Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 6 Packages Projects Releases Wiki Activity

fix conflicts in docs about unified_logs vs macadmins_unified_logs (#9214)

Browse Source 
As raised by a community member in
[Slack](https://osquery.slack.com/archives/C01DXJL16D8/p1672751794862639),
this updates our documentation to account for both `unified_log` and
`macadmins_unified_log`.

Per my testing, it should also help with the #9158 bug in Fleet's UI.

I have updated the columns of `macadmins_unified_log` according to
what's in the [source
code](https://github.com/macadmins/osquery-