m-%dT%H:%M:%S', a.password_last_set_time, 'unixepoch') AS password_last_set_time, a.failed_login_count, strftime('%Y-%m-%dT%H:%M:%S', a.failed_login_timestamp, 'unixepoch') AS failed_login_timestamp FROM account_policy_data AS a CROSS JOIN users AS u USING (uid) ORDER BY password_last_set_time ASC;" + "examples": "Query the creation date of user accounts. You could also query the date of the last failed login attempt or password change.\n```\nSELECT strftime('%Y-%m-%d %H:%M:%S',creation_time,'unixepoch') AS creationdate FROM account_policy_data;\n```\n\nSee each user's last password set date and number of failed logins since last successful login to detect any intrusion attempts.\n```\nSELECT u.username u.uid, strftime('%Y-%m-%dT%H:%M:%S', a.password_last_set_time, 'unixepoch') AS password_last_set_time, a.failed_login_count, strftime('%Y-%m-%dT%H:%M:%S', a.failed_login_timestamp, 'unixepoch') AS failed_login_timestamp FROM account_policy_data AS a CROSS JOIN users AS u USING (uid) ORDER BY password_last_set_time ASC;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/account_policy_data.yml" }, { "name": "acpi_tables", "description": "Firmware ACPI functional table common metadata and content.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/acpi_tables.table", + "url": "https://fleetdm.com/tables/acpi_tables", "platforms": [ "darwin", "linux" @@ -87,12 +88,14 @@ "required": false, "index": false } - ] + ], + "hidden": true, + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/acpi_tables.yml" }, { "name": "ad_config", "description": "macOS Active Directory configuration.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/ad_config.table", + "url": "https://fleetdm.com/tables/ad_config", "platforms": [ "darwin" ], @@ -132,12 +135,13 @@ "index": false } ], - "examples": "See the domain, if any, that the Mac is bound to.\n```\nSELECT domain FROM ad_config;\n```" + "examples": "See the domain, if any, that the Mac is bound to.\n```\nSELECT domain FROM ad_config;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ad_config.yml" }, { "name": "alf", "description": "macOS application layer firewall (ALF) service details.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/alf.table", + "url": "https://fleetdm.com/tables/alf", "platforms": [ "darwin" ], @@ -201,12 +205,13 @@ "index": false } ], - "examples": "See the state of the Application Layer Firewall on a Mac. A result of 0 means it is disabled, 1 means it is enabled, and 2 means it is enabled and blocking all inbound connections. See our standard query library for an example policy query using this.\n```\nSELECT global_state FROM alf;\n```" + "examples": "See the state of the Application Layer Firewall on a Mac. A result of 0 means it is disabled, 1 means it is enabled, and 2 means it is enabled and blocking all inbound connections. See our standard query library for an example policy query using this.\n```\nSELECT global_state FROM alf;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf.yml" }, { "name": "alf_exceptions", - "description": "macOS application layer firewall (ALF) service exceptions.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/alf_exceptions.table", + "description": "The exceptions configured for the [built-in firewall protection](https://fleetdm.com/tables/alf) on this Mac.", + "url": "https://fleetdm.com/tables/alf_exceptions", "platforms": [ "darwin" ], @@ -223,19 +228,20 @@ }, { "name": "state", - "description": "Firewall exception state", + "description": "Firewall [exception state](https://krypted.com/mac-security/command-line-alf-on-mac-os-x/)", "type": "integer", "hidden": false, "required": false, "index": false } ], - "examples": "List applications that are able to receive inbound connections across the firewall. This is useful when looking to see if vulnerable software is exposed to networks. \n```\nSELECT * FROM alf_exceptions\n```" + "examples": "List applications that are able to receive inbound connections across the firewall. This is useful when looking to see if vulnerable software is exposed to networks. \n```\nSELECT * FROM alf_exceptions;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf_exceptions.yml" }, { "name": "alf_explicit_auths", "description": "ALF services explicitly allowed to perform networking.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/alf_explicit_auths.table", + "url": "https://fleetdm.com/tables/alf_explicit_auths", "platforms": [ "darwin" ], @@ -250,12 +256,15 @@ "required": false, "index": false } - ] + ], + "examples": "List applications were granted explicit access through the firewall. This is useful when looking to see if vulnerable software is exposed to networks. \n```\nSELECT * FROM alf_exceptions;\n```", + "notes": "This table is currently affected by a [bug](https://github.com/osquery/osquery/issues/2322) and not returning applications visible in the preferences interface.", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf_explicit_auths.yml" }, { "name": "app_schemes", "description": "macOS application schemes and handlers (e.g., http, file, mailto).", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/app_schemes.table", + "url": "https://fleetdm.com/tables/app_schemes", "platforms": [ "darwin" ], @@ -303,12 +312,13 @@ "index": false } ], - "examples": "List applications that have registered the URL scheme \"mailto\" to handle email links.\n```\nSELECT * FROM app_schemes WHERE scheme='mailto';\n```" + "examples": "List applications that have registered the URL scheme \"mailto\" to handle email links.\n```\nSELECT * FROM app_schemes WHERE scheme='mailto';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/app_schemes.yml" }, { "name": "apparmor_events", "description": "Track AppArmor events.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/apparmor_events.table", + "url": "https://fleetdm.com/tables/apparmor_events", "platforms": [ "linux" ], @@ -491,12 +501,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/apparmor_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fapparmor_events.yml&value=name%3A%20apparmor_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "apparmor_profiles", "description": "Track active AppArmor profiles.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/apparmor_profiles.table", + "url": "https://fleetdm.com/tables/apparmor_profiles", "platforms": [ "linux" ], @@ -543,12 +555,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/apparmor_profiles.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fapparmor_profiles.yml&value=name%3A%20apparmor_profiles%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "appcompat_shims", "description": "Application Compatibility shims are a way to persist malware. This table presents the AppCompat Shim information from the registry in a nice format. See http://files.brucon.org/2015/Tomczak_and_Ballenthin_Shims_for_the_Win.pdf for more details.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/appcompat_shims.table", + "url": "https://fleetdm.com/tables/appcompat_shims", "platforms": [ "windows" ], @@ -603,12 +617,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/appcompat_shims.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fappcompat_shims.yml&value=name%3A%20appcompat_shims%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "apps", "description": "macOS applications installed in known search paths (e.g., /Applications).", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/apps.table", + "url": "https://fleetdm.com/tables/apps", "platforms": [ "darwin" ], @@ -768,12 +784,13 @@ "index": false } ], - "examples": "See the last time applications were used. Useful to know if a vulnerable application is being used as well as for licensing purposes.\n```\nSELECT *, strftime('%Y-%m-%d %H:%M:%S',last_opened_time,'unixepoch') as LastUseDate FROM apps WHERE last_opened_time!='-1.0';\n```" + "examples": "See the last time applications were used. Useful to know if a vulnerable application is being used as well as for licensing purposes.\n```\nSELECT *, strftime('%Y-%m-%d %H:%M:%S',last_opened_time,'unixepoch') as LastUseDate FROM apps WHERE last_opened_time!='-1.0';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apps.yml" }, { "name": "apt_sources", "description": "Current list of APT repositories or software channels.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/apt_sources.table", + "url": "https://fleetdm.com/tables/apt_sources", "platforms": [ "linux" ], @@ -856,12 +873,13 @@ ] } ], - "examples": "On Ubuntu or other Debian based systems, identify APT repositories that are not maintained by Ubuntu.\n```\nSELECT * FROM apt_sources WHERE maintainer!='Ubuntu';\n```" + "examples": "On Ubuntu or other Debian based systems, identify APT repositories that are not maintained by Ubuntu.\n```\nSELECT * FROM apt_sources WHERE maintainer!='Ubuntu';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apt_sources.yml" }, { "name": "arp_cache", "description": "Address resolution cache, both static and dynamic (from ARP, NDP).", - "url": "https://github.com/osquery/osquery/blob/master/specs/arp_cache.table", + "url": "https://fleetdm.com/tables/arp_cache", "platforms": [ "darwin", "linux", @@ -904,12 +922,14 @@ "index": false } ], - "examples": "List the content of the ARP cache. On systems located in an office or datacenter, you can use this to watch for network attacks by checking for gateway IPs that do not have the expected MAC address.\n```\nSELECT address, interface, mac FROM arp_cache;\n```" + "examples": "List the content of the ARP cache.\n```\nSELECT address, interface, mac FROM arp_cache;\n```\nOn systems located in an office or datacenter, you can use this to watch for network attacks by checking for gateway IPs that do not have the expected MAC address. This could indicate an [ARP spoofing](https://en.wikipedia.org/wiki/ARP_spoofing) attack, in which an attacker that controls a system on the LAN attempts to funnel all remote traffic through it so they can inspect it.\n```\nSELECT * FROM arp_cache WHERE address IN (INSERT_GATEWAY_IPS) AND mac NOT IN (INSERT_EXPECTED_MAC_ADDRESSES);\n```", + "notes": "* The first six digits of a MAC address is the [Organizationally Unique Identifier (OUI)](https://en.wikipedia.org/wiki/Organizationally_unique_identifier).\n* You can lookup the manufacturer and model via the MAC address using a tool like [wireshark OUI lookup](https://www.wireshark.org/tools/oui-lookup.html).", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/arp_cache.yml" }, { "name": "asl", "description": "Queries the Apple System Log data structure for system events.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/asl.table", + "url": "https://fleetdm.com/tables/asl", "platforms": [ "darwin" ], @@ -1020,12 +1040,14 @@ "required": false, "index": false } - ] + ], + "examples": "Apple System Logger (ASL) is deprecated since macOS 10.12. On older Macs, this table can be used to read logs. On newer ones, see the *unified_log* table. This example is from the osquery documentation.\n```\nSELECT time, message FROM asl WHERE facility = 'authpriv' AND sender = 'sudo' AND message LIKE '%python%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/asl.yml" }, { "name": "atom_packages", "description": "Lists all atom packages in a directory or globally installed in a system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/atom_packages.table", + "url": "https://fleetdm.com/tables/atom_packages", "platforms": [ "darwin", "linux", @@ -1089,14 +1111,17 @@ "type": "bigint", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true } - ] + ], + "examples": "List installed Atom packages and their version.\n```\nSELECT name, version, description FROM atom_packages;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/atom_packages.yml" }, { "name": "augeas", "description": "Configuration files parsed by augeas.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/augeas.table", + "url": "https://fleetdm.com/tables/augeas", "platforms": [ "darwin", "linux" @@ -1136,12 +1161,14 @@ "required": false, "index": false } - ] + ], + "examples": "This table requires augeas [lenses](https://augeas.net/docs/lenses.html) to be installed in their default location. This query will output *sshd_config* as if it was a table. This is especially useful to check for specific configurations in text files.\n```\nSELECT * FROM augeas WHERE path='/etc/ssh/sshd_config';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/augeas.yml" }, { "name": "authenticode", "description": "File (executable, bundle, installer, disk) code signing status.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/authenticode.table", + "url": "https://fleetdm.com/tables/authenticode", "platforms": [ "windows" ], @@ -1196,12 +1223,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/authenticode.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fauthenticode.yml&value=name%3A%20authenticode%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "authorization_mechanisms", "description": "macOS Authorization mechanisms database.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/authorization_mechanisms.table", + "url": "https://fleetdm.com/tables/authorization_mechanisms", "platforms": [ "darwin" ], @@ -1249,12 +1278,13 @@ "index": false } ], - "examples": "Discover privileged macOS authorization mechanisms, which could include third party software. Finding third party software using this means it is likely an important piece of software that should be kept very up to date.\n```\nSELECT * FROM authorization_mechanisms WHERE privileged='true';\n```" + "examples": "Discover privileged macOS authorization mechanisms, which could include third party software. Finding third party software using this means it is likely an important piece of software that should be kept very up to date.\n```\nSELECT * FROM authorization_mechanisms WHERE privileged='true';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorization_mechanisms.yml" }, { "name": "authorizations", "description": "macOS Authorization rights database.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/authorizations.table", + "url": "https://fleetdm.com/tables/authorizations", "platforms": [ "darwin" ], @@ -1358,12 +1388,13 @@ "index": false } ], - "examples": "See macOS authorizations that have been modified since their creation. Useful for threat hunting.\n```\nSELECT * FROM authorizations WHERE created!=modified;\n```" + "examples": "See macOS authorizations that have been modified since their creation. Useful for threat hunting.\n```\nSELECT * FROM authorizations WHERE created!=modified;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorizations.yml" }, { "name": "authorized_keys", "description": "A line-delimited authorized_keys table.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/authorized_keys.table", + "url": "https://fleetdm.com/tables/authorized_keys", "platforms": [ "darwin", "linux" @@ -1377,7 +1408,8 @@ "type": "bigint", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "algorithm", @@ -1415,12 +1447,13 @@ ] } ], - "examples": "List the SSH keys allowed to connect to this host\n```\nSELECT key FROM authorized_keys;\n```" + "examples": "List the SSH keys allowed to connect to this host.\n```\nSELECT key FROM authorized_keys;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorized_keys.yml" }, { "name": "autoexec", "description": "Aggregate of executables that will automatically execute on the target machine. This is an amalgamation of other tables like services, scheduled_tasks, startup_items and more.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/autoexec.table", + "url": "https://fleetdm.com/tables/autoexec", "platforms": [ "windows" ], @@ -1451,12 +1484,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/autoexec.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fautoexec.yml&value=name%3A%20autoexec%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "azure_instance_metadata", "description": "Azure instance metadata.", - "url": "https://github.com/osquery/osquery/blob/master/specs/azure_instance_metadata.table", + "url": "https://fleetdm.com/tables/azure_instance_metadata", "platforms": [ "darwin", "linux", @@ -1595,12 +1630,13 @@ "index": false } ], - "examples": "See in which Azure location a VM is located\n```\nSELECT location FROM azure_instance_metadata;\n```" + "examples": "See in which Azure location a VM is located\n```\nSELECT location FROM azure_instance_metadata;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/azure_instance_metadata.yml" }, { "name": "azure_instance_tags", "description": "Azure instance tags.", - "url": "https://github.com/osquery/osquery/blob/master/specs/azure_instance_tags.table", + "url": "https://fleetdm.com/tables/azure_instance_tags", "platforms": [ "darwin", "linux", @@ -1635,12 +1671,13 @@ "index": false } ], - "examples": "List the tags assigned to an Azure VM\n```\nSELECT key, value FROM azure_instance_tags;\n```" + "examples": "List the tags assigned to an Azure VM\n```\nSELECT key, value FROM azure_instance_tags;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/azure_instance_tags.yml" }, { "name": "background_activities_moderator", "description": "Background Activities Moderator (BAM) tracks application execution.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/background_activities_moderator.table", + "url": "https://fleetdm.com/tables/background_activities_moderator", "platforms": [ "windows" ], @@ -1671,12 +1708,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/background_activities_moderator.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fbackground_activities_moderator.yml&value=name%3A%20background_activities_moderator%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "battery", "description": "Provides information about the internal battery of a Macbook.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/battery.table", + "url": "https://fleetdm.com/tables/battery", "platforms": [ "darwin" ], @@ -1827,12 +1866,14 @@ "required": false, "index": false } - ] + ], + "examples": "This table contains a lot of information about the health of batteries. This query shows how many cycles the battery of a device was used for, allowing you to identify users who put more wear on it and might need more frequent replacements.\n```\nSELECT cycle_count FROM battery;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/battery.yml" }, { "name": "bitlocker_info", "description": "Retrieve bitlocker status of the machine.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/bitlocker_info.table", + "url": "https://fleetdm.com/tables/bitlocker_info", "platforms": [ "windows" ], @@ -1911,12 +1952,15 @@ "required": false, "index": false } - ] + ], + "examples": "Full Disk Encryption (FDE) reduces the risk of compromise when a device is lost or stolen. This query lists any system that does not have BitLocker enabled on its OS drive (typically `C:`). \n```\n \n SELECT * FROM bitlocker_info WHERE drive_letter='C:' AND protection_status != 1;\n\n```", + "notes": "* `protection_status` is quite nuanced - from the [Microsoft documentation](https://learn.microsoft.com/en-us/windows/win32/secprov/getprotectionstatus-win32-encryptablevolume#parameters):\n\n `protection_status = 0`\n\n For an Internal HD:\n The volume is unencrypted, partially encrypted, or the volume's encryption key is available in the clear on the hard disk.\n\n For an External HD:\n The band for the volume is perpetually unlocked, has no key manager, or is managed by a third party key manager.\n This can also mean that the band is managed by BitLocker but the DisableKeyProtectors method has been called and the drive is suspended.\n\n `protection_status = 1`\n\n For an Internal HD:\n The volume is fully encrypted and the encryption key for the volume is not available in the clear on the hard disk.\n\n For an External HD:\n BitLocker is the key manager for the band. The drive can be locked or unlocked but cannot be perpetually unlocked.\n\n `protection_status = 2`\n\n The volume protection status cannot be determined. This can be caused by the volume being in a locked state.", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/bitlocker_info.yml" }, { "name": "block_devices", "description": "Block (buffered access) device file nodes: disks, ramdisks, and DMG containers.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/block_devices.table", + "url": "https://fleetdm.com/tables/block_devices", "platforms": [ "darwin", "linux" @@ -1997,12 +2041,13 @@ "index": false } ], - "examples": "Identify USB storage in use\n```\nSELECT * FROM block_devices WHERE type='USB';\n```" + "examples": "Identify USB storage in use\n```\nSELECT * FROM block_devices WHERE type='USB';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/block_devices.yml" }, { "name": "bpf_process_events", "description": "Track time/action process executions.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/bpf_process_events.table", + "url": "https://fleetdm.com/tables/bpf_process_events", "platforms": [ "linux" ], @@ -2145,12 +2190,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/bpf_process_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fbpf_process_events.yml&value=name%3A%20bpf_process_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "bpf_socket_events", "description": "Track network socket opens and closes.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/bpf_socket_events.table", + "url": "https://fleetdm.com/tables/bpf_socket_events", "platforms": [ "linux" ], @@ -2333,12 +2380,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/bpf_socket_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fbpf_socket_events.yml&value=name%3A%20bpf_socket_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "browser_plugins", "description": "All C/NPAPI browser plugin details for all users. C/NPAPI has been deprecated on all major browsers. To query for plugins on modern browsers, try: `chrome_extensions` `firefox_addons` `safari_extensions`.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/browser_plugins.table", + "url": "https://fleetdm.com/tables/browser_plugins", "platforms": [ "darwin" ], @@ -2426,12 +2475,13 @@ "index": false } ], - "examples": "See classic browser plugins (C/NPAPI) installed by users. These plugins have been deprecated for a long time, so this query will usually not return anything.\n```\nSELECT bp.name, bp.identifier, bp.version FROM browser_plugins bp JOIN users u on bp.uid = u.uid ;\n```" + "examples": "See classic browser plugins (C/NPAPI) installed by users. These plugins have been deprecated for a long time, so this query will usually not return anything.\n```\nSELECT bp.name, bp.identifier, bp.version FROM browser_plugins bp JOIN users u on bp.uid = u.uid ;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/browser_plugins.yml" }, { "name": "carbon_black_info", "description": "Returns info about a Carbon Black sensor install.", - "url": "https://github.com/osquery/osquery/blob/master/specs/carbon_black_info.table", + "url": "https://fleetdm.com/tables/carbon_black_info", "platforms": [ "darwin", "linux", @@ -2610,12 +2660,13 @@ "index": false } ], - "examples": "See systems running Carbon Black but which have protection disabled.\n```\nSELECT * FROM carbon_black_info WHERE protection_disabled='1';\n```" + "examples": "See systems running Carbon Black but which have protection disabled.\n```\nSELECT * FROM carbon_black_info WHERE protection_disabled='1';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/carbon_black_info.yml" }, { "name": "carves", "description": "List the set of completed and in-progress carves. If carve=1 then the query is treated as a new carve request.", - "url": "https://github.com/osquery/osquery/blob/master/specs/carves.table", + "url": "https://fleetdm.com/tables/carves", "platforms": [ "darwin", "linux", @@ -2689,12 +2740,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/carves.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fcarves.yml&value=name%3A%20carves%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "certificates", - "description": "Certificate Authorities installed in Keychains/ca-bundles.", - "url": "https://github.com/osquery/osquery/blob/master/specs/certificates.table", + "description": "[Certificate authorities](https://en.wikipedia.org/wiki/Certificate_authority) installed in Keychains/ca-bundles.", + "url": "https://fleetdm.com/tables/certificates", "platforms": [ "darwin", "linux", @@ -2912,12 +2965,13 @@ ] } ], - "examples": "Replace 1QAZ2WSX with your Apple Developer ID, if you have one. This query will then let you identify Macs that have a copy of your code signing and notarization certificates.\n```\nSELECT * FROM certificates WHERE common_\"name\" LIKE '%%1QAZ2SWX%%';\n```" + "examples": "Replace 1QAZ2WSX with your Apple Developer ID, if you have one. This query will then let you identify Macs that have a copy of your code signing and notarization certificates.\n```\nSELECT * FROM certificates WHERE common_\"name\" LIKE '%%1QAZ2SWX%%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/certificates.yml" }, { "name": "chassis_info", "description": "Display information pertaining to the chassis and its security status.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/chassis_info.table", + "url": "https://fleetdm.com/tables/chassis_info", "platforms": [ "windows" ], @@ -3028,12 +3082,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/chassis_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fchassis_info.yml&value=name%3A%20chassis_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "chocolatey_packages", "description": "Chocolatey packages installed in a system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/chocolatey_packages.table", + "url": "https://fleetdm.com/tables/chocolatey_packages", "platforms": [ "windows" ], @@ -3088,12 +3144,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/chocolatey_packages.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fchocolatey_packages.yml&value=name%3A%20chocolatey_packages%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "chrome_extension_content_scripts", "description": "Chrome browser extension content scripts.", - "url": "https://github.com/osquery/osquery/blob/master/specs/chrome_extension_content_scripts.table", + "url": "https://fleetdm.com/tables/chrome_extension_content_scripts", "platforms": [ "darwin", "linux", @@ -3117,7 +3175,8 @@ "type": "bigint", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "identifier", @@ -3175,12 +3234,13 @@ "required": false, "index": false } - ] + ], + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/chrome_extension_content_scripts.yml" }, { "name": "chrome_extensions", "description": "Chrome-based browser extensions.", - "url": "https://github.com/osquery/osquery/blob/master/specs/chrome_extensions.table", + "url": "https://fleetdm.com/tables/chrome_extensions", "platforms": [ "darwin", "linux", @@ -3204,7 +3264,8 @@ "type": "bigint", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "name", @@ -3407,12 +3468,13 @@ "index": false } ], - "examples": "List Chrome extensions by user and profile which have full access to HTTPS browsing.\n```\nSELECT u.username, ce.name, ce.description, ce.version, ce.profile, ce.permissions FROM users u CROSS JOIN chrome_extensions ce USING (uid) WHERE ce.permissions LIKE '%%https://*/*%%';\n```" + "examples": "List Chrome extensions by user and profile which have full access to HTTPS browsing.\n```\nSELECT u.username, ce.name, ce.description, ce.version, ce.profile, ce.permissions FROM users u CROSS JOIN chrome_extensions ce USING (uid) WHERE ce.permissions LIKE '%%https://*/*%%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/chrome_extensions.yml" }, { "name": "connectivity", "description": "Provides the overall system's network state.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/connectivity.table", + "url": "https://fleetdm.com/tables/connectivity", "platforms": [ "windows" ], @@ -3491,12 +3553,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/connectivity.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fconnectivity.yml&value=name%3A%20connectivity%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "cpu_info", "description": "Retrieve cpu hardware info of the machine.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linwin/cpu_info.table", + "url": "https://fleetdm.com/tables/cpu_info", "platforms": [ "linux", "windows" @@ -3600,12 +3664,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linwin/cpu_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fcpu_info.yml&value=name%3A%20cpu_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "cpu_time", "description": "Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/cpu_time.table", + "url": "https://fleetdm.com/tables/cpu_time", "platforms": [ "darwin", "linux" @@ -3702,12 +3768,13 @@ "index": false } ], - "examples": "Identify overworked CPUs using a ratio of system to user CPU usage. Here, a ratio of 2 was arbitrarily chosen.\n```\nSELECT * FROM cpu_time WHERE user/system>2;\n```" + "examples": "Identify overworked CPUs using a ratio of system to user CPU usage. Here, a ratio of 2 was arbitrarily chosen.\n```\nSELECT * FROM cpu_time WHERE user/system>2;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpu_time.yml" }, { "name": "cpuid", "description": "Useful CPU features from the cpuid ASM call.", - "url": "https://github.com/osquery/osquery/blob/master/specs/cpuid.table", + "url": "https://fleetdm.com/tables/cpuid", "platforms": [ "darwin", "linux", @@ -3758,12 +3825,13 @@ "index": false } ], - "examples": "Identify Intel powered Macs that support a specific Intel CPU feature, such as sgx1.\n```\nSELECT * from cpuid WHERE feature='sgx1';\n```" + "examples": "Identify Intel powered Macs that support a specific Intel CPU feature, such as sgx1.\n```\nSELECT * from cpuid WHERE feature='sgx1';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpuid.yml" }, { "name": "crashes", "description": "Application, System, and Mobile App crash logs.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/crashes.table", + "url": "https://fleetdm.com/tables/crashes", "platforms": [ "darwin" ], @@ -3840,7 +3908,8 @@ "type": "integer", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "datetime", @@ -3898,12 +3967,14 @@ "required": false, "index": false } - ] + ], + "examples": "See software responsible for crashes. This can be useful to detect what the most problematic software in your environment is.\n```\nSELECT crash_path, identifier, responsible, exception_type FROM crashes;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/crashes.yml" }, { "name": "crontab", "description": "Line parsed values from system and user cron/tab.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/crontab.table", + "url": "https://fleetdm.com/tables/crontab", "platforms": [ "darwin", "linux" @@ -3987,12 +4058,13 @@ ] } ], - "examples": "List commands scheduled for execution as cron jobs\n```\nSELECT * FROM crontab;\n```" + "examples": "List commands scheduled for execution as cron jobs\n```\nSELECT * FROM crontab;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/crontab.yml" }, { "name": "cups_destinations", "description": "Returns all configured printers.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/cups_destinations.table", + "url": "https://fleetdm.com/tables/cups_destinations", "platforms": [ "darwin" ], @@ -4024,12 +4096,13 @@ "index": false } ], - "examples": "Identify the types of printers connected to computers. This query works for both network and local printers.\n```\nSELECT * FROM cups_destinations WHERE option_\"name\"='printer-info';\n```" + "examples": "Identify the types of printers connected to computers. This query works for both network and local printers.\n```\nSELECT * FROM cups_destinations WHERE option_\"name\"='printer-info';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cups_destinations.yml" }, { "name": "cups_jobs", "description": "Returns all completed print jobs from cups.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/cups_jobs.table", + "url": "https://fleetdm.com/tables/cups_jobs", "platforms": [ "darwin" ], @@ -4101,12 +4174,13 @@ "index": false } ], - "examples": "See what file format are being printed to what printer. This is useful for identifying systems that print a lot, which can help you ensure they have access to faster printers. Using this table, you could also highlight slow print jobs that might benefit from troubleshooting.\n```\nSELECT destination, format, strftime('%Y-%m-%d %H:%M:%S',creation_time,'unixepoch') AS creationDate FROM cups_jobs;\n```" + "examples": "See what file format are being printed to what printer. This is useful for identifying systems that print a lot, which can help you ensure they have access to faster printers. Using this table, you could also highlight slow print jobs that might benefit from troubleshooting.\n```\nSELECT destination, format, strftime('%Y-%m-%d %H:%M:%S',creation_time,'unixepoch') AS creationDate FROM cups_jobs;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cups_jobs.yml" }, { "name": "curl", "description": "Perform an http request and return stats about it.", - "url": "https://github.com/osquery/osquery/blob/master/specs/curl.table", + "url": "https://fleetdm.com/tables/curl", "platforms": [ "darwin", "linux", @@ -4172,12 +4246,14 @@ "required": false, "index": false } - ] + ], + "examples": "Connect over HTTP and retrieve statistics about the process. This is useful to detect machines on slow networks, or that have no Internet access.\n```\nSELECT round_trip_time FROM curl WHERE URL='https://fleetdm.com';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/curl.yml" }, { "name": "curl_certificate", "description": "Inspect TLS certificates by connecting to input hostnames.", - "url": "https://github.com/osquery/osquery/blob/master/specs/curl_certificate.table", + "url": "https://fleetdm.com/tables/curl_certificate", "platforms": [ "darwin", "linux", @@ -4444,12 +4520,13 @@ "index": false } ], - "examples": "Identify the certificates being served to osquery clients. This can allow you to detect machines that are behind a proxy or firewall attempting to decrypt TLS, maliciously or not.\n```\nSELECT issuer_organization, signature, sha256_fingerprint FROM curl_certificate WHERE hostname='google.com';\n```" + "examples": "Identify the certificates being served to osquery clients. This can allow you to detect machines that are behind a proxy or firewall attempting to decrypt TLS, maliciously or not.\n```\nSELECT issuer_organization, signature, sha256_fingerprint FROM curl_certificate WHERE hostname='google.com';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/curl_certificate.yml" }, { "name": "deb_packages", "description": "The installed DEB package database.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/deb_packages.table", + "url": "https://fleetdm.com/tables/deb_packages", "platforms": [ "linux" ], @@ -4566,12 +4643,13 @@ "Linux" ] } - ] + ], + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/deb_packages.yml" }, { "name": "default_environment", "description": "Default environment variables and values.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/default_environment.table", + "url": "https://fleetdm.com/tables/default_environment", "platforms": [ "windows" ], @@ -4602,12 +4680,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/default_environment.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdefault_environment.yml&value=name%3A%20default_environment%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "device_file", "description": "Similar to the file table, but use TSK and allow block address access.", - "url": "https://github.com/osquery/osquery/blob/master/specs/sleuthkit/device_file.table", + "url": "https://fleetdm.com/tables/device_file", "platforms": [ "darwin", "linux" @@ -4735,12 +4815,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/sleuthkit/device_file.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdevice_file.yml&value=name%3A%20device_file%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "device_firmware", "description": "A best-effort list of discovered firmware versions.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/device_firmware.table", + "url": "https://fleetdm.com/tables/device_firmware", "platforms": [ "darwin" ], @@ -4772,12 +4854,13 @@ "index": false } ], - "examples": "Identify the firmware version of hardware on a Mac, such as the SSD controller in this case. Older versions might indicate a problem with software updates, and this information can be useful when troubleshooting various issues.\n```\nSELECT * FROM device_firmware WHERE device='AppleANS3NVMeController';\n```" + "examples": "Identify the firmware version of hardware on a Mac, such as the SSD controller in this case. Older versions might indicate a problem with software updates, and this information can be useful when troubleshooting various issues.\n```\nSELECT * FROM device_firmware WHERE device='AppleANS3NVMeController';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/device_firmware.yml" }, { "name": "device_hash", "description": "Similar to the hash table, but use TSK and allow block address access.", - "url": "https://github.com/osquery/osquery/blob/master/specs/sleuthkit/device_hash.table", + "url": "https://fleetdm.com/tables/device_hash", "platforms": [ "darwin", "linux" @@ -4833,12 +4916,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/sleuthkit/device_hash.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdevice_hash.yml&value=name%3A%20device_hash%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "device_partitions", "description": "Use TSK to enumerate details about partitions on a disk device.", - "url": "https://github.com/osquery/osquery/blob/master/specs/sleuthkit/device_partitions.table", + "url": "https://fleetdm.com/tables/device_partitions", "platforms": [ "darwin", "linux" @@ -4918,12 +5003,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/sleuthkit/device_partitions.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdevice_partitions.yml&value=name%3A%20device_partitions%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "disk_encryption", "description": "Disk encryption status and information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/disk_encryption.table", + "url": "https://fleetdm.com/tables/disk_encryption", "platforms": [ "darwin", "linux" @@ -5005,12 +5092,13 @@ ] } ], - "examples": "A policy query to check if Filevault disk encryption is enabled on a Mac.\n```\nSELECT 1 FROM disk_encryption WHERE user_uuid IS NOT '' AND filevault_status = 'on' LIMIT 1;\n```" + "examples": "A policy query to check if Filevault disk encryption is enabled on a Mac.\n```\nSELECT 1 FROM disk_encryption WHERE user_uuid IS NOT '' AND filevault_status = 'on' LIMIT 1;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_encryption.yml" }, { "name": "disk_events", "description": "Track DMG disk image events (appearance/disappearance) when opened.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/disk_events.table", + "url": "https://fleetdm.com/tables/disk_events", "platforms": [ "darwin" ], @@ -5146,12 +5234,13 @@ "index": false } ], - "examples": "This is an evented table, and as such, is more useful if you are sending osquery logs to a SIEM or other centralized destination via Fleet. Events must be enabled. This query will contain the list of all actions related to connecting and removing disks, including SMB drives and USB storage, which can be very useful for investigative purposes.\n```\nSELECT * FROM disk_events;\n```" + "examples": "This is an evented table, and as such, is more useful if you are sending osquery logs to a SIEM or other centralized destination via Fleet. Events must be enabled. This query will contain the list of all actions related to connecting and removing disks, including SMB drives and USB storage, which can be very useful for investigative purposes.\n```\nSELECT * FROM disk_events;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_events.yml" }, { "name": "disk_info", "description": "Retrieve basic information about the physical disks of a system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/disk_info.table", + "url": "https://fleetdm.com/tables/disk_info", "platforms": [ "windows" ], @@ -5246,12 +5335,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/disk_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdisk_info.yml&value=name%3A%20disk_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "dns_cache", "description": "Enumerate the DNS cache using the undocumented DnsGetCacheDataTable function in dnsapi.dll.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/dns_cache.table", + "url": "https://fleetdm.com/tables/dns_cache", "platforms": [ "windows" ], @@ -5282,12 +5373,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/dns_cache.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdns_cache.yml&value=name%3A%20dns_cache%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "dns_resolvers", "description": "Resolvers used by this host.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/dns_resolvers.table", + "url": "https://fleetdm.com/tables/dns_resolvers", "platforms": [ "darwin", "linux" @@ -5347,12 +5440,13 @@ ] } ], - "examples": "Identify computers that are using an external DNS server instead of an internal one. This query also removes null and empty strings that can be returned by this table.\n```\nSELECT address FROM dns_resolvers WHERE type='nameserver' AND address NOT LIKE '192.168%%' AND address NOT LIKE '172.16%%' AND address NOT LIKE '172.17%%' AND address NOT LIKE '172.18%%' AND address NOT LIKE '172.19%%' AND address NOT LIKE '172.20%%' AND address NOT LIKE '172.21%%' AND address NOT LIKE '172.22%%' AND address NOT LIKE '172.23%%' AND address NOT LIKE '10.%%' AND address NOT LIKE '127.%%' AND address IS NOT NULL AND address IS NOT ' ' AND address IS NOT ''; \n```" + "examples": "Identify computers that are using an external DNS server instead of an internal one. This query also removes null and empty strings that can be returned by this table.\n```\nSELECT address FROM dns_resolvers WHERE type='nameserver' AND address NOT LIKE '192.168%%' AND address NOT LIKE '172.16%%' AND address NOT LIKE '172.17%%' AND address NOT LIKE '172.18%%' AND address NOT LIKE '172.19%%' AND address NOT LIKE '172.20%%' AND address NOT LIKE '172.21%%' AND address NOT LIKE '172.22%%' AND address NOT LIKE '172.23%%' AND address NOT LIKE '10.%%' AND address NOT LIKE '127.%%' AND address IS NOT NULL AND address IS NOT ' ' AND address IS NOT ''; \n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dns_resolvers.yml" }, { "name": "docker_container_envs", "description": "Docker container environment variables.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_envs.table", + "url": "https://fleetdm.com/tables/docker_container_envs", "platforms": [ "darwin", "linux" @@ -5384,12 +5478,14 @@ "required": false, "index": false } - ] + ], + "examples": "This table allows you to list environment variables for running Docker containers. This query will output the value of a variable called *MYSQL_VERSION* for example.\n```\nSELECT key, value FROM docker_container_envs WHERE key LIKE 'MYSQL_VERSION';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_envs.yml" }, { "name": "docker_container_fs_changes", "description": "Changes to files or directories on container's filesystem.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_fs_changes.table", + "url": "https://fleetdm.com/tables/docker_container_fs_changes", "platforms": [ "darwin", "linux" @@ -5421,12 +5517,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_fs_changes.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_container_fs_changes.yml&value=name%3A%20docker_container_fs_changes%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_container_labels", "description": "Docker container labels.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_labels.table", + "url": "https://fleetdm.com/tables/docker_container_labels", "platforms": [ "darwin", "linux" @@ -5458,12 +5556,14 @@ "required": false, "index": false } - ] + ], + "examples": "This table exposes all Docker labels on running containers. By joining it to the [docker_containers](https://fleetdm.com/tables/docker_containers)table, we can list containers and their maintainers.\n```\nSELECT dl.value, dc.name, FROM docker_container_labels dl JOIN docker_containers dc ON dl.id = dc.id WHERE key='maintainer';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_labels.yml" }, { "name": "docker_container_mounts", "description": "Docker container mounts.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_mounts.table", + "url": "https://fleetdm.com/tables/docker_container_mounts", "platforms": [ "darwin", "linux" @@ -5543,12 +5643,14 @@ "required": false, "index": false } - ] + ], + "examples": "List the source and destination of Docker bind and volume mounts.\n```\nSELECT dm.source, dm.destination, dm.mode, dc.name FROM docker_container_mounts dm JOIN docker_containers dc ON dm.id = dc.id;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_mounts.yml" }, { "name": "docker_container_networks", "description": "Docker container networks.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_networks.table", + "url": "https://fleetdm.com/tables/docker_container_networks", "platforms": [ "darwin", "linux" @@ -5644,12 +5746,14 @@ "required": false, "index": false } - ] + ], + "examples": "List the IP address of Docker containers.\n```\nSELECT dn.ip_address, dc.name FROM docker_container_networks dn JOIN docker_containers dc ON dn.id=dc.id;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_networks.yml" }, { "name": "docker_container_ports", "description": "Docker container ports.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_ports.table", + "url": "https://fleetdm.com/tables/docker_container_ports", "platforms": [ "darwin", "linux" @@ -5697,12 +5801,14 @@ "required": false, "index": false } - ] + ], + "examples": "Identify the ports exposed at the host level and see which containers they redirect traffic to.\n```\nSELECT dc.name, dp.type, dp.port, dp.host_ip, dp.host_port FROM docker_container_ports dp JOIN docker_containers dc ON dp.id=dc.id WHERE dp.host_port !='0';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_ports.yml" }, { "name": "docker_container_processes", "description": "Docker container processes.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_processes.table", + "url": "https://fleetdm.com/tables/docker_container_processes", "platforms": [ "darwin", "linux" @@ -5894,12 +6000,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_processes.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_container_processes.yml&value=name%3A%20docker_container_processes%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_container_stats", "description": "Docker container statistics. Queries on this table take at least one second.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_stats.table", + "url": "https://fleetdm.com/tables/docker_container_stats", "platforms": [ "darwin", "linux" @@ -6099,12 +6207,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_container_stats.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_container_stats.yml&value=name%3A%20docker_container_stats%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_containers", "description": "Docker containers information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_containers.table", + "url": "https://fleetdm.com/tables/docker_containers", "platforms": [ "darwin", "linux" @@ -6218,7 +6328,7 @@ }, { "name": "privileged", - "description": "Is the container privileged", + "description": "Is the container [privileged](https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities)", "type": "integer", "hidden": false, "required": false, @@ -6325,12 +6435,14 @@ "Linux" ] } - ] + ], + "examples": "Identify containers that are running with high privileges.\n```\nSELECT state, status, image, image_id FROM docker_containers WHERE privileged='1';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_containers.yml" }, { "name": "docker_image_history", "description": "Docker image history information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_image_history.table", + "url": "https://fleetdm.com/tables/docker_image_history", "platforms": [ "darwin", "linux" @@ -6386,12 +6498,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_image_history.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_image_history.yml&value=name%3A%20docker_image_history%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_image_labels", "description": "Docker image labels.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_image_labels.table", + "url": "https://fleetdm.com/tables/docker_image_labels", "platforms": [ "darwin", "linux" @@ -6423,12 +6537,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_image_labels.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_image_labels.yml&value=name%3A%20docker_image_labels%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_image_layers", "description": "Docker image layers information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_image_layers.table", + "url": "https://fleetdm.com/tables/docker_image_layers", "platforms": [ "darwin", "linux" @@ -6460,12 +6576,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_image_layers.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_image_layers.yml&value=name%3A%20docker_image_layers%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_images", "description": "Docker images information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_images.table", + "url": "https://fleetdm.com/tables/docker_images", "platforms": [ "darwin", "linux" @@ -6506,12 +6624,13 @@ "index": false } ], - "examples": "See how much storage is used by Docker images. Requires Docker to be running.\n```\nSELECT ROUND(SUM(size_bytes * 10e-10),2) as gigabytes_of_images FROM docker_images; \n```" + "examples": "See how much storage is used by Docker images. Requires Docker to be running.\n```\nSELECT ROUND(SUM(size_bytes * 10e-10),2) as gigabytes_of_images FROM docker_images; \n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_images.yml" }, { "name": "docker_info", "description": "Docker system information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_info.table", + "url": "https://fleetdm.com/tables/docker_info", "platforms": [ "darwin", "linux" @@ -6775,12 +6894,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_info.yml&value=name%3A%20docker_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_network_labels", "description": "Docker network labels.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_network_labels.table", + "url": "https://fleetdm.com/tables/docker_network_labels", "platforms": [ "darwin", "linux" @@ -6812,12 +6933,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_network_labels.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_network_labels.yml&value=name%3A%20docker_network_labels%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_networks", "description": "Docker networks information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_networks.table", + "url": "https://fleetdm.com/tables/docker_networks", "platforms": [ "darwin", "linux" @@ -6881,12 +7004,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_networks.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_networks.yml&value=name%3A%20docker_networks%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_version", "description": "Docker version information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_version.table", + "url": "https://fleetdm.com/tables/docker_version", "platforms": [ "darwin", "linux" @@ -6966,12 +7091,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_version.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_version.yml&value=name%3A%20docker_version%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_volume_labels", "description": "Docker volume labels.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_volume_labels.table", + "url": "https://fleetdm.com/tables/docker_volume_labels", "platforms": [ "darwin", "linux" @@ -7003,12 +7130,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_volume_labels.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdocker_volume_labels.yml&value=name%3A%20docker_volume_labels%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "docker_volumes", "description": "Docker volumes information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/docker_volumes.table", + "url": "https://fleetdm.com/tables/docker_volumes", "platforms": [ "darwin", "linux" @@ -7048,12 +7177,13 @@ "required": false, "index": false } - ] + ], + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_volumes.yml" }, { "name": "drivers", "description": "Details for in-use Windows device drivers. This does not display installed but unused drivers.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/drivers.table", + "url": "https://fleetdm.com/tables/drivers", "platforms": [ "windows" ], @@ -7172,12 +7302,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/drivers.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fdrivers.yml&value=name%3A%20drivers%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "ec2_instance_metadata", "description": "EC2 instance metadata.", - "url": "https://github.com/osquery/osquery/blob/master/specs/ec2_instance_metadata.table", + "url": "https://fleetdm.com/tables/ec2_instance_metadata", "platforms": [ "darwin", "linux", @@ -7299,12 +7431,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/ec2_instance_metadata.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fec2_instance_metadata.yml&value=name%3A%20ec2_instance_metadata%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "ec2_instance_tags", "description": "EC2 instance tag key value pairs.", - "url": "https://github.com/osquery/osquery/blob/master/specs/ec2_instance_tags.table", + "url": "https://fleetdm.com/tables/ec2_instance_tags", "platforms": [ "darwin", "linux", @@ -7338,12 +7472,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/ec2_instance_tags.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fec2_instance_tags.yml&value=name%3A%20ec2_instance_tags%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "es_process_events", "description": "Process execution events from EndpointSecurity.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/es_process_events.table", + "url": "https://fleetdm.com/tables/es_process_events", "platforms": [ "darwin" ], @@ -7558,12 +7694,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/es_process_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fes_process_events.yml&value=name%3A%20es_process_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "es_process_file_events", "description": "Process execution events from EndpointSecurity.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/es_process_file_events.table", + "url": "https://fleetdm.com/tables/es_process_file_events", "platforms": [ "darwin" ], @@ -7658,12 +7796,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/es_process_file_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fes_process_file_events.yml&value=name%3A%20es_process_file_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "etc_hosts", "description": "Line-parsed /etc/hosts.", - "url": "https://github.com/osquery/osquery/blob/master/specs/etc_hosts.table", + "url": "https://fleetdm.com/tables/etc_hosts", "platforms": [ "darwin", "linux", @@ -7701,12 +7841,13 @@ ] } ], - "examples": "Identify host\"name\"s pointed to IP addresses using the hosts file. This technique is often abused by malware, but can also indicate services that do not have proper DNS configuration to be reached from workstations.\n```\nSELECT * FROM etc_hosts WHERE address!='127.0.0.1' AND address!='::1' AND address!='255.255.255.255';\n```" + "examples": "Identify host\"name\"s pointed to IP addresses using the hosts file. This technique is often abused by malware, but can also indicate services that do not have proper DNS configuration to be reached from workstations.\n```\nSELECT * FROM etc_hosts WHERE address!='127.0.0.1' AND address!='::1' AND address!='255.255.255.255';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/etc_hosts.yml" }, { "name": "etc_protocols", "description": "Line-parsed /etc/protocols.", - "url": "https://github.com/osquery/osquery/blob/master/specs/etc_protocols.table", + "url": "https://fleetdm.com/tables/etc_protocols", "platforms": [ "darwin", "linux", @@ -7748,12 +7889,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/etc_protocols.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fetc_protocols.yml&value=name%3A%20etc_protocols%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "etc_services", "description": "Line-parsed /etc/services.", - "url": "https://github.com/osquery/osquery/blob/master/specs/etc_services.table", + "url": "https://fleetdm.com/tables/etc_services", "platforms": [ "darwin", "linux", @@ -7803,12 +7946,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/etc_services.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fetc_services.yml&value=name%3A%20etc_services%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "event_taps", "description": "Returns information about installed event taps.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/event_taps.table", + "url": "https://fleetdm.com/tables/event_taps", "platforms": [ "darwin" ], @@ -7856,12 +8001,13 @@ "index": false } ], - "examples": "Identify processes that have a tap into the system, such as access to keystrokes, and view details on the executable including signature status, team identifier if signed and the authority that emitted the signing certificate. This can be used to detect keyloggers and other malicious applications.\n```\nSELECT t.event_tapped, s.identifier, s.signed, s.team_identifier, s.authority FROM event_taps t JOIN processes p ON p.pid = t.tapping_process JOIN signature s on s.path = p.path WHERE s.identifier !='com.apple.ViewBridgeAuxiliary' AND s.identifier !='com.apple.universalaccessd' AND s.identifier !='com.apple.accessibility.AXVisualSupportAgent';\n```" + "examples": "Identify processes that have a tap into the system, such as access to keystrokes, and view details on the executable including signature status, team identifier if signed and the authority that emitted the signing certificate. This can be used to detect keyloggers and other malicious applications.\n```\nSELECT t.event_tapped, s.identifier, s.signed, s.team_identifier, s.authority FROM event_taps t JOIN processes p ON p.pid = t.tapping_process JOIN signature s on s.path = p.path WHERE s.identifier !='com.apple.ViewBridgeAuxiliary' AND s.identifier !='com.apple.universalaccessd' AND s.identifier !='com.apple.accessibility.AXVisualSupportAgent';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/event_taps.yml" }, { "name": "extended_attributes", "description": "Returns the extended attributes for files (similar to Windows ADS).", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/extended_attributes.table", + "url": "https://fleetdm.com/tables/extended_attributes", "platforms": [ "darwin", "linux" @@ -7909,12 +8055,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/extended_attributes.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fextended_attributes.yml&value=name%3A%20extended_attributes%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "fan_speed_sensors", "description": "Fan speeds.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/fan_speed_sensors.table", + "url": "https://fleetdm.com/tables/fan_speed_sensors", "platforms": [ "darwin" ], @@ -7969,12 +8117,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/fan_speed_sensors.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Ffan_speed_sensors.yml&value=name%3A%20fan_speed_sensors%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "fbsd_kmods", "description": "Loaded FreeBSD kernel modules.", - "url": "https://github.com/osquery/osquery/blob/master/specs/freebsd/fbsd_kmods.table", + "url": "https://fleetdm.com/tables/fbsd_kmods", "platforms": [ "freebsd" ], @@ -8013,12 +8163,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/freebsd/fbsd_kmods.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Ffbsd_kmods.yml&value=name%3A%20fbsd_kmods%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "file", "description": "Interactive filesystem attributes and metadata.", - "url": "https://github.com/osquery/osquery/blob/master/specs/utility/file.table", + "url": "https://fleetdm.com/tables/file", "platforms": [ "darwin", "linux", @@ -8168,49 +8320,67 @@ "name": "attributes", "description": "File attrib string. See: https://ss64.com/nt/attrib.html", "type": "text", - "hidden": true, + "hidden": false, "required": false, - "index": false + "index": false, + "platforms": [ + "Windows" + ] }, { "name": "volume_serial", "description": "Volume serial number", "type": "text", - "hidden": true, + "hidden": false, "required": false, - "index": false + "index": false, + "platforms": [ + "Windows" + ] }, { "name": "file_id", "description": "file ID", "type": "text", - "hidden": true, + "hidden": false, "required": false, - "index": false + "index": false, + "platforms": [ + "Windows" + ] }, { "name": "file_version", "description": "File version", "type": "text", - "hidden": true, + "hidden": false, "required": false, - "index": false + "index": false, + "platforms": [ + "Windows" + ] }, { "name": "product_version", "description": "File product version", "type": "text", - "hidden": true, + "hidden": false, "required": false, - "index": false + "index": false, + "platforms": [ + "Windows" + ] }, { "name": "original_filename", "description": "(Executable files only) Original filename", "type": "text", - "hidden": true, + "hidden": false, "required": false, - "index": false + "index": false, + "platforms": [ + "Windows" + ] }, { "name": "bsd_flags", @@ -8218,31 +8388,41 @@ "type": "text", "hidden": false, "required": false, - "index": false + "index": false, + "platforms": [ + "macOS" + ] }, { "name": "pid_with_namespace", "description": "Pids that contain a namespace", "type": "integer", - "hidden": true, + "hidden": false, "required": false, - "index": false + "index": false, + "platforms": [ + "Linux" + ] }, { "name": "mount_namespace_id", "description": "Mount namespace id", "type": "text", - "hidden": true, + "hidden": false, "required": false, - "index": false + "index": false, + "platforms": [ + "Linux" + ] } ], - "examples": "List zip files in the downloads folder as well as their associated sha256 hash.\n```\nSELECT f.path, h.sha256 FROM file f JOIN hash h ON f.path = h.path WHERE f.path LIKE '/Users/%/Downloads/%%.zip';\n```" + "examples": "List zip files in the downloads folder as well as their associated sha256 hash.\n```\nSELECT f.path, h.sha256 FROM file f JOIN hash h ON f.path = h.path WHERE f.path LIKE '/Users/%/Downloads/%%.zip';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/file.yml" }, { "name": "file_events", "description": "Track time/action changes to files specified in configuration data.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/file_events.table", + "url": "https://fleetdm.com/tables/file_events", "platforms": [ "darwin", "linux" @@ -8394,12 +8574,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/file_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Ffile_events.yml&value=name%3A%20file_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "firefox_addons", "description": "Firefox browser extensions, webapps, and addons.", - "url": "https://github.com/osquery/osquery/blob/master/specs/firefox_addons.table", + "url": "https://fleetdm.com/tables/firefox_addons", "platforms": [ "darwin", "linux", @@ -8415,7 +8597,8 @@ "type": "bigint", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "name", @@ -8530,12 +8713,13 @@ "index": false } ], - "examples": "See Firefox extensions by user as well as information about their creator and automatic update status.\n```\nSELECT u.username, f.identifier, f.creator, f.description, f.version, f.autoupdate FROM users u CROSS JOIN firefox_addons f USING (uid) WHERE f.active='1';\n```" + "examples": "See Firefox extensions by user as well as information about their creator and automatic update status.\n```\nSELECT u.username, f.identifier, f.creator, f.description, f.version, f.autoupdate FROM users u CROSS JOIN firefox_addons f USING (uid) WHERE f.active='1';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firefox_addons.yml" }, { "name": "gatekeeper", "description": "macOS Gatekeeper Details.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/gatekeeper.table", + "url": "https://fleetdm.com/tables/gatekeeper", "platforms": [ "darwin" ], @@ -8575,12 +8759,13 @@ "index": false } ], - "examples": "Policy query to check that Gatekeeper is enabled\n```\nSELECT 1 FROM gatekeeper WHERE assessments_enabled = 1;\n```" + "examples": "Policy query to check that Gatekeeper is enabled\n```\nSELECT 1 FROM gatekeeper WHERE assessments_enabled = 1;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/gatekeeper.yml" }, { "name": "gatekeeper_approved_apps", "description": "Gatekeeper apps a user has allowed to run.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/gatekeeper_approved_apps.table", + "url": "https://fleetdm.com/tables/gatekeeper_approved_apps", "platforms": [ "darwin" ], @@ -8619,12 +8804,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/gatekeeper_approved_apps.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fgatekeeper_approved_apps.yml&value=name%3A%20gatekeeper_approved_apps%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "groups", "description": "Local system groups.", - "url": "https://github.com/osquery/osquery/blob/master/specs/groups.table", + "url": "https://fleetdm.com/tables/groups", "platforms": [ "darwin", "linux", @@ -8704,12 +8891,13 @@ } ], "examples": "See all groups with the IsHidden OpenDirectory attribute\n```\nSELECT * FROM groups WHERE is_hidden='1';\n```", - "notes": "* On Windows, `gid` and `gid_signed` are always the same" + "notes": "* On Windows, `gid` and `gid_signed` are always the same", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/groups.yml" }, { "name": "hardware_events", "description": "Hardware (PCI/USB/HID) events from UDEV or IOKit.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/hardware_events.table", + "url": "https://fleetdm.com/tables/hardware_events", "platforms": [ "darwin", "linux" @@ -8813,12 +9001,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/hardware_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fhardware_events.yml&value=name%3A%20hardware_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "hash", "description": "Filesystem hash data.", - "url": "https://github.com/osquery/osquery/blob/master/specs/hash.table", + "url": "https://fleetdm.com/tables/hash", "platforms": [ "darwin", "linux", @@ -8891,12 +9081,13 @@ ] } ], - "examples": "List zip files in the downloads folder as well as their associated sha256 hash.\n```\nSELECT f.path, h.sha256 FROM file f JOIN hash h ON f.path = h.path WHERE f.path LIKE '/Users/%/Downloads/%%.zip';\n```" + "examples": "List zip files in the downloads folder as well as their associated sha256 hash.\n```\nSELECT f.path, h.sha256 FROM file f JOIN hash h ON f.path = h.path WHERE f.path LIKE '/Users/%/Downloads/%%.zip';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/hash.yml" }, { "name": "homebrew_packages", "description": "The installed homebrew package database.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/homebrew_packages.table", + "url": "https://fleetdm.com/tables/homebrew_packages", "platforms": [ "darwin" ], @@ -8936,12 +9127,13 @@ "index": false } ], - "examples": "Check the version of a package installed via homebrew. This example checks the version of ffmeg, which should be replaced by the actual package you want to check for. This is useful for finding problematic or vulnerable installs, though Fleet will detect vulnerable packages automatically.\n```\nSELECT version FROM homebrew_packages WHERE name = 'ffmpeg';\n```" + "examples": "Check the version of a package installed via homebrew. This example checks the version of ffmeg, which should be replaced by the actual package you want to check for. This is useful for finding problematic or vulnerable installs, though Fleet will detect vulnerable packages automatically.\n```\nSELECT version FROM homebrew_packages WHERE name = 'ffmpeg';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/homebrew_packages.yml" }, { "name": "hvci_status", "description": "Retrieve HVCI info of the machine.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/hvci_status.table", + "url": "https://fleetdm.com/tables/hvci_status", "platforms": [ "windows" ], @@ -8988,12 +9180,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/hvci_status.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fhvci_status.yml&value=name%3A%20hvci_status%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "ibridge_info", "description": "Information about the Apple iBridge hardware controller.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/ibridge_info.table", + "url": "https://fleetdm.com/tables/ibridge_info", "platforms": [ "darwin" ], @@ -9032,12 +9226,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/ibridge_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fibridge_info.yml&value=name%3A%20ibridge_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "ie_extensions", "description": "Internet Explorer browser extensions.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/ie_extensions.table", + "url": "https://fleetdm.com/tables/ie_extensions", "platforms": [ "windows" ], @@ -9076,12 +9272,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/ie_extensions.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fie_extensions.yml&value=name%3A%20ie_extensions%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "intel_me_info", "description": "Intel ME/CSE Info.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linwin/intel_me_info.table", + "url": "https://fleetdm.com/tables/intel_me_info", "platforms": [ "linux", "windows" @@ -9097,12 +9295,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linwin/intel_me_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fintel_me_info.yml&value=name%3A%20intel_me_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "interface_addresses", "description": "Network interfaces and relevant metadata.", - "url": "https://github.com/osquery/osquery/blob/master/specs/interface_addresses.table", + "url": "https://fleetdm.com/tables/interface_addresses", "platforms": [ "darwin", "linux", @@ -9172,12 +9372,13 @@ ] } ], - "examples": "Find all interfaces that have a public Internet IP. This query filters out all RFC1918 IPv4 addresses as well as IPv6 localhost.\n```\nSELECT * FROM interface_addresses WHERE address NOT LIKE '192.168%%' AND address NOT LIKE '172.16%%' AND address NOT LIKE '172.17%%' AND address NOT LIKE '172.18%%' AND address NOT LIKE '172.19%%' AND address NOT LIKE '172.20%%' AND address NOT LIKE '172.21%%' AND address NOT LIKE '172.22%%' AND address NOT LIKE '172.23%%' AND address NOT LIKE '10.%%' AND address NOT LIKE '127.%%' AND address IS NOT NULL AND address IS NOT ' ' AND address IS NOT '' AND address IS NOT '::1' AND mask IS NOT 'ffff:ffff:ffff:ffff::';\n```" + "examples": "Find all interfaces that have a public Internet IP. This query filters out all RFC1918 IPv4 addresses as well as IPv6 localhost.\n```\nSELECT * FROM interface_addresses WHERE address NOT LIKE '192.168%%' AND address NOT LIKE '172.16%%' AND address NOT LIKE '172.17%%' AND address NOT LIKE '172.18%%' AND address NOT LIKE '172.19%%' AND address NOT LIKE '172.20%%' AND address NOT LIKE '172.21%%' AND address NOT LIKE '172.22%%' AND address NOT LIKE '172.23%%' AND address NOT LIKE '10.%%' AND address NOT LIKE '127.%%' AND address IS NOT NULL AND address IS NOT ' ' AND address IS NOT '' AND address IS NOT '::1' AND mask IS NOT 'ffff:ffff:ffff:ffff::';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_addresses.yml" }, { "name": "interface_details", "description": "Detailed information and stats of network interfaces.", - "url": "https://github.com/osquery/osquery/blob/master/specs/interface_details.table", + "url": "https://fleetdm.com/tables/interface_details", "platforms": [ "darwin", "linux", @@ -9525,12 +9726,13 @@ "Windows" ] } - ] + ], + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_details.yml" }, { "name": "interface_ipv6", "description": "IPv6 configuration and stats of network interfaces.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/interface_ipv6.table", + "url": "https://fleetdm.com/tables/interface_ipv6", "platforms": [ "darwin", "linux" @@ -9579,12 +9781,13 @@ "index": false } ], - "examples": "Identify interfaces using IPv6 with forwarding enabled.\n```\nSELECT interface FROM interface_ipv6 WHERE forwarding_enabled='1';\n```" + "examples": "Identify interfaces using IPv6 with forwarding enabled.\n```\nSELECT interface FROM interface_ipv6 WHERE forwarding_enabled='1';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_ipv6.yml" }, { "name": "iokit_devicetree", "description": "The IOKit registry matching the DeviceTree plane.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/iokit_devicetree.table", + "url": "https://fleetdm.com/tables/iokit_devicetree", "platforms": [ "darwin" ], @@ -9664,12 +9867,13 @@ "index": false } ], - "examples": "List the components in a Mac's device tree\n```\nSELECT * from iokit_devicetree;\n```" + "examples": "List the components in a Mac's device tree\n```\nSELECT * from iokit_devicetree;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iokit_devicetree.yml" }, { "name": "iokit_registry", "description": "The full IOKit registry without selecting a plane.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/iokit_registry.table", + "url": "https://fleetdm.com/tables/iokit_registry", "platforms": [ "darwin" ], @@ -9733,12 +9937,13 @@ "index": false } ], - "examples": "Identify devices with a Yubikey connected. The name will also contain the protocols supported by the key, such as FIDO.\n```\nSELECT * from iokit_registry WHERE name LIKE 'Yubi%';\n```" + "examples": "Identify devices with a Yubikey connected. The name will also contain the protocols supported by the key, such as FIDO.\n```\nSELECT * from iokit_registry WHERE name LIKE 'Yubi%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iokit_registry.yml" }, { "name": "iptables", "description": "Linux IP packet filtering and NAT tool.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/iptables.table", + "url": "https://fleetdm.com/tables/iptables", "platforms": [ "linux" ], @@ -9889,12 +10094,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/iptables.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fiptables.yml&value=name%3A%20iptables%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "kernel_extensions", "description": "macOS's kernel extensions, both loaded and within the load search path.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/kernel_extensions.table", + "url": "https://fleetdm.com/tables/kernel_extensions", "platforms": [ "darwin" ], @@ -9958,12 +10165,13 @@ "index": false } ], - "examples": "Identify third-party kernel extensions.\n```\nSELECT * FROM kernel_extensions WHERE name NOT LIKE 'com.apple%' AND name NOT LIKE '__kernel__';\n```" + "examples": "Identify third-party kernel extensions.\n```\nSELECT * FROM kernel_extensions WHERE name NOT LIKE 'com.apple%' AND name NOT LIKE '__kernel__';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_extensions.yml" }, { "name": "kernel_info", "description": "Basic active kernel information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/kernel_info.table", + "url": "https://fleetdm.com/tables/kernel_info", "platforms": [ "darwin", "linux", @@ -10006,12 +10214,13 @@ "index": false } ], - "examples": "See the kernel version running\n```\nSELECT version FROM kernel_info;\n```" + "examples": "See the kernel version running\n```\nSELECT version FROM kernel_info;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_info.yml" }, { "name": "kernel_modules", "description": "Linux kernel modules both loaded and within the load search path.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/kernel_modules.table", + "url": "https://fleetdm.com/tables/kernel_modules", "platforms": [ "linux" ], @@ -10058,12 +10267,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/kernel_modules.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fkernel_modules.yml&value=name%3A%20kernel_modules%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "kernel_panics", "description": "System kernel panic logs.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/kernel_panics.table", + "url": "https://fleetdm.com/tables/kernel_panics", "platforms": [ "darwin" ], @@ -10175,12 +10386,13 @@ "index": false } ], - "examples": "Look for kernel panics and see which module was last loaded before they happened.\n```\nSELECT os_version, name, time, system_model, last_loaded FROM kernel_panics;\n```" + "examples": "Look for kernel panics and see which module was last loaded before they happened.\n```\nSELECT os_version, name, time, system_model, last_loaded FROM kernel_panics;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_panics.yml" }, { "name": "keychain_acls", "description": "Applications that have ACL entries in the keychain.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/keychain_acls.table", + "url": "https://fleetdm.com/tables/keychain_acls", "platforms": [ "darwin" ], @@ -10228,12 +10440,13 @@ "index": false } ], - "examples": "Identify keychain items with permissions granted to Applications at the system or user level.SELECT * FROM keychain_acls WHERE path LIKE '/System/Applications/%%' OR path LIKE '/Users/%%/Applications/%%';\n```\nSELECT * FROM keychain_acls WHERE path LIKE '/System/Applications/%%' OR path LIKE '/Users/%%/Applications/%%';\n```" + "examples": "Identify keychain items with permissions granted to Applications at the system or user level.\n```\nSELECT * FROM keychain_acls WHERE path LIKE '/System/Applications/%%' OR path LIKE '/Users/%%/Applications/%%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/keychain_acls.yml" }, { "name": "keychain_items", "description": "Generic details about keychain items.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/keychain_items.table", + "url": "https://fleetdm.com/tables/keychain_items", "platforms": [ "darwin" ], @@ -10274,7 +10487,7 @@ }, { "name": "created", - "description": "Data item was created", + "description": "Date item was created", "type": "text", "hidden": false, "required": false, @@ -10305,12 +10518,13 @@ "index": false } ], - "examples": "Identify Macs that contain certificates related to Apple application signing and notarization. (replace with your Apple Developer ID string)\n```\nSELECT * FROM keychain_items WHERE label LIKE '%8EHZ83LZNU%';\n```" + "examples": "Identify Macs that contain certificates related to Apple application signing and notarization. (replace with your Apple Developer ID string)\n```\nSELECT * FROM keychain_items WHERE label LIKE '%8EHZ83LZNU%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/keychain_items.yml" }, { "name": "known_hosts", "description": "A line-delimited known_hosts table.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/known_hosts.table", + "url": "https://fleetdm.com/tables/known_hosts", "platforms": [ "darwin", "linux" @@ -10324,7 +10538,8 @@ "type": "bigint", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "key", @@ -10342,12 +10557,13 @@ "required": false, "index": false } - ] + ], + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/known_hosts.yml" }, { "name": "kva_speculative_info", "description": "Display kernel virtual address and speculative execution information for the system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/kva_speculative_info.table", + "url": "https://fleetdm.com/tables/kva_speculative_info", "platforms": [ "windows" ], @@ -10442,12 +10658,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/kva_speculative_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fkva_speculative_info.yml&value=name%3A%20kva_speculative_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "last", "description": "System logins and logouts.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/last.table", + "url": "https://fleetdm.com/tables/last", "platforms": [ "darwin", "linux" @@ -10512,12 +10730,13 @@ "index": false } ], - "examples": "System logins and logouts with formatted time.\n```\nSELECT strftime('%Y-%m-%d %H:%M:%S',time,'unixepoch') AS formatted_time, username, pid, type FROM last WHERE tty='console'; \n```" + "examples": "System logins and logouts with formatted time.\n```\nSELECT strftime('%Y-%m-%d %H:%M:%S',time,'unixepoch') AS formatted_time, username, pid, type FROM last WHERE tty='console'; \n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/last.yml" }, { "name": "launchd", "description": "LaunchAgents and LaunchDaemons from default search paths.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/launchd.table", + "url": "https://fleetdm.com/tables/launchd", "platforms": [ "darwin" ], @@ -10693,12 +10912,13 @@ "index": false } ], - "examples": "List launch daemons that run an application in the Applications directory.\n```\nSELECT * FROM launchd WHERE program LIKE '/Applications/%%' OR program LIKE '/Users/%%/Applications/%%';\n```" + "examples": "List launch daemons that run an application in the Applications directory.\n```\nSELECT * FROM launchd WHERE program LIKE '/Applications/%%' OR program LIKE '/Users/%%/Applications/%%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/launchd.yml" }, { "name": "launchd_overrides", "description": "Override keys, per user, for LaunchDaemons and Agents.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/launchd_overrides.table", + "url": "https://fleetdm.com/tables/launchd_overrides", "platforms": [ "darwin" ], @@ -10745,12 +10965,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/launchd_overrides.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flaunchd_overrides.yml&value=name%3A%20launchd_overrides%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "listening_ports", "description": "Processes with listening (bound) network sockets/ports.", - "url": "https://github.com/osquery/osquery/blob/master/specs/listening_ports.table", + "url": "https://fleetdm.com/tables/listening_ports", "platforms": [ "darwin", "linux", @@ -10836,12 +11058,13 @@ ] } ], - "examples": "List executables listening on network ports.\n```\nSELECT l.port, l.pid, p.name, p.path FROM listening_ports l JOIN processes p USING (pid); \n```" + "examples": "List executables listening on network ports.\n```\nSELECT l.port, l.pid, p.name, p.path FROM listening_ports l JOIN processes p USING (pid); \n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/listening_ports.yml" }, { "name": "load_average", "description": "Displays information about the system wide load averages.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/load_average.table", + "url": "https://fleetdm.com/tables/load_average", "platforms": [ "darwin", "linux" @@ -10866,12 +11089,13 @@ "index": false } ], - "examples": "Find computers with a load average of 3.5 or higher over the last 15 minutes.\n```\nSELECT average from load_average WHERE period='15m' AND average>=3.5;\n```" + "examples": "Find computers with a load average of 3.5 or higher over the last 15 minutes.\n```\nSELECT average from load_average WHERE period='15m' AND average>=3.5;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/load_average.yml" }, { "name": "location_services", "description": "Reports the status of the Location Services feature of the OS.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/location_services.table", + "url": "https://fleetdm.com/tables/location_services", "platforms": [ "darwin" ], @@ -10887,12 +11111,13 @@ "index": false } ], - "examples": "If this query returns a 1 in the enabled column, location services are enabled on this Mac.\n```\nSELECT enabled from location_services;\n```" + "examples": "If this query returns a 1 in the enabled column, location services are enabled on this Mac.\n```\nSELECT enabled from location_services;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/location_services.yml" }, { "name": "logged_in_users", "description": "Users with an active shell on the system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/logged_in_users.table", + "url": "https://fleetdm.com/tables/logged_in_users", "platforms": [ "darwin", "linux", @@ -10973,12 +11198,13 @@ ] } ], - "examples": "See the user currently logged in on the console of the computer.\n```\nSELECT user, type, tty from logged_in_users WHERE tty='console';\n```" + "examples": "See the user currently logged in on the console of the computer.\n```\nSELECT user, type, tty from logged_in_users WHERE tty='console';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/logged_in_users.yml" }, { "name": "logical_drives", "description": "Details for logical drives on the system. A logical drive generally represents a single partition.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/logical_drives.table", + "url": "https://fleetdm.com/tables/logical_drives", "platforms": [ "windows" ], @@ -11041,12 +11267,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/logical_drives.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flogical_drives.yml&value=name%3A%20logical_drives%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "logon_sessions", "description": "Windows Logon Session.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/logon_sessions.table", + "url": "https://fleetdm.com/tables/logon_sessions", "platforms": [ "windows" ], @@ -11173,12 +11401,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/logon_sessions.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flogon_sessions.yml&value=name%3A%20logon_sessions%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "lxd_certificates", "description": "LXD certificates information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_certificates.table", + "url": "https://fleetdm.com/tables/lxd_certificates", "platforms": [ "linux" ], @@ -11217,12 +11447,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_certificates.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flxd_certificates.yml&value=name%3A%20lxd_certificates%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "lxd_cluster", "description": "LXD cluster information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_cluster.table", + "url": "https://fleetdm.com/tables/lxd_cluster", "platforms": [ "linux" ], @@ -11285,12 +11517,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_cluster.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flxd_cluster.yml&value=name%3A%20lxd_cluster%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "lxd_cluster_members", "description": "LXD cluster members information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_cluster_members.table", + "url": "https://fleetdm.com/tables/lxd_cluster_members", "platforms": [ "linux" ], @@ -11337,12 +11571,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_cluster_members.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flxd_cluster_members.yml&value=name%3A%20lxd_cluster_members%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "lxd_images", "description": "LXD images information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_images.table", + "url": "https://fleetdm.com/tables/lxd_images", "platforms": [ "linux" ], @@ -11501,12 +11737,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_images.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flxd_images.yml&value=name%3A%20lxd_images%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "lxd_instance_config", "description": "LXD instance configuration information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_instance_config.table", + "url": "https://fleetdm.com/tables/lxd_instance_config", "platforms": [ "linux" ], @@ -11537,12 +11775,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_instance_config.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flxd_instance_config.yml&value=name%3A%20lxd_instance_config%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "lxd_instance_devices", "description": "LXD instance devices information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_instance_devices.table", + "url": "https://fleetdm.com/tables/lxd_instance_devices", "platforms": [ "linux" ], @@ -11589,12 +11829,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_instance_devices.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flxd_instance_devices.yml&value=name%3A%20lxd_instance_devices%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "lxd_instances", "description": "LXD instances information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_instances.table", + "url": "https://fleetdm.com/tables/lxd_instances", "platforms": [ "linux" ], @@ -11689,12 +11931,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_instances.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flxd_instances.yml&value=name%3A%20lxd_instances%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "lxd_networks", "description": "LXD network information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_networks.table", + "url": "https://fleetdm.com/tables/lxd_networks", "platforms": [ "linux" ], @@ -11805,12 +12049,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_networks.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flxd_networks.yml&value=name%3A%20lxd_networks%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "lxd_storage_pools", "description": "LXD storage pool information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_storage_pools.table", + "url": "https://fleetdm.com/tables/lxd_storage_pools", "platforms": [ "linux" ], @@ -11881,12 +12127,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/lxd_storage_pools.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Flxd_storage_pools.yml&value=name%3A%20lxd_storage_pools%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "magic", "description": "Magic number recognition library table.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/magic.table", + "url": "https://fleetdm.com/tables/magic", "platforms": [ "darwin", "linux" @@ -11934,12 +12182,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/magic.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmagic.yml&value=name%3A%20magic%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "managed_policies", "description": "The managed configuration policies from AD, MDM, MCX, etc.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/managed_policies.table", + "url": "https://fleetdm.com/tables/managed_policies", "platforms": [ "darwin" ], @@ -11995,12 +12245,13 @@ "index": false } ], - "examples": "Check if critical software update installation is enabled via a profile (1 = enabled)\n```\nSELECT name, value FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='CriticalUpdateInstall' LIMIT 1;\n```" + "examples": "Check if critical software update installation is enabled via a profile (1 = enabled)\n```\nSELECT name, value FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='CriticalUpdateInstall' LIMIT 1;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/managed_policies.yml" }, { "name": "md_devices", "description": "Software RAID array settings.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/md_devices.table", + "url": "https://fleetdm.com/tables/md_devices", "platforms": [ "linux" ], @@ -12255,12 +12506,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/md_devices.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmd_devices.yml&value=name%3A%20md_devices%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "md_drives", "description": "Drive devices used for Software RAID.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/md_drives.table", + "url": "https://fleetdm.com/tables/md_drives", "platforms": [ "linux" ], @@ -12299,12 +12552,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/md_drives.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmd_drives.yml&value=name%3A%20md_drives%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "md_personalities", "description": "Software RAID setting supported by the kernel.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/md_personalities.table", + "url": "https://fleetdm.com/tables/md_personalities", "platforms": [ "linux" ], @@ -12319,12 +12574,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/md_personalities.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmd_personalities.yml&value=name%3A%20md_personalities%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "mdfind", "description": "Run searches against the spotlight database.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/mdfind.table", + "url": "https://fleetdm.com/tables/mdfind", "platforms": [ "darwin" ], @@ -12347,12 +12604,14 @@ "required": true, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/mdfind.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmdfind.yml&value=name%3A%20mdfind%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "mdls", "description": "Query file metadata in the Spotlight database.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/mdls.table", + "url": "https://fleetdm.com/tables/mdls", "platforms": [ "darwin" ], @@ -12392,12 +12651,13 @@ "index": false } ], - "examples": "Identify hidden files that have been indexed by Spotlight. This could reveal files that were recently deleted and are still in the Spotlight database.\n```\nSELECT * FROM mdls WHERE path LIKE '/Users/g/%%' AND key='kMDItemFSIsExtensionHidden' AND value='true';\n```" + "examples": "Identify hidden files that have been indexed by Spotlight. This could reveal files that were recently deleted and are still in the Spotlight database.\n```\nSELECT * FROM mdls WHERE path LIKE '/Users/g/%%' AND key='kMDItemFSIsExtensionHidden' AND value='true';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdls.yml" }, { "name": "memory_array_mapped_addresses", "description": "Data associated for address mapping of physical memory arrays.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/memory_array_mapped_addresses.table", + "url": "https://fleetdm.com/tables/memory_array_mapped_addresses", "platforms": [ "darwin", "linux" @@ -12445,12 +12705,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/memory_array_mapped_addresses.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmemory_array_mapped_addresses.yml&value=name%3A%20memory_array_mapped_addresses%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "memory_arrays", "description": "Data associated with collection of memory devices that operate to form a memory address.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/memory_arrays.table", + "url": "https://fleetdm.com/tables/memory_arrays", "platforms": [ "darwin", "linux" @@ -12514,12 +12776,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/memory_arrays.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmemory_arrays.yml&value=name%3A%20memory_arrays%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "memory_device_mapped_addresses", "description": "Data associated for address mapping of physical memory devices.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/memory_device_mapped_addresses.table", + "url": "https://fleetdm.com/tables/memory_device_mapped_addresses", "platforms": [ "darwin", "linux" @@ -12591,12 +12855,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/memory_device_mapped_addresses.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmemory_device_mapped_addresses.yml&value=name%3A%20memory_device_mapped_addresses%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "memory_devices", "description": "Physical memory device (type 17) information retrieved from SMBIOS.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/memory_devices.table", + "url": "https://fleetdm.com/tables/memory_devices", "platforms": [ "darwin", "linux" @@ -12764,12 +13030,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/memory_devices.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmemory_devices.yml&value=name%3A%20memory_devices%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "memory_error_info", "description": "Data associated with errors of a physical memory array.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/memory_error_info.table", + "url": "https://fleetdm.com/tables/memory_error_info", "platforms": [ "darwin", "linux" @@ -12841,12 +13109,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/memory_error_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmemory_error_info.yml&value=name%3A%20memory_error_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "memory_info", "description": "Main memory information in bytes.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/memory_info.table", + "url": "https://fleetdm.com/tables/memory_info", "platforms": [ "linux" ], @@ -12933,12 +13203,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/memory_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmemory_info.yml&value=name%3A%20memory_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "memory_map", "description": "OS memory region map.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/memory_map.table", + "url": "https://fleetdm.com/tables/memory_map", "platforms": [ "linux" ], @@ -12969,12 +13241,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/memory_map.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmemory_map.yml&value=name%3A%20memory_map%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "mounts", "description": "System mounted devices and filesystems (not process specific).", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/mounts.table", + "url": "https://fleetdm.com/tables/mounts", "platforms": [ "darwin", "linux" @@ -13071,12 +13345,13 @@ "index": false } ], - "examples": "If this query returns a 1 in the enabled column, location services are enabled on this Mac.\n```\nSELECT enabled from location_services;\n```" + "examples": "If this query returns a 1 in the enabled column, location services are enabled on this Mac.\n```\nSELECT enabled from location_services;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mounts.yml" }, { "name": "msr", "description": "Various pieces of data stored in the model specific register per processor. NOTE: the msr kernel module must be enabled, and osquery must be run as root.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/msr.table", + "url": "https://fleetdm.com/tables/msr", "platforms": [ "linux" ], @@ -13163,12 +13438,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/msr.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fmsr.yml&value=name%3A%20msr%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "nfs_shares", "description": "NFS shares exported by the host.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/nfs_shares.table", + "url": "https://fleetdm.com/tables/nfs_shares", "platforms": [ "darwin" ], @@ -13200,12 +13477,13 @@ "index": false } ], - "examples": "List shares exported via NFS on Macs, and if they are read only (readonly=1) or not.\n```\nSELECT share, readonly FROM nfs_shares;\n```" + "examples": "List shares exported via NFS on Macs, and if they are read only (readonly=1) or not.\n```\nSELECT share, readonly FROM nfs_shares;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nfs_shares.yml" }, { "name": "npm_packages", "description": "Node packages installed in a system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/npm_packages.table", + "url": "https://fleetdm.com/tables/npm_packages", "platforms": [ "darwin", "linux", @@ -13301,12 +13579,14 @@ "Linux" ] } - ] + ], + "examples": "List the author, description and more information about packages made by Fleet. Replace the homepage with any other distributor desired.\n```\nSELECT author, description, directory, version FROM npm_packages WHERE homepage='https://fleetdm.com';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/npm_packages.yml" }, { "name": "ntdomains", "description": "Display basic NT domain information of a Windows machine.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/ntdomains.table", + "url": "https://fleetdm.com/tables/ntdomains", "platforms": [ "windows" ], @@ -13377,12 +13657,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/ntdomains.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fntdomains.yml&value=name%3A%20ntdomains%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "ntfs_acl_permissions", "description": "Retrieve NTFS ACL permission information for files and directories.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/ntfs_acl_permissions.table", + "url": "https://fleetdm.com/tables/ntfs_acl_permissions", "platforms": [ "windows" ], @@ -13429,12 +13711,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/ntfs_acl_permissions.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fntfs_acl_permissions.yml&value=name%3A%20ntfs_acl_permissions%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "ntfs_journal_events", "description": "Track time/action changes to files specified in configuration data.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/ntfs_journal_events.table", + "url": "https://fleetdm.com/tables/ntfs_journal_events", "platforms": [ "windows" ], @@ -13545,12 +13829,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/ntfs_journal_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fntfs_journal_events.yml&value=name%3A%20ntfs_journal_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "nvram", "description": "Apple NVRAM variable listing.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/nvram.table", + "url": "https://fleetdm.com/tables/nvram", "platforms": [ "darwin" ], @@ -13582,12 +13868,13 @@ "index": false } ], - "examples": "If a Mac had a sleep failure, this query will return the reason for it.\n```\nSELECT name, value FROM nvram WHERE name='SleepWakeFailureString';\n```" + "examples": "If a Mac had a sleep failure, this query will return the reason for it.\n```\nSELECT name, value FROM nvram WHERE name='SleepWakeFailureString';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nvram.yml" }, { "name": "oem_strings", "description": "OEM defined strings retrieved from SMBIOS.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/oem_strings.table", + "url": "https://fleetdm.com/tables/oem_strings", "platforms": [ "darwin", "linux" @@ -13619,12 +13906,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/oem_strings.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Foem_strings.yml&value=name%3A%20oem_strings%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "office_mru", "description": "View recently opened Office documents.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/office_mru.table", + "url": "https://fleetdm.com/tables/office_mru", "platforms": [ "windows" ], @@ -13671,12 +13960,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/office_mru.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Foffice_mru.yml&value=name%3A%20office_mru%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "os_version", "description": "A single row containing the operating system name and version.", - "url": "https://github.com/osquery/osquery/blob/master/specs/os_version.table", + "url": "https://fleetdm.com/tables/os_version", "platforms": [ "darwin", "linux", @@ -13800,12 +14091,13 @@ ] } ], - "examples": "See the OS version as well as the CPU architecture in use (X86 vs ARM for example)\n```\nSELECT arch, version FROM os_version;\n```" + "examples": "See the OS version as well as the CPU architecture in use (X86 vs ARM for example)\n```\nSELECT arch, version FROM os_version;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/os_version.yml" }, { "name": "osquery_events", "description": "Information about the event publishers and subscribers.", - "url": "https://github.com/osquery/osquery/blob/master/specs/utility/osquery_events.table", + "url": "https://fleetdm.com/tables/osquery_events", "platforms": [ "darwin", "linux", @@ -13872,12 +14164,13 @@ "index": false } ], - "examples": "Identify osquery event types which have no subscriber.\n```\nSELECT * from osquery_events WHERE subscriptions='0';\n```" + "examples": "Identify osquery event types which have no subscriber.\n```\nSELECT * from osquery_events WHERE subscriptions='0';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_events.yml" }, { "name": "osquery_extensions", "description": "List of active osquery extensions.", - "url": "https://github.com/osquery/osquery/blob/master/specs/utility/osquery_extensions.table", + "url": "https://fleetdm.com/tables/osquery_extensions", "platforms": [ "darwin", "linux", @@ -13936,12 +14229,13 @@ "index": false } ], - "examples": "Identify osquery extensions in use that are not part of osquery core.\n```\nSELECT name, path from osquery_extensions WHERE type IS NOT 'core';\n```" + "examples": "Identify osquery extensions in use that are not part of osquery core.\n```\nSELECT name, path from osquery_extensions WHERE type IS NOT 'core';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_extensions.yml" }, { "name": "osquery_flags", "description": "Configurable flags that modify osquery's behavior.", - "url": "https://github.com/osquery/osquery/blob/master/specs/utility/osquery_flags.table", + "url": "https://fleetdm.com/tables/osquery_flags", "platforms": [ "darwin", "linux", @@ -14000,12 +14294,13 @@ "index": false } ], - "examples": "If disable_events has a value of false, events are enabled.\n```\nSELECT description, name, value FROM osquery_flags WHERE name='disable_events';\n```" + "examples": "If disable_events has a value of false, events are enabled.\n```\nSELECT description, name, value FROM osquery_flags WHERE name='disable_events';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_flags.yml" }, { "name": "osquery_info", "description": "Top level information about the running version of osquery.", - "url": "https://github.com/osquery/osquery/blob/master/specs/utility/osquery_info.table", + "url": "https://fleetdm.com/tables/osquery_info", "platforms": [ "darwin", "linux", @@ -14112,12 +14407,13 @@ "index": false } ], - "examples": "See the version of the currently running osquery.\n```\nSELECT version FROM osquery_info; \n```" + "examples": "See the version of the currently running osquery.\n```\nSELECT version FROM osquery_info; \n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_info.yml" }, { "name": "osquery_packs", "description": "Information about the current query packs that are loaded in osquery.", - "url": "https://github.com/osquery/osquery/blob/master/specs/utility/osquery_packs.table", + "url": "https://fleetdm.com/tables/osquery_packs", "platforms": [ "darwin", "linux", @@ -14184,12 +14480,13 @@ "index": false } ], - "examples": "See query packs currently active on osquery.\n```\nSELECT name FROM osquery_packs WHERE active='1';\n```" + "examples": "See query packs currently active on osquery.\n```\nSELECT name FROM osquery_packs WHERE active='1';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_packs.yml" }, { "name": "osquery_registry", "description": "List the osquery registry plugins.", - "url": "https://github.com/osquery/osquery/blob/master/specs/utility/osquery_registry.table", + "url": "https://fleetdm.com/tables/osquery_registry", "platforms": [ "darwin", "linux", @@ -14240,12 +14537,13 @@ "index": false } ], - "examples": "See the list of tables available on this instance of osquery.\n```\nSELECT DISTINCT name FROM osquery_registry;\n```" + "examples": "See the list of tables available on this instance of osquery.\n```\nSELECT DISTINCT name FROM osquery_registry;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_registry.yml" }, { "name": "osquery_schedule", "description": "Information about the current queries that are scheduled in osquery.", - "url": "https://github.com/osquery/osquery/blob/master/specs/utility/osquery_schedule.table", + "url": "https://fleetdm.com/tables/osquery_schedule", "platforms": [ "darwin", "linux", @@ -14384,12 +14682,13 @@ "index": false } ], - "examples": "Identify scheduled queries that have been denylisted by the osquery watchdog. This could indicate queries that required a lot of resources to be executed. They will not be executed again until osquery restarts.\n```\nSELECT name, query FROM osquery_schedule WHERE denylisted='1';\n```" + "examples": "Identify scheduled queries that have been denylisted by the osquery watchdog. This could indicate queries that required a lot of resources to be executed. They will not be executed again until osquery restarts.\n```\nSELECT name, query FROM osquery_schedule WHERE denylisted='1';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_schedule.yml" }, { "name": "package_bom", "description": "macOS package bill of materials (BOM) file list.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/package_bom.table", + "url": "https://fleetdm.com/tables/package_bom", "platforms": [ "darwin" ], @@ -14453,12 +14752,13 @@ "index": false } ], - "examples": "List the bill of materials of a package. The receipts directory contains packages to installed applications.\n```\nSELECT * FROM package_bom WHERE path='/private/var/db/receipts/com.yubico.ykman.bom';\n```" + "examples": "List the bill of materials of a package. The receipts directory contains packages to installed applications.\n```\nSELECT * FROM package_bom WHERE path='/private/var/db/receipts/com.yubico.ykman.bom';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_bom.yml" }, { "name": "package_install_history", "description": "macOS package install history.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/package_install_history.table", + "url": "https://fleetdm.com/tables/package_install_history", "platforms": [ "darwin" ], @@ -14514,12 +14814,13 @@ "index": false } ], - "examples": "See a list of packages installed in the last week.\n```\nSELECT name, version, source, datetime(time,'unixepoch') AS install_time from package_install_history WHERE install_time >= datetime('now','-7 days');\n```" + "examples": "See a list of packages installed in the last week.\n```\nSELECT name, version, source, datetime(time,'unixepoch') AS install_time from package_install_history WHERE install_time >= datetime('now','-7 days');\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_install_history.yml" }, { "name": "package_receipts", "description": "macOS package receipt details.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/package_receipts.table", + "url": "https://fleetdm.com/tables/package_receipts", "platforms": [ "darwin" ], @@ -14583,12 +14884,13 @@ "index": false } ], - "examples": "List the location of receipt files related to installed packages.\n```\nSELECT * FROM package_receipts;\n```" + "examples": "List the location of receipt files related to installed packages.\n```\nSELECT * FROM package_receipts;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_receipts.yml" }, { "name": "password_policy", "description": "Password Policies for macOS.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/password_policy.table", + "url": "https://fleetdm.com/tables/password_policy", "platforms": [ "darwin" ], @@ -14627,12 +14929,14 @@ "required": false, "index": false } - ] + ], + "examples": "This policy query will return a 1 if the password policy requires passwords that are 10 characters or longer.\n```\nSELECT 1 FROM (SELECT cast(lengthtxt as integer(2)) minlength FROM (SELECT SUBSTRING(length, 1, 2) AS lengthtxt FROM (SELECT policy_description, policy_identifier, split(policy_content, '{', 1) AS length FROM password_policy WHERE policy_identifier LIKE '%minLength')) WHERE minlength >= 10);\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/password_policy.yml" }, { "name": "patches", "description": "Lists all the patches applied. Note: This does not include patches applied via MSI or downloaded from Windows Update (e.g. Service Packs).", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/patches.table", + "url": "https://fleetdm.com/tables/patches", "platforms": [ "windows" ], @@ -14703,12 +15007,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/patches.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fpatches.yml&value=name%3A%20patches%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "pci_devices", "description": "PCI devices active on the host system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/pci_devices.table", + "url": "https://fleetdm.com/tables/pci_devices", "platforms": [ "darwin", "linux" @@ -14849,12 +15155,14 @@ "Linux" ] } - ] + ], + "examples": "This table allows you to list PCI devices. With this query, identify devices with a specific model ID. This can be useful when trying to identify systems that use common hardware, for example, when trying to target firmware updates or understand similarities between problematic systems.\n```\nSELECT driver, model, vendor, vendor_id FROM pci_devices WHERE model_id='0x1001';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pci_devices.yml" }, { "name": "physical_disk_performance", "description": "Provides provides raw data from performance counters that monitor hard or fixed disk drives on the system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/physical_disk_performance.table", + "url": "https://fleetdm.com/tables/physical_disk_performance", "platforms": [ "windows" ], @@ -14957,12 +15265,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/physical_disk_performance.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fphysical_disk_performance.yml&value=name%3A%20physical_disk_performance%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "pipes", "description": "Named and Anonymous pipes.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/pipes.table", + "url": "https://fleetdm.com/tables/pipes", "platforms": [ "windows" ], @@ -15009,12 +15319,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/pipes.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fpipes.yml&value=name%3A%20pipes%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "pkg_packages", "description": "pkgng packages that are currently installed on the host system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/freebsd/pkg_packages.table", + "url": "https://fleetdm.com/tables/pkg_packages", "platforms": [ "freebsd" ], @@ -15053,12 +15365,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/freebsd/pkg_packages.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fpkg_packages.yml&value=name%3A%20pkg_packages%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "platform_info", "description": "Information about EFI/UEFI/ROM and platform/boot.", - "url": "https://github.com/osquery/osquery/blob/master/specs/platform_info.table", + "url": "https://fleetdm.com/tables/platform_info", "platforms": [ "darwin", "linux", @@ -15133,12 +15447,13 @@ "index": false } ], - "examples": "See version information about the boot system, such as iBoot on Apple Silicon\n```\nSELECT version FROM platform_info;\n```" + "examples": "See version information about the boot system, such as iBoot on Apple Silicon\n```\nSELECT version FROM platform_info;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/platform_info.yml" }, { "name": "plist", "description": "Read and parse a plist file.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/plist.table", + "url": "https://fleetdm.com/tables/plist", "platforms": [ "darwin" ], @@ -15178,12 +15493,13 @@ "index": false } ], - "examples": "Read the contents of a plist file, formatted into a table\n```\nSELECT key, subkey, value FROM plist WHERE path LIKE '/Users/%%/Library/Preferences/com.apple.Terminal.plist';\n```" + "examples": "Read the contents of a plist file, formatted into a table\n```\nSELECT key, subkey, value FROM plist WHERE path LIKE '/Users/%%/Library/Preferences/com.apple.Terminal.plist';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/plist.yml" }, { "name": "portage_keywords", "description": "A summary about portage configurations like keywords, mask and unmask.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/portage_keywords.table", + "url": "https://fleetdm.com/tables/portage_keywords", "platforms": [ "linux" ], @@ -15230,12 +15546,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/portage_keywords.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fportage_keywords.yml&value=name%3A%20portage_keywords%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "portage_packages", "description": "List of currently installed packages.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/portage_packages.table", + "url": "https://fleetdm.com/tables/portage_packages", "platforms": [ "linux" ], @@ -15306,12 +15624,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/portage_packages.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fportage_packages.yml&value=name%3A%20portage_packages%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "portage_use", "description": "List of enabled portage USE values for specific package.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/portage_use.table", + "url": "https://fleetdm.com/tables/portage_use", "platforms": [ "linux" ], @@ -15342,12 +15662,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/portage_use.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fportage_use.yml&value=name%3A%20portage_use%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "power_sensors", "description": "Machine power (currents, voltages, wattages, etc) sensors.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/power_sensors.table", + "url": "https://fleetdm.com/tables/power_sensors", "platforms": [ "darwin" ], @@ -15386,12 +15708,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/power_sensors.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fpower_sensors.yml&value=name%3A%20power_sensors%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "powershell_events", "description": "Powershell script blocks reconstructed to their full script content, this table requires script block logging to be enabled.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/powershell_events.table", + "url": "https://fleetdm.com/tables/powershell_events", "platforms": [ "windows" ], @@ -15462,12 +15786,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/powershell_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fpowershell_events.yml&value=name%3A%20powershell_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "preferences", "description": "macOS defaults and managed preferences.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/preferences.table", + "url": "https://fleetdm.com/tables/preferences", "platforms": [ "darwin" ], @@ -15520,7 +15846,8 @@ "type": "text", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "host", @@ -15531,12 +15858,13 @@ "index": false } ], - "examples": "This table reads a huge amount of preferences, including on third-party apps. This query will show how many users are enrolled to TouchID.\n```\nSELECT * FROM preferences WHERE subkey='dailyEvents/2/enrolledUserCount';\n```" + "examples": "This table reads a huge amount of preferences, including on third-party apps. This query will show how many users are enrolled to TouchID.\n```\nSELECT * FROM preferences WHERE subkey='dailyEvents/2/enrolledUserCount';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/preferences.yml" }, { "name": "prefetch", "description": "Prefetch files show metadata related to file execution.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/prefetch.table", + "url": "https://fleetdm.com/tables/prefetch", "platforms": [ "windows" ], @@ -15647,12 +15975,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/prefetch.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fprefetch.yml&value=name%3A%20prefetch%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "process_envs", "description": "A key/value table of environment variables for each process.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/process_envs.table", + "url": "https://fleetdm.com/tables/process_envs", "platforms": [ "darwin", "linux" @@ -15685,12 +16015,13 @@ "index": false } ], - "examples": "See what PATH is configured as an environment variable.\n```\nSELECT DISTINCT value, key FROM process_envs WHERE key='PATH';\n```" + "examples": "See what PATH is configured as an environment variable.\n```\nSELECT DISTINCT value, key FROM process_envs WHERE key='PATH';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_envs.yml" }, { "name": "process_events", "description": "Track time/action process executions.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/process_events.table", + "url": "https://fleetdm.com/tables/process_events", "platforms": [ "darwin", "linux" @@ -15964,12 +16295,13 @@ "Linux" ] } - ] + ], + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_events.yml" }, { "name": "process_file_events", "description": "A File Integrity Monitor implementation using the audit service.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/process_file_events.table", + "url": "https://fleetdm.com/tables/process_file_events", "platforms": [ "linux" ], @@ -16136,12 +16468,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/process_file_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fprocess_file_events.yml&value=name%3A%20process_file_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "process_memory_map", "description": "Process memory mapped files and pseudo device/regions.", - "url": "https://github.com/osquery/osquery/blob/master/specs/process_memory_map.table", + "url": "https://fleetdm.com/tables/process_memory_map", "platforms": [ "darwin", "linux", @@ -16224,12 +16558,13 @@ "index": false } ], - "examples": "See the memory ranges with write permissions assigned to processes.\n```\nSELECT * FROM process_memory_map WHERE permissions LIKE '%w%';\n```" + "examples": "See the memory ranges with write permissions assigned to processes.\n```\nSELECT * FROM process_memory_map WHERE permissions LIKE '%w%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_memory_map.yml" }, { "name": "process_namespaces", "description": "Linux namespaces for processes running on the host system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/process_namespaces.table", + "url": "https://fleetdm.com/tables/process_namespaces", "platforms": [ "linux" ], @@ -16300,12 +16635,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/process_namespaces.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fprocess_namespaces.yml&value=name%3A%20process_namespaces%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "process_open_files", "description": "File descriptors for each process.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/process_open_files.table", + "url": "https://fleetdm.com/tables/process_open_files", "platforms": [ "darwin", "linux" @@ -16338,12 +16675,13 @@ "index": false } ], - "examples": "See what processes have which files open, for example, what processes are currently interacting with files with 1Password in their name?\n```\nSELECT f.path file_path, p.path process_path FROM process_open_files f JOIN processes p ON p.pid = f.pid WHERE f.path LIKE '%1Password%';\n```" + "examples": "See what processes have which files open, for example, what processes are currently interacting with files with 1Password in their name?\n```\nSELECT f.path file_path, p.path process_path FROM process_open_files f JOIN processes p ON p.pid = f.pid WHERE f.path LIKE '%1Password%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_open_files.yml" }, { "name": "process_open_pipes", "description": "Pipes and partner processes for each process.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/process_open_pipes.table", + "url": "https://fleetdm.com/tables/process_open_pipes", "platforms": [ "linux" ], @@ -16414,12 +16752,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/process_open_pipes.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fprocess_open_pipes.yml&value=name%3A%20process_open_pipes%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "process_open_sockets", "description": "Processes which have open network sockets on the system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/process_open_sockets.table", + "url": "https://fleetdm.com/tables/process_open_sockets", "platforms": [ "darwin", "linux", @@ -16533,12 +16873,14 @@ "Linux" ] } - ] + ], + "examples": "This table allows you to see network activity by process. With this query, list all connections made to or from a process, excluding connections to localhost and [RFC1918](https://en.wikipedia.org/wiki/Private_network) IP addresses.\n```\nSELECT pos.local_port, pos.remote_port, pos.remote_address, p.pid, p.path FROM process_open_sockets pos JOIN processes p ON pos.pid = p.pid WHERE remote_address NOT LIKE '192.168%' AND remote_address NOT LIKE '10.%' AND remote_address NOT LIKE '172.16.%' AND remote_address NOT LIKE '127.%' AND remote_address!='0.0.0.0' AND remote_address NOT LIKE 'fe80%' AND remote_port!='0'; \n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_open_sockets.yml" }, { "name": "processes", "description": "All running processes on the host system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/processes.table", + "url": "https://fleetdm.com/tables/processes", "platforms": [ "darwin", "linux", @@ -16889,12 +17231,13 @@ ] } ], - "examples": "List executables listening on network ports.\n```\nSELECT l.port, l.pid, p.name, p.path FROM listening_ports l JOIN processes p USING (pid); \n```" + "examples": "List executables listening on network ports.\n```\nSELECT l.port, l.pid, p.name, p.path FROM listening_ports l JOIN processes p USING (pid); \n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/processes.yml" }, { "name": "programs", "description": "Represents products as they are installed by Windows Installer. A product generally correlates to one installation package on Windows. Some fields may be blank as Windows installation details are left to the discretion of the product author.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/programs.table", + "url": "https://fleetdm.com/tables/programs", "platforms": [ "windows" ], @@ -16973,12 +17316,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/programs.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fprograms.yml&value=name%3A%20programs%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "prometheus_metrics", "description": "Retrieve metrics from a Prometheus server.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/prometheus_metrics.table", + "url": "https://fleetdm.com/tables/prometheus_metrics", "platforms": [ "darwin", "linux" @@ -17018,12 +17363,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/prometheus_metrics.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fprometheus_metrics.yml&value=name%3A%20prometheus_metrics%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "python_packages", "description": "Python packages installed in a system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/python_packages.table", + "url": "https://fleetdm.com/tables/python_packages", "platforms": [ "darwin", "linux", @@ -17101,12 +17448,13 @@ ] } ], - "examples": "List the versions of pip installed.\n```\nSELECT author, name, summary, version FROM python_packages WHERE name='pip';\n```" + "examples": "List the versions of pip installed.\n```\nSELECT author, name, summary, version FROM python_packages WHERE name='pip';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/python_packages.yml" }, { "name": "quicklook_cache", "description": "Files and thumbnails within macOS's Quicklook Cache.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/quicklook_cache.table", + "url": "https://fleetdm.com/tables/quicklook_cache", "platforms": [ "darwin" ], @@ -17209,12 +17557,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/quicklook_cache.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fquicklook_cache.yml&value=name%3A%20quicklook_cache%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "registry", "description": "All of the Windows registry hives.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/registry.table", + "url": "https://fleetdm.com/tables/registry", "platforms": [ "windows" ], @@ -17269,12 +17619,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/registry.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fregistry.yml&value=name%3A%20registry%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "routes", "description": "The active route table for the host system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/routes.table", + "url": "https://fleetdm.com/tables/routes", "platforms": [ "darwin", "linux", @@ -17369,12 +17721,13 @@ ] } ], - "examples": "Identify static routes\n```\nSELECT destination, interface, type FROM routes WHERE type='static';\n```" + "examples": "Identify static routes\n```\nSELECT destination, interface, type FROM routes WHERE type='static';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/routes.yml" }, { "name": "rpm_package_files", "description": "RPM packages that are currently installed on the host system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/rpm_package_files.table", + "url": "https://fleetdm.com/tables/rpm_package_files", "platforms": [ "linux" ], @@ -17437,12 +17790,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/rpm_package_files.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Frpm_package_files.yml&value=name%3A%20rpm_package_files%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "rpm_packages", "description": "RPM packages that are currently installed on the host system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/rpm_packages.table", + "url": "https://fleetdm.com/tables/rpm_packages", "platforms": [ "linux" ], @@ -17559,12 +17914,13 @@ "Linux" ] } - ] + ], + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/rpm_packages.yml" }, { "name": "running_apps", "description": "macOS applications currently running on the host system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/running_apps.table", + "url": "https://fleetdm.com/tables/running_apps", "platforms": [ "darwin" ], @@ -17596,12 +17952,13 @@ "index": false } ], - "examples": "List all running applications. Filter on is_active='1' to see the application that currently has focus.\n```\nSELECT * FROM running_apps;\n```" + "examples": "List all running applications. Filter on is_active='1' to see the application that currently has focus.\n```\nSELECT * FROM running_apps;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/running_apps.yml" }, { "name": "safari_extensions", "description": "Safari browser extension details for all users.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/safari_extensions.table", + "url": "https://fleetdm.com/tables/safari_extensions", "platforms": [ "darwin" ], @@ -17614,7 +17971,8 @@ "type": "bigint", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "name", @@ -17688,12 +18046,13 @@ "required": false, "index": false } - ] + ], + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/safari_extensions.yml" }, { "name": "sandboxes", "description": "macOS application sandboxes container details.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/sandboxes.table", + "url": "https://fleetdm.com/tables/sandboxes", "platforms": [ "darwin" ], @@ -17748,12 +18107,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/sandboxes.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fsandboxes.yml&value=name%3A%20sandboxes%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "scheduled_tasks", "description": "Lists all of the tasks in the Windows task scheduler.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/scheduled_tasks.table", + "url": "https://fleetdm.com/tables/scheduled_tasks", "platforms": [ "windows" ], @@ -17840,12 +18201,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/scheduled_tasks.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fscheduled_tasks.yml&value=name%3A%20scheduled_tasks%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "screenlock", "description": "macOS screenlock status for the current logged in user context.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/screenlock.table", + "url": "https://fleetdm.com/tables/screenlock", "platforms": [ "darwin" ], @@ -17868,12 +18231,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/screenlock.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fscreenlock.yml&value=name%3A%20screenlock%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "seccomp_events", "description": "A virtual table that tracks seccomp events.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/seccomp_events.table", + "url": "https://fleetdm.com/tables/seccomp_events", "platforms": [ "linux" ], @@ -18000,12 +18365,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/seccomp_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fseccomp_events.yml&value=name%3A%20seccomp_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "secureboot", "description": "Secure Boot UEFI Settings.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linwin/secureboot.table", + "url": "https://fleetdm.com/tables/secureboot", "platforms": [ "linux", "windows" @@ -18030,12 +18397,13 @@ "index": false } ], - "examples": "See the secure boot status (enabled or not) of Windows and Linux systems. You could create a policy looking for it to be set to 1.\n```\nSELECT secure_boot FROM secureboot;\n```" + "examples": "See the secure boot status (enabled or not) of Windows and Linux systems. You could create a policy looking for it to be set to 1.\n```\nSELECT secure_boot FROM secureboot;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/secureboot.yml" }, { "name": "selinux_events", "description": "Track SELinux events.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/selinux_events.table", + "url": "https://fleetdm.com/tables/selinux_events", "platforms": [ "linux" ], @@ -18082,12 +18450,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/selinux_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fselinux_events.yml&value=name%3A%20selinux_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "selinux_settings", "description": "Track active SELinux settings.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/selinux_settings.table", + "url": "https://fleetdm.com/tables/selinux_settings", "platforms": [ "linux" ], @@ -18118,12 +18488,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/selinux_settings.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fselinux_settings.yml&value=name%3A%20selinux_settings%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "services", "description": "Lists all installed Windows services and their relevant data.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/services.table", + "url": "https://fleetdm.com/tables/services", "platforms": [ "windows" ], @@ -18226,12 +18598,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/services.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fservices.yml&value=name%3A%20services%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "shadow", "description": "Local system users encrypted passwords and related information. Please note, that you usually need superuser rights to access `/etc/shadow`.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/shadow.table", + "url": "https://fleetdm.com/tables/shadow", "platforms": [ "linux" ], @@ -18318,12 +18692,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/shadow.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fshadow.yml&value=name%3A%20shadow%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "shared_folders", "description": "Folders available to others via SMB or AFP.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/shared_folders.table", + "url": "https://fleetdm.com/tables/shared_folders", "platforms": [ "darwin" ], @@ -18347,12 +18723,13 @@ "index": false } ], - "examples": "List all shared folders except for the standard public ones.\n```\nSELECT * FROM shared_folders WHERE path NOT LIKE '/Users/%%/Public%';\n```" + "examples": "List all shared folders except for the standard public ones.\n```\nSELECT * FROM shared_folders WHERE path NOT LIKE '/Users/%%/Public%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shared_folders.yml" }, { "name": "shared_memory", "description": "OS shared memory regions.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/shared_memory.table", + "url": "https://fleetdm.com/tables/shared_memory", "platforms": [ "linux" ], @@ -18463,12 +18840,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/shared_memory.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fshared_memory.yml&value=name%3A%20shared_memory%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "shared_resources", "description": "Displays shared resources on a computer system running Windows. This may be a disk drive, printer, interprocess communication, or other sharable device.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/shared_resources.table", + "url": "https://fleetdm.com/tables/shared_resources", "platforms": [ "windows" ], @@ -18547,12 +18926,15 @@ "required": false, "index": false } - ] + ], + "examples": "Network shares with loose access controls are common places that leak sensitive information. This query looks for shared drives on Windows systems that likely contain sensitive data, by listing all shared folders that have the word `backup` in their name. This does not include `ADMIN$` type shares.\n```\nSELECT description,name,path FROM shared_resources WHERE type = 0 and name like '%backup%';\n```", + "notes": "* `type_name` is a human readable value of the type column. These values can include: \"Disk Drive Admin\", \"IPC Admin\", \"Disk Drive\"", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shared_resources.yml" }, { "name": "sharing_preferences", "description": "macOS Sharing preferences.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/sharing_preferences.table", + "url": "https://fleetdm.com/tables/sharing_preferences", "platforms": [ "darwin" ], @@ -18640,12 +19022,13 @@ "index": false } ], - "examples": "Identify systems where any type of sharing is enabled. This table can be very useful for building policies for specific types of sharing.\n```\nSELECT * FROM sharing_preferences WHERE screen_sharing='1' OR file_sharing='1' OR printer_sharing='1' OR remote_login='1' OR remote_management='1' OR remote_apple_events='1' OR internet_sharing='1' OR bluetooth_sharing='1' OR disc_sharing='1' OR content_caching='1';\n```" + "examples": "Identify systems where any type of sharing is enabled. This table can be very useful for building policies for specific types of sharing.\n```\nSELECT * FROM sharing_preferences WHERE screen_sharing='1' OR file_sharing='1' OR printer_sharing='1' OR remote_login='1' OR remote_management='1' OR remote_apple_events='1' OR internet_sharing='1' OR bluetooth_sharing='1' OR disc_sharing='1' OR content_caching='1';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sharing_preferences.yml" }, { "name": "shell_history", "description": "A line-delimited (command) table of per-user .*_history data.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/shell_history.table", + "url": "https://fleetdm.com/tables/shell_history", "platforms": [ "darwin", "linux" @@ -18659,7 +19042,8 @@ "type": "bigint", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "time", @@ -18686,12 +19070,13 @@ "index": false } ], - "examples": "See command line executions and related timestamps. Useful for threat hunting when a device is suspected of being compromised.\n```\nSELECT u.username, s.command, s.time FROM users u CROSS JOIN shell_history s USING (uid);\n```" + "examples": "See command line executions and related timestamps. Useful for threat hunting when a device is suspected of being compromised.\n```\nSELECT u.username, s.command, s.time FROM users u CROSS JOIN shell_history s USING (uid);\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shell_history.yml" }, { "name": "shellbags", "description": "Shows directories accessed via Windows Explorer.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/shellbags.table", + "url": "https://fleetdm.com/tables/shellbags", "platforms": [ "windows" ], @@ -18762,12 +19147,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/shellbags.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fshellbags.yml&value=name%3A%20shellbags%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "shimcache", "description": "Application Compatibility Cache, contains artifacts of execution.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/shimcache.table", + "url": "https://fleetdm.com/tables/shimcache", "platforms": [ "windows" ], @@ -18806,12 +19193,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/shimcache.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fshimcache.yml&value=name%3A%20shimcache%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "signature", "description": "File (executable, bundle, installer, disk) code signing status.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/signature.table", + "url": "https://fleetdm.com/tables/signature", "platforms": [ "darwin" ], @@ -18883,12 +19272,13 @@ "index": false } ], - "examples": "Identify system extensions that are not managed via MDM and see their signature status.\n```\nSELECT se.identifier, se.bundle_path, se.category, se.state, s.signed FROM system_extensions se JOIN signature s on s.path = se.bundle_path WHERE se.mdm_managed='0';\n```" + "examples": "Identify system extensions that are not managed via MDM and see their signature status.\n```\nSELECT se.identifier, se.bundle_path, se.category, se.state, s.signed FROM system_extensions se JOIN signature s on s.path = se.bundle_path WHERE se.mdm_managed='0';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/signature.yml" }, { "name": "sip_config", "description": "Apple's System Integrity Protection (rootless) status.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/sip_config.table", + "url": "https://fleetdm.com/tables/sip_config", "platforms": [ "darwin" ], @@ -18920,12 +19310,13 @@ "index": false } ], - "examples": "View the status of System Integrity Protection.\n```\nSELECT config_flag, enabled FROM sip_config WHERE config_flag='sip';\n```" + "examples": "View the status of System Integrity Protection.\n```\nSELECT config_flag, enabled FROM sip_config WHERE config_flag='sip';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sip_config.yml" }, { "name": "smbios_tables", "description": "BIOS (DMI) structure common details and content.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/smbios_tables.table", + "url": "https://fleetdm.com/tables/smbios_tables", "platforms": [ "darwin", "linux" @@ -18989,12 +19380,15 @@ "required": false, "index": false } - ] + ], + "examples": "SMBIOS tables are used to deliver information from the BIOS to the operating system. Use the *md5* field to compare systems and see if their hardware is configured identically.\n```\nSELECT * FROM smbios_tables WHERE md5='dd66d84ec724d35db011883052973eae'\n```", + "notes": "This table requires an Intel compatible system.", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/smbios_tables.yml" }, { "name": "smc_keys", "description": "Apple's system management controller keys.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/smc_keys.table", + "url": "https://fleetdm.com/tables/smc_keys", "platforms": [ "darwin" ], @@ -19042,12 +19436,13 @@ "index": false } ], - "examples": "See if the temperature sensor on an Intel Mac is returning values. SMC values aren't officially documented and as such this table is useful if you are troubleshooting and digging into a specific hardware related issue.\n```\nSELECT * FROM smc_keys WHERE key='TC0P';\n```" + "examples": "See if the temperature sensor on an Intel Mac is returning values. SMC values aren't officially documented and as such this table is useful if you are troubleshooting and digging into a specific hardware related issue.\n```\nSELECT * FROM smc_keys WHERE key='TC0P';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/smc_keys.yml" }, { "name": "socket_events", "description": "Track network socket opens and closes.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/socket_events.table", + "url": "https://fleetdm.com/tables/socket_events", "platforms": [ "darwin", "linux" @@ -19191,12 +19586,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/socket_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fsocket_events.yml&value=name%3A%20socket_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "ssh_configs", "description": "A table of parsed ssh_configs.", - "url": "https://github.com/osquery/osquery/blob/master/specs/ssh_configs.table", + "url": "https://fleetdm.com/tables/ssh_configs", "platforms": [ "darwin", "linux", @@ -19212,7 +19609,8 @@ "type": "bigint", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "block", @@ -19239,12 +19637,13 @@ "index": false } ], - "examples": "Identify SSH clients configured to send their locales to the server.\n```\nSELECT * FROM ssh_configs WHERE option='sendenv lang lc_*'; \n```" + "examples": "Identify SSH clients configured to send their locales to the server.\n```\nSELECT * FROM ssh_configs WHERE option='sendenv lang lc_*'; \n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ssh_configs.yml" }, { "name": "startup_items", "description": "Applications and binaries set as user/login startup items.", - "url": "https://github.com/osquery/osquery/blob/master/specs/startup_items.table", + "url": "https://fleetdm.com/tables/startup_items", "platforms": [ "darwin", "linux", @@ -19311,12 +19710,13 @@ "index": false } ], - "examples": "List commands executed as user/logon startup items.\n```\nSELECT name, type FROM startup_items WHERE status='enabled';\n```" + "examples": "List commands executed as user/logon startup items.\n```\nSELECT name, type FROM startup_items WHERE status='enabled';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/startup_items.yml" }, { "name": "sudoers", "description": "Rules for running commands as other users via sudo.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/sudoers.table", + "url": "https://fleetdm.com/tables/sudoers", "platforms": [ "darwin", "linux" @@ -19349,12 +19749,13 @@ "index": false } ], - "examples": "Identify systems where sudo is configured in a way to allow users to retain their existing environment variables, which is a security risk.\n```\nSELECT header, source, rule_details FROM sudoers WHERE rule_details='!env_reset';\n```" + "examples": "Identify systems where sudo is configured in a way to allow users to retain their existing environment variables, which is a security risk.\n```\nSELECT header, source, rule_details FROM sudoers WHERE rule_details='!env_reset';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sudoers.yml" }, { "name": "suid_bin", "description": "suid binaries in common locations.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/suid_bin.table", + "url": "https://fleetdm.com/tables/suid_bin", "platforms": [ "darwin", "linux" @@ -19406,12 +19807,13 @@ ] } ], - "examples": "Identify unsigned executables with suid privileges.\n```\nSELECT s.path, s.username, s.permissions, sig.signed, sig.team_identifier, sig.authority FROM suid_bin s JOIN signature sig on s.path = sig.path WHERE sig.signed='0';\n```" + "examples": "Identify unsigned executables with suid privileges.\n```\nSELECT s.path, s.username, s.permissions, sig.signed, sig.team_identifier, sig.authority FROM suid_bin s JOIN signature sig on s.path = sig.path WHERE sig.signed='0';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/suid_bin.yml" }, { "name": "syslog_events", "description": "", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/syslog_events.table", + "url": "https://fleetdm.com/tables/syslog_events", "platforms": [ "linux" ], @@ -19482,12 +19884,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/syslog_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fsyslog_events.yml&value=name%3A%20syslog_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "system_controls", "description": "sysctl names, values, and settings information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/system_controls.table", + "url": "https://fleetdm.com/tables/system_controls", "platforms": [ "darwin", "linux" @@ -19555,12 +19959,13 @@ ] } ], - "examples": "See if IP forwarding is enabled (value=1) or not (current_value=0). This table provides access to a large quantity of low-level settings and is ideal to build policies.\n```\nSELECT current_value, name FROM system_controls WHERE name='net.inet.ip.forwarding';\n```" + "examples": "See if IP forwarding is enabled (value=1) or not (current_value=0). This table provides access to a large quantity of low-level settings and is ideal to build policies.\n```\nSELECT current_value, name FROM system_controls WHERE name='net.inet.ip.forwarding';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_controls.yml" }, { "name": "system_extensions", "description": "macOS (>= 10.15) system extension table.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/system_extensions.table", + "url": "https://fleetdm.com/tables/system_extensions", "platforms": [ "darwin" ], @@ -19640,12 +20045,13 @@ "index": false } ], - "examples": "Identify system extensions that are not managed via MDM and see their signature status.\n```\nSELECT se.identifier, se.bundle_path, se.category, se.state, s.signed FROM system_extensions se JOIN signature s on s.path = se.bundle_path WHERE se.mdm_managed='0';\n```" + "examples": "Identify system extensions that are not managed via MDM and see their signature status.\n```\nSELECT se.identifier, se.bundle_path, se.category, se.state, s.signed FROM system_extensions se JOIN signature s on s.path = se.bundle_path WHERE se.mdm_managed='0';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_extensions.yml" }, { "name": "system_info", "description": "System information for identification.", - "url": "https://github.com/osquery/osquery/blob/master/specs/system_info.table", + "url": "https://fleetdm.com/tables/system_info", "platforms": [ "darwin", "linux", @@ -19808,12 +20214,13 @@ "index": false } ], - "examples": "See the CPU architecture of a machine as well as who made it and what its serial number is.\n```\nSELECT CPU_type, hardware_vendor, hardware_model, hardware_serial FROM system_info;\n```" + "examples": "See the CPU architecture of a machine as well as who made it and what its serial number is.\n```\nSELECT CPU_type, hardware_vendor, hardware_model, hardware_serial FROM system_info;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_info.yml" }, { "name": "systemd_units", "description": "Track systemd units.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/systemd_units.table", + "url": "https://fleetdm.com/tables/systemd_units", "platforms": [ "linux" ], @@ -19924,12 +20331,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/systemd_units.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fsystemd_units.yml&value=name%3A%20systemd_units%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "temperature_sensors", "description": "Machine's temperature sensors.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/temperature_sensors.table", + "url": "https://fleetdm.com/tables/temperature_sensors", "platforms": [ "darwin" ], @@ -19969,12 +20378,13 @@ "index": false } ], - "examples": "Identify systems with CPU temperature sensors above or equal to 90c.\n```\nSELECT name, celsius FROM temperature_sensors WHERE name LIKE 'CPU%' AND celsius>='90';\n```" + "examples": "Identify systems with CPU temperature sensors above or equal to 90c.\n```\nSELECT name, celsius FROM temperature_sensors WHERE name LIKE 'CPU%' AND celsius>='90';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/temperature_sensors.yml" }, { "name": "time", "description": "Track current date and time in UTC.", - "url": "https://github.com/osquery/osquery/blob/master/specs/utility/time.table", + "url": "https://fleetdm.com/tables/time", "platforms": [ "darwin", "linux", @@ -20100,12 +20510,13 @@ ] } ], - "examples": "View the timezone a system is configured in. \n```\nSELECT local_timezone FROM time;\n```" + "examples": "View the timezone a system is configured in. \n```\nSELECT local_timezone FROM time;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time.yml" }, { "name": "time_machine_backups", "description": "Backups to drives using TimeMachine.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/time_machine_backups.table", + "url": "https://fleetdm.com/tables/time_machine_backups", "platforms": [ "darwin" ], @@ -20129,12 +20540,13 @@ "index": false } ], - "examples": "See the time of the latest backup. In environments where you want to encourage backups, this can be useful to remind users to perform them, and in environments where you do not allow backups, to detect that they are happening.\n```\nSELECT strftime('%Y-%m-%d %H:%M:%S',backup_date,'unixepoch') AS last_backup FROM time_machine_backups;\n```" + "examples": "See the time of the latest backup. In environments where you want to encourage backups, this can be useful to remind users to perform them, and in environments where you do not allow backups, to detect that they are happening.\n```\nSELECT strftime('%Y-%m-%d %H:%M:%S',backup_date,'unixepoch') AS last_backup FROM time_machine_backups;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time_machine_backups.yml" }, { "name": "time_machine_destinations", "description": "Locations backed up to using Time Machine.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/time_machine_destinations.table", + "url": "https://fleetdm.com/tables/time_machine_destinations", "platforms": [ "darwin" ], @@ -20198,12 +20610,13 @@ "index": false } ], - "examples": "If Time Machine is configured, see what destination it is configured to go to. \n```\nSELECT alias FROM time_machine_destinations;\n```" + "examples": "If Time Machine is configured, see what destination it is configured to go to. \n```\nSELECT alias FROM time_machine_destinations;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time_machine_destinations.yml" }, { "name": "tpm_info", "description": "A table that lists the TPM related information.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/tpm_info.table", + "url": "https://fleetdm.com/tables/tpm_info", "platforms": [ "windows" ], @@ -20282,12 +20695,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/tpm_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Ftpm_info.yml&value=name%3A%20tpm_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "ulimit_info", "description": "System resource usage limits.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/ulimit_info.table", + "url": "https://fleetdm.com/tables/ulimit_info", "platforms": [ "darwin", "linux" @@ -20320,12 +20735,13 @@ "index": false } ], - "examples": "Check the stack size limit\n```\nSELECT * FROM ulimit_info WHERE type='stack';\n```" + "examples": "Check the stack size limit\n```\nSELECT * FROM ulimit_info WHERE type='stack';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ulimit_info.yml" }, { "name": "uptime", "description": "Track time passed since last boot. Some systems track this as calendar time, some as runtime.", - "url": "https://github.com/osquery/osquery/blob/master/specs/uptime.table", + "url": "https://fleetdm.com/tables/uptime", "platforms": [ "darwin", "linux", @@ -20376,12 +20792,13 @@ "index": false } ], - "examples": "See how long hosts that have been up for more than a month have been up. This could indicate systems that are not ephemeral as expected, or not being patched as frequently as they should be.\n```\nSELECT days FROM uptime WHERE days>='31'\n```" + "examples": "See how long hosts that have been up for more than a month have been up. This could indicate systems that are not ephemeral as expected, or not being patched as frequently as they should be.\n```\nSELECT days FROM uptime WHERE days>='31'\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/uptime.yml" }, { "name": "usb_devices", "description": "USB devices that are actively plugged into the host system.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/usb_devices.table", + "url": "https://fleetdm.com/tables/usb_devices", "platforms": [ "darwin", "linux" @@ -20486,12 +20903,13 @@ "index": false } ], - "examples": "Identify Yubikeys currently connected. The model field contains information about what authentication protocols the keys are configured to support. This table can be used to track any type of USB device.\n```\nSELECT model, vendor, version FROM usb_devices WHERE vendor='Yubico';\n```" + "examples": "Identify Yubikeys currently connected. The model field contains information about what authentication protocols the keys are configured to support. This table can be used to track any type of USB device.\n```\nSELECT model, vendor, version FROM usb_devices WHERE vendor='Yubico';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/usb_devices.yml" }, { "name": "user_events", "description": "Track user events from the audit framework.", - "url": "https://github.com/osquery/osquery/blob/master/specs/posix/user_events.table", + "url": "https://fleetdm.com/tables/user_events", "platforms": [ "darwin", "linux" @@ -20587,12 +21005,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/posix/user_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fuser_events.yml&value=name%3A%20user_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "user_groups", "description": "Local system user group relationships.", - "url": "https://github.com/osquery/osquery/blob/master/specs/user_groups.table", + "url": "https://fleetdm.com/tables/user_groups", "platforms": [ "darwin", "linux", @@ -20618,12 +21038,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/user_groups.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fuser_groups.yml&value=name%3A%20user_groups%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "user_interaction_events", "description": "Track user interaction events from macOS' event tapping framework.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/user_interaction_events.table", + "url": "https://fleetdm.com/tables/user_interaction_events", "platforms": [ "darwin" ], @@ -20638,12 +21060,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/darwin/user_interaction_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fuser_interaction_events.yml&value=name%3A%20user_interaction_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "user_ssh_keys", "description": "Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.", - "url": "https://github.com/osquery/osquery/blob/master/specs/user_ssh_keys.table", + "url": "https://fleetdm.com/tables/user_ssh_keys", "platforms": [ "darwin", "linux", @@ -20659,7 +21083,8 @@ "type": "bigint", "hidden": false, "required": false, - "index": false + "index": false, + "requires_user_context": true }, { "name": "path", @@ -20697,12 +21122,13 @@ ] } ], - "examples": "Identify SSH keys stored in clear text in user directories\n```\nSELECT * FROM users JOIN user_ssh_keys USING (uid) WHERE encrypted = 0;,\n```" + "examples": "Identify SSH keys stored in clear text in user directories\n```\nSELECT * FROM users JOIN user_ssh_keys USING (uid) WHERE encrypted = 0;,\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/user_ssh_keys.yml" }, { "name": "userassist", "description": "UserAssist Registry Key tracks when a user executes an application from Windows Explorer.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/userassist.table", + "url": "https://fleetdm.com/tables/userassist", "platforms": [ "windows" ], @@ -20741,12 +21167,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/userassist.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fuserassist.yml&value=name%3A%20userassist%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "users", "description": "Local user accounts (including domain accounts that have logged on locally (Windows)).", - "url": "https://github.com/osquery/osquery/blob/master/specs/users.table", + "url": "https://fleetdm.com/tables/users", "platforms": [ "darwin", "linux", @@ -20862,12 +21290,13 @@ ] } ], - "examples": "List users that have interactive access via a shell that isn't false.\n```\nSELECT * FROM users WHERE shell!='/usr/bin/false';\n```" + "examples": "List users that have interactive access via a shell that isn't false.\n```\nSELECT * FROM users WHERE shell!='/usr/bin/false';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/users.yml" }, { "name": "video_info", "description": "Retrieve video card information of the machine.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/video_info.table", + "url": "https://fleetdm.com/tables/video_info", "platforms": [ "windows" ], @@ -20938,12 +21367,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/video_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fvideo_info.yml&value=name%3A%20video_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "virtual_memory_info", "description": "Darwin Virtual Memory statistics.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/virtual_memory_info.table", + "url": "https://fleetdm.com/tables/virtual_memory_info", "platforms": [ "darwin" ], @@ -21127,12 +21558,13 @@ "index": false } ], - "examples": "Identify systems where memory swapping is occuring. These systems might benefit from more RAM.\n```\nSELECT * FROM virtual_memory_info WHERE swap_ins>'0';\n```" + "examples": "Identify systems where memory swapping is occuring. These systems might benefit from more RAM.\n```\nSELECT * FROM virtual_memory_info WHERE swap_ins>'0';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/virtual_memory_info.yml" }, { "name": "wifi_networks", "description": "macOS known/remembered Wi-Fi networks list.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/wifi_networks.table", + "url": "https://fleetdm.com/tables/wifi_networks", "platforms": [ "darwin" ], @@ -21284,12 +21716,13 @@ "index": false } ], - "examples": "Find WiFi networks configured on Macs that are unencrypted and require a captive portal. This can be useful to understand how much people use laptops in hotels, airports and other environments, and is a good indicator that tools such as DNS-over-HTTPS would improve privacy of connectivity.\n```\nSELECT network_name FROM wifi_networks WHERE security_type='Open' AND captive_portal='1';\n```" + "examples": "Find WiFi networks configured on Macs that are unencrypted and require a captive portal. This can be useful to understand how much people use laptops in hotels, airports and other environments, and is a good indicator that tools such as DNS-over-HTTPS would improve privacy of connectivity.\n```\nSELECT network_name FROM wifi_networks WHERE security_type='Open' AND captive_portal='1';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_networks.yml" }, { "name": "wifi_status", "description": "macOS current WiFi status.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/wifi_status.table", + "url": "https://fleetdm.com/tables/wifi_status", "platforms": [ "darwin" ], @@ -21401,12 +21834,13 @@ "index": false } ], - "examples": "See the current speed of the WiFi connection, in megabits per second.\n```\nSELECT transmit_rate FROM wifi_status;\n```" + "examples": "See the current speed of the WiFi connection, in megabits per second.\n```\nSELECT transmit_rate FROM wifi_status;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_status.yml" }, { "name": "wifi_survey", "description": "Scan for nearby WiFi networks.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/wifi_scan.table", + "url": "https://fleetdm.com/tables/wifi_survey", "platforms": [ "darwin" ], @@ -21494,12 +21928,13 @@ "index": false } ], - "examples": "Count the amount of wireless networks visible to the computer.\n```\nSELECT COUNT ( DISTINCT network_name ) AS \"Number of wireless networks visible\" FROM wifi_survey;\n```" + "examples": "Count the amount of wireless networks visible to the computer.\n```\nSELECT COUNT ( DISTINCT network_name ) AS \"Number of wireless networks visible\" FROM wifi_survey;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_survey.yml" }, { "name": "winbaseobj", "description": "Lists named Windows objects in the default object directories, across all terminal services sessions. Example Windows ojbect types include Mutexes, Events, Jobs and Semaphors.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/winbaseobj.table", + "url": "https://fleetdm.com/tables/winbaseobj", "platforms": [ "windows" ], @@ -21530,12 +21965,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/winbaseobj.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwinbaseobj.yml&value=name%3A%20winbaseobj%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "windows_crashes", "description": "Extracted information from Windows crash logs (Minidumps).", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_crashes.table", + "url": "https://fleetdm.com/tables/windows_crashes", "platforms": [ "windows" ], @@ -21710,12 +22147,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_crashes.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwindows_crashes.yml&value=name%3A%20windows_crashes%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "windows_eventlog", "description": "Table for querying all recorded Windows event logs.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_eventlog.table", + "url": "https://fleetdm.com/tables/windows_eventlog", "platforms": [ "windows" ], @@ -21842,12 +22281,15 @@ "required": true, "index": false } - ] + ], + "examples": "Tracking user account changes is a key part of both detection & incident response. This query lists all Windows Eventlogs from the Security channel with an EventID of 4720 - A user account was created. There are many other relevant EventIDs that should be monitored as well: \n- [4722: Account enabled](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4722)\n- [4724: Password reset](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4724)\n- [4728: Added to a security-enabled global group](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventid=4728)\n\n```\nSELECT datetime,computer_name,data FROM windows_eventlog WHERE eventid=4720 AND channel='Security'\"\n```", + "notes": "* This is not an evented table - instead, it pulls directly from the local system's existing eventlogs. \n* The information returned in the `data` column will be JSON formatted, which will require additional parsing. ", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_eventlog.yml" }, { "name": "windows_events", "description": "Windows Event logs.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_events.table", + "url": "https://fleetdm.com/tables/windows_events", "platforms": [ "windows" ], @@ -21950,12 +22392,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwindows_events.yml&value=name%3A%20windows_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "windows_firewall_rules", "description": "Provides the list of Windows firewall rules.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_firewall_rules.table", + "url": "https://fleetdm.com/tables/windows_firewall_rules", "platforms": [ "windows" ], @@ -22090,12 +22534,15 @@ "required": false, "index": false } - ] + ], + "examples": "Controlling inbound access to remote services is essential for maintaining security on a system. This query lists all enabled Windows Firewall rules that allow inbound RDP, WinRM & VNC connections on the public firewall profile.\n```\n\n SELECT name,app_name,local_ports FROM windows_firewall_rules WHERE enabled = 1 AND direction = \"In\" AND remote_addresses=\"*\" AND profile_public = 1 AND action = \"Allow\" AND local_ports IN (\"3389\",\"5985\",\"5986\",\"5900\");\n\n```", + "notes": "* A rule can exist, but it has to be part of the currently enabled firewall profile to be enforced.", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_firewall_rules.yml" }, { "name": "windows_optional_features", "description": "Lists names and installation states of windows features. Maps to Win32_OptionalFeature WMI class.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_optional_features.table", + "url": "https://fleetdm.com/tables/windows_optional_features", "platforms": [ "windows" ], @@ -22134,12 +22581,14 @@ "required": false, "index": false } - ] + ], + "examples": "SMBv1 is deprecated and has known, unpatched vulnerablities; it should be disabled whenever possible. This query lists enabled SMBv1 services (client and/or server).\n```\n \n SELECT name,caption,statename FROM windows_optional_features WHERE name LIKE 'SMB1Protocol%' AND state = 1;\n\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_optional_features.yml" }, { "name": "windows_security_center", "description": "The health status of Window Security features. Health values can be \"Good\", \"Poor\". \"Snoozed\", \"Not Monitored\", and \"Error\".", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_security_center.table", + "url": "https://fleetdm.com/tables/windows_security_center", "platforms": [ "windows" ], @@ -22202,12 +22651,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_security_center.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwindows_security_center.yml&value=name%3A%20windows_security_center%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "windows_security_products", "description": "Enumeration of registered Windows security products.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_security_products.table", + "url": "https://fleetdm.com/tables/windows_security_products", "platforms": [ "windows" ], @@ -22262,12 +22713,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_security_products.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwindows_security_products.yml&value=name%3A%20windows_security_products%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "windows_update_history", "description": "Provides the history of the windows update events.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_update_history.table", + "url": "https://fleetdm.com/tables/windows_update_history", "platforms": [ "windows" ], @@ -22370,12 +22823,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/windows_update_history.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwindows_update_history.yml&value=name%3A%20windows_update_history%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "wmi_bios_info", "description": "Lists important information from the system bios.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/wmi_bios_info.table", + "url": "https://fleetdm.com/tables/wmi_bios_info", "platforms": [ "windows" ], @@ -22398,12 +22853,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/wmi_bios_info.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwmi_bios_info.yml&value=name%3A%20wmi_bios_info%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "wmi_cli_event_consumers", "description": "WMI CommandLineEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/wmi_cli_event_consumers.table", + "url": "https://fleetdm.com/tables/wmi_cli_event_consumers", "platforms": [ "windows" ], @@ -22450,12 +22907,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/wmi_cli_event_consumers.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwmi_cli_event_consumers.yml&value=name%3A%20wmi_cli_event_consumers%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "wmi_event_filters", "description": "Lists WMI event filters.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/wmi_event_filters.table", + "url": "https://fleetdm.com/tables/wmi_event_filters", "platforms": [ "windows" ], @@ -22502,12 +22961,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/wmi_event_filters.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwmi_event_filters.yml&value=name%3A%20wmi_event_filters%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "wmi_filter_consumer_binding", "description": "Lists the relationship between event consumers and filters.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/wmi_filter_consumer_binding.table", + "url": "https://fleetdm.com/tables/wmi_filter_consumer_binding", "platforms": [ "windows" ], @@ -22546,12 +23007,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/wmi_filter_consumer_binding.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwmi_filter_consumer_binding.yml&value=name%3A%20wmi_filter_consumer_binding%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "wmi_script_event_consumers", "description": "WMI ActiveScriptEventConsumer, which can be used for persistence on Windows. See https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf for more details.", - "url": "https://github.com/osquery/osquery/blob/master/specs/windows/wmi_script_event_consumers.table", + "url": "https://fleetdm.com/tables/wmi_script_event_consumers", "platforms": [ "windows" ], @@ -22606,12 +23069,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/windows/wmi_script_event_consumers.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fwmi_script_event_consumers.yml&value=name%3A%20wmi_script_event_consumers%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "xprotect_entries", "description": "Database of the machine's XProtect signatures.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/xprotect_entries.table", + "url": "https://fleetdm.com/tables/xprotect_entries", "platforms": [ "darwin" ], @@ -22675,12 +23140,13 @@ "index": false } ], - "examples": "Identify the Bundlore variants Xprotect protects the computer from\n```\nSELECT * FROM xprotect_entries WHERE name LIKE 'OSX.Bundlore%';\n```" + "examples": "Identify the Bundlore variants Xprotect protects the computer from\n```\nSELECT * FROM xprotect_entries WHERE name LIKE 'OSX.Bundlore%';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_entries.yml" }, { "name": "xprotect_meta", "description": "Database of the machine's XProtect browser-related signatures.", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/xprotect_meta.table", + "url": "https://fleetdm.com/tables/xprotect_meta", "platforms": [ "darwin" ], @@ -22720,12 +23186,13 @@ "index": false } ], - "examples": "See the minimum version of specific components allowed by Xprotect. This usually means the previous versions have vulnerabilities that are being exploited at scale, or were exploited at scale at some point in time.\n```\nSELECT * FROM xprotect_meta WHERE min_version!='any';\n```" + "examples": "See the minimum version of specific components allowed by Xprotect. This usually means the previous versions have vulnerabilities that are being exploited at scale, or were exploited at scale at some point in time.\n```\nSELECT * FROM xprotect_meta WHERE min_version!='any';\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_meta.yml" }, { "name": "xprotect_reports", "description": "Database of XProtect matches (if user generated/sent an XProtect report).", - "url": "https://github.com/osquery/osquery/blob/master/specs/darwin/xprotect_reports.table", + "url": "https://fleetdm.com/tables/xprotect_reports", "platforms": [ "darwin" ], @@ -22757,12 +23224,13 @@ "index": false } ], - "examples": "See all Xprotect activity reports, if any are present. This indicates potentially malicious software was blocked by Xprotect.\n```\nSELECT * FROM xprotect_reports;\n```" + "examples": "See all Xprotect activity reports, if any are present. This indicates potentially malicious software was blocked by Xprotect.\n```\nSELECT * FROM xprotect_reports;\n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_reports.yml" }, { "name": "yara", "description": "Track YARA matches for files or PIDs.", - "url": "https://github.com/osquery/osquery/blob/master/specs/yara/yara.table", + "url": "https://fleetdm.com/tables/yara", "platforms": [ "darwin", "linux", @@ -22843,12 +23311,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/yara/yara.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fyara.yml&value=name%3A%20yara%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "yara_events", "description": "Track YARA matches for files specified in configuration data.", - "url": "https://github.com/osquery/osquery/blob/master/specs/yara/yara_events.table", + "url": "https://fleetdm.com/tables/yara_events", "platforms": [ "darwin", "linux", @@ -22937,12 +23407,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/yara/yara_events.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fyara_events.yml&value=name%3A%20yara_events%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "ycloud_instance_metadata", "description": "Yandex.Cloud instance metadata.", - "url": "https://github.com/osquery/osquery/blob/master/specs/ycloud_instance_metadata.table", + "url": "https://fleetdm.com/tables/ycloud_instance_metadata", "platforms": [ "darwin", "linux", @@ -23024,12 +23496,14 @@ "required": false, "index": false } - ] + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/ycloud_instance_metadata.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema/tables/?filename=%2Ftables%2Fycloud_instance_metadata.yml&value=name%3A%20ycloud_instance_metadata%0Adescription%3A%20%3E-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%3E-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%3E-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." }, { "name": "yum_sources", "description": "Current list of Yum repositories or software channels.", - "url": "https://github.com/osquery/osquery/blob/master/specs/linux/yum_sources.table", + "url": "https://fleetdm.com/tables/yum_sources", "platforms": [ "linux" ], @@ -23096,6 +23570,703 @@ ] } ], - "examples": "Find yum repositories on Linux servers for which cryptographic verification via GPG is disabled. This could allow untrusted packages to be injected into a repository that could then be installed.\n```\nSELECT * FROM yum_sources WHERE gpgcheck='0'; \n```" + "examples": "Find yum repositories on Linux servers for which cryptographic verification via GPG is disabled. This could allow untrusted packages to be injected into a repository that could then be installed.\n```\nSELECT * FROM yum_sources WHERE gpgcheck='0'; \n```", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yum_sources.yml" + }, + { + "name": "file_lines", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Allows reading an arbitrary file.", + "platforms": "darwin, windows, linux", + "evented": false, + "examples": "Output the content of `/etc/hosts` line by line. \n```\nSELECT * FROM file_lines WHERE path='/etc/hosts';\n```", + "columns": [ + { + "name": "path", + "description": "Path of the file to read.", + "required": true, + "type": "text" + }, + { + "name": "line", + "description": "Output of the file, line by line.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/file_lines", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/file_lines.yml" + }, + { + "name": "filevault_users", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Information on the users able to unlock the current boot volume if protected with FileVault.", + "platforms": "darwin", + "evented": false, + "examples": "List the usernames able to unlock and boot a computer protected by FileVault, joined to [users.username](http://fleetdm.com/tables/users) to obtain the description of the operating system account that owns it.\n```\nSELECT fu.username, u.description FROM filevault_users fu JOIN users u ON fu.uuid=u.uuid;\n```", + "columns": [ + { + "name": "username", + "description": "Username of the FileVault user.", + "required": false, + "type": "text" + }, + { + "name": "uuid", + "description": "UUID of the FileVault user, which can be joined to [users.uuid](http://fleetdm.com/tables/users).", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/filevault_users", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/filevault_users.yml" + }, + { + "name": "google_chrome_profiles", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Profiles configured in Google Chrome.", + "platforms": "darwin, windows, linux", + "evented": false, + "examples": "List the Google Chrome accounts logged in to with `fleetdm.com` email addresses, joined to the [users](https://fleetdm.com/tables/users) table, to see the description of the operating system account that owns it.\n```\nSELECT gp.email, gp.username, u.description FROM google_chrome_profiles gp JOIN users u ON gp.username=u.username WHERE gp.email LIKE '%fleetdm.com';\n```", + "columns": [ + { + "name": "email", + "description": "Email address linked to the Google account this profile uses, if any.", + "required": false, + "type": "text" + }, + { + "name": "ephemeral", + "description": "Boolean indicating if the profile is ephemeral or not.", + "required": false, + "type": "boolean" + }, + { + "name": "name", + "description": "Name of the Chrome profile.", + "required": false, + "type": "text" + }, + { + "name": "username", + "description": "Operating system level username of the account where this profile is located.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/google_chrome_profiles", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/google_chrome_profiles.yml" + }, + { + "name": "macos_profiles", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "High level information on installed profiles enrollment.", + "platforms": "darwin", + "evented": false, + "examples": "Identify all profiles that are not *verified*.\n```\nSELECT display_name, install_date FROM macos_profiles WHERE verification_state!='verified'; \n```", + "columns": [ + { + "name": "description", + "description": "The description of the profile.", + "required": false, + "type": "text" + }, + { + "name": "display_name", + "description": "The display name of the profile.", + "required": false, + "type": "text" + }, + { + "name": "identifier", + "description": "The identifier of the profile.", + "required": false, + "type": "text" + }, + { + "name": "install_date", + "description": "Date and time at which the profile was installed.", + "required": false, + "type": "text" + }, + { + "name": "organization", + "description": "The profile's organization value.", + "required": false, + "type": "text" + }, + { + "name": "type", + "description": "The type of profile.", + "required": false, + "type": "text" + }, + { + "name": "uuid", + "description": "The [UUID](https://en.wikipedia.org/wiki/Universally_unique_identifier) of the profile.", + "required": false, + "type": "text" + }, + { + "name": "verification_state", + "description": "The verification state of the profile.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/macos_profiles", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/macos_profiles.yml" + }, + { + "name": "mdm", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [Kolide](https://github.com/kolide/launcher).

Due to changes in macOS 12.3, the output of `profiles show -type enrollment` can only be generated once a day. If you are running this command with another tool, you should set the `PROFILES_SHOW_ENROLLMENT_CACHE_PATH` environment variable to the path you are caching this. The cache file should be `json` with the keys `dep_capable` and `rate_limited present`, both booleans representing whether the device is capable of DEP enrollment and whether the response from `profiles show -type enrollment` is being rate limited or not.", + "description": "Information on the device's MDM enrollment.", + "platforms": "darwin", + "evented": false, + "examples": "Identify Macs that are DEP capable but have not been enrolled to MDM.\n```\nSELECT * FROM mdm WHERE dep_capable='true' AND enrolled='false';\n```", + "columns": [ + { + "name": "access_rights", + "description": "The access rights of the payload. The resulting number is the total of every [AccessRight](https://developer.apple.com/documentation/devicemanagement/mdm) added up.", + "required": false, + "type": "integer" + }, + { + "name": "checkin_url", + "description": "The URL the Mac checks in with, which should point to your MDM server.", + "required": false, + "type": "text" + }, + { + "name": "dep_capable", + "description": "Indicates if the computer is DEP capable or not, even if it is not currently enrolled into MDM.", + "required": false, + "type": "text" + }, + { + "name": "enrolled", + "description": "Indicates if the computer is enrolled into MDM.", + "required": false, + "type": "text" + }, + { + "name": "has_scep_payload", + "description": "Indicates if the computer has a certificate used by the MDM server to authenticate it.", + "required": false, + "type": "text" + }, + { + "name": "identity_certificate_uuid", + "description": "The [UUID](https://en.wikipedia.org/wiki/Universally_unique_identifier) of the [SCEP](https://en.wikipedia.org/wiki/Simple_Certificate_Enrollment_Protocol) certificate.", + "required": false, + "type": "text" + }, + { + "name": "install_date", + "description": "The date on which the MDM payload was installed on the Mac.", + "required": false, + "type": "text" + }, + { + "name": "installed_from_dep", + "description": "Indicates if the MDM payload was installed via DEP or not.", + "required": false, + "type": "text" + }, + { + "name": "payload_identifier", + "description": "The identifier of the MDM payload.", + "required": false, + "type": "text" + }, + { + "name": "server_url", + "description": "The URL of the MDM server used by this computer.", + "required": false, + "type": "text" + }, + { + "name": "sign_message", + "description": "Indicates if messages sent and received from the MDM server must be signed.", + "required": false, + "type": "text" + }, + { + "name": "topic", + "description": "The topic MDM listens to for push notifications.", + "required": false, + "type": "text" + }, + { + "name": "user_approved", + "description": "Indicates if this MDM payload was approved by the user.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/mdm", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/mdm.yml" + }, + { + "name": "munki_info", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [Kolide](https://github.com/kolide/launcher).", + "description": "Information from the last [Munki](https://github.com/munki/munki) run.", + "platforms": "darwin", + "evented": false, + "examples": "Output errors, warnings and problematic installations from Munki.\n```\nSELECT errors, warnings, problem_installs FROM munki_info ;\n```", + "columns": [ + { + "name": "console_user", + "description": "The username of the user currently logged into the console of the Mac.", + "required": false, + "type": "text" + }, + { + "name": "end_time", + "description": "The date and time at which the latest Munki run ended.", + "required": false, + "type": "text" + }, + { + "name": "errors", + "description": "If Munki encountered any error during the last run, they will be returned in this column.", + "required": false, + "type": "text" + }, + { + "name": "manifest_name", + "description": "The internal manifest name", + "required": false, + "type": "text" + }, + { + "name": "problem_installs", + "description": "A list of installs that did not succeed, if any.", + "required": false, + "type": "text" + }, + { + "name": "start_time", + "description": "The date and time at which the latest Munki run started.", + "required": false, + "type": "text" + }, + { + "name": "success", + "description": "Shows if the Munki run was a success (true), or not (false).", + "required": false, + "type": "text" + }, + { + "name": "version", + "description": "The version of Munki used during the last run.", + "required": false, + "type": "text" + }, + { + "name": "warnings", + "description": "If Munki encountered any error during the last run, they will be returned in this column.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/munki_info", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/munki_info.yml" + }, + { + "name": "munki_installs", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).

Code based on work by [Kolide](https://github.com/kolide/launcher).", + "description": "Software packages and other items [Munki](https://github.com/munki/munki) is managing.", + "platforms": "darwin", + "evented": false, + "examples": "See the version of software that has been deployed by Munki.\n```\nSELECT name, installed_version FROM munki_installs WHERE installed='true';\n```", + "columns": [ + { + "name": "end_time", + "description": "The end time of the last Munki run.", + "required": false, + "type": "text" + }, + { + "name": "installed", + "description": "Shows if Munki installed an item (true) or if it is simply available but not installed (false).", + "required": false, + "type": "text" + }, + { + "name": "installed_version", + "description": "The version number of installed items.", + "required": false, + "type": "text" + }, + { + "name": "name", + "description": "The name of items managed by Munki.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/munki_installs", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/munki_installs.yml" + }, + { + "name": "puppet_facts", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Facts about [Puppet](https://puppet.com/). Puppet facts are *key:value* pairs.", + "platforms": "darwin, windows, linux", + "evented": false, + "examples": "List all Puppet facts.\n```\nSELECT * FROM puppet_facts;\n```", + "columns": [ + { + "name": "node", + "description": "Node, or block of Puppet code.", + "required": false, + "type": "text" + }, + { + "name": "fact", + "description": "Key.", + "required": false, + "type": "text" + }, + { + "name": "value", + "description": "Value.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/puppet_facts", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/puppet_facts.yml" + }, + { + "name": "puppet_info", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Information on the last [Puppet](https://puppet.com/) run. This table uses data from the `last_run_report` that Puppet creates.", + "platforms": "darwin, windows, linux", + "evented": false, + "examples": "List all the information available about the last Puppet run.\n```\nSELECT * FROM puppet_info;\n```", + "columns": [ + { + "name": "cached_catalog_status", + "description": "The status of Puppet catalogs cached on the system.", + "required": false, + "type": "text" + }, + { + "name": "catalog_uuid", + "description": "The [UUID](https://en.wikipedia.org/wiki/Universally_unique_identifier) of the catalog downloaded by Puppet.", + "required": false, + "type": "text" + }, + { + "name": "code_id", + "description": "The `code_id` links the catalog with the compile-time version of file resources using the `puppet:///` URI.", + "required": false, + "type": "text" + }, + { + "name": "configuration_version", + "description": "The version of the Puppet configuration.", + "required": false, + "type": "text" + }, + { + "name": "corrective_change", + "description": "A corrective change is triggered when Puppet detects a discrepency between the current state and the expected state of a value.", + "required": false, + "type": "text" + }, + { + "name": "environment", + "description": "The environment name.", + "required": false, + "type": "text" + }, + { + "name": "host", + "description": "The host on which Puppet is used.", + "required": false, + "type": "text" + }, + { + "name": "kind", + "description": "Kind of Puppet run.", + "required": false, + "type": "text" + }, + { + "name": "master_used", + "description": "The Puppet server used.", + "required": false, + "type": "text" + }, + { + "name": "noop", + "description": "Indicates if Puppet was run in [noop](https://puppet.com/docs/puppet/latest/metaparameter.html#noop) mode.", + "required": false, + "type": "text" + }, + { + "name": "noop_prending", + "description": "Items pending from a [noop](https://puppet.com/docs/puppet/latest/metaparameter.html#noop) run.", + "required": false, + "type": "text" + }, + { + "name": "puppet_version", + "description": "The version of Puppet used during the last run.", + "required": false, + "type": "text" + }, + { + "name": "report_format", + "description": "The format the Puppet report was exported as.", + "required": false, + "type": "text" + }, + { + "name": "status", + "description": "The status of Puppet on this system.", + "required": false, + "type": "text" + }, + { + "name": "time", + "description": "The time of the last Puppet run.", + "required": false, + "type": "text" + }, + { + "name": "transaction_completed", + "description": "Indicates if the transaction completed or not.", + "required": false, + "type": "text" + }, + { + "name": "transaction_uuid", + "description": "The [UUID](https://en.wikipedia.org/wiki/Universally_unique_identifier) of the transaction.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/puppet_info", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/puppet_info.yml" + }, + { + "name": "puppet_logs", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Outputs [Puppet](https://puppet.com/) logs from the last run.", + "platforms": "darwin, windows, linux", + "evented": false, + "examples": "List Puppet logs that are of a level of anything but informational.\n```\nSELECT * FROM puppet_logs WHERE level!='info';\n```", + "columns": [ + { + "name": "level", + "description": "The level of the log item (info, error, etc).", + "required": false, + "type": "text" + }, + { + "name": "message", + "description": "The log message content.", + "required": false, + "type": "text" + }, + { + "name": "source", + "description": "The source of the log item.", + "required": false, + "type": "text" + }, + { + "name": "time", + "description": "The time at which this item was logged.", + "required": false, + "type": "text" + }, + { + "name": "file", + "description": "The file from which osquery read this log.", + "required": false, + "type": "text" + }, + { + "name": "line", + "description": "The line from which this log item was read.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/puppet_logs", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/puppet_logs.yml" + }, + { + "name": "puppet_state", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "State of every resource [Puppet](https://puppet.com/) is managing. This table uses data from the `last_run_report` that Puppet creates.", + "platforms": "darwin, windows, linux", + "evented": false, + "examples": "List resources that failed or took over a minute to evaluate.\n```\nSELECT * FROM puppet_state WHERE failed='true' OR evaluation_time>'60';\n```", + "columns": [ + { + "name": "title", + "description": "The name of the resource.", + "required": false, + "type": "text" + }, + { + "name": "file", + "description": "The file that contains the resource.", + "required": false, + "type": "text" + }, + { + "name": "line", + "description": "The line on which the resource is specified.", + "required": false, + "type": "text" + }, + { + "name": "resource", + "description": "The resource and its title as `Type[title]`.", + "required": false, + "type": "text" + }, + { + "name": "resource_type", + "description": "The resource type.", + "required": false, + "type": "text" + }, + { + "name": "evaluation_time", + "description": "The amount of seconds it took to evaluate the resource.", + "required": false, + "type": "text" + }, + { + "name": "failed", + "description": "If Puppet failed to evaluate this resource, this column is `true`.", + "required": false, + "type": "text" + }, + { + "name": "changed", + "description": "If `change_count` is above `0`, this is `true`.", + "required": false, + "type": "text" + }, + { + "name": "out_of_sync", + "description": "If `out_of_sync_count` is above `0`, this is `true`.", + "required": false, + "type": "text" + }, + { + "name": "skipped", + "description": "True if this resource was skipped.", + "required": false, + "type": "text" + }, + { + "name": "change_count", + "description": "The count of changes to be performed.", + "required": false, + "type": "text" + }, + { + "name": "out_of_sync_count", + "description": "The number of properties that are out of sync", + "required": false, + "type": "text" + }, + { + "name": "corrective_change", + "description": "True if a change on the system caused unexpected changes between two Puppet runs.", + "required": false, + "type": "text" + } + ], + "url": "https://fleetdm.com/tables/puppet_state", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/puppet_state.yml" + }, + { + "name": "unified_log", + "notes": "Requires [macadmins-extension](https://github.com/macadmins/osquery-extension/), which is included by default on osquery packages built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).", + "description": "Allows querying macOS [unified logs](https://developer.apple.com/documentation/os/logging).", + "platforms": "darwin", + "evented": false, + "examples": "Select the latest 100 log items related to `LaunchServices` and convert the UNIX time to a human readable format, and the signature table to verify its cryptographic signature.\n```\nSELECT u.category, u.level, u.message, u.pid, datetime(u.timestamp, 'unixepoch') AS human_time, p.path, s.signed, s.identifier, s.authority FROM unified_log u JOIN processes p ON u.pid = p.pid JOIN signature s ON p.path=s.path WHERE sender='LaunchServices' LIMIT 100; \n```", + "columns": [ + { + "name": "activity", + "description": "The identifier of the log activity.", + "required": false, + "type": "text" + }, + { + "name": "category", + "description": "The category of the log activity.", + "required": false, + "type": "text" + }, + { + "name": "level", + "description": "The log level of this item, such as `default`, `info`, `fault`, etc.", + "required": false, + "type": "text" + }, + { + "name": "message", + "description": "The log message.", + "required": false, + "type": "text" + }, + { + "name": "pid", + "description": "Process ID of the process that generated this log item, which can be joined to multiple other tables including a *PID*.", + "required": false, + "type": "bigint" + }, + { + "name": "process", + "description": "Name of the process that generated this log activity.", + "required": false, + "type": "text" + }, + { + "name": "sender", + "description": "System that sent this activity.", + "required": false, + "type": "text" + }, + { + "name": "storage", + "description": "TBD.", + "required": false, + "type": "text" + }, + { + "name": "subsystem", + "description": "The subsystem responsible for this activity.", + "required": false, + "type": "text" + }, + { + "name": "tid", + "description": "TBD.", + "required": false, + "type": "bigint" + }, + { + "name": "timestamp", + "description": "Timestamp in [UNIX time format](https://en.wikipedia.org/wiki/Unix_time).", + "required": false, + "type": "bigint" + } + ], + "url": "https://fleetdm.com/tables/unified_log", + "fleetRepoUrl": "https://github.com/edit/fleetdm/fleet/schema/tables/unified_log.yml" } ]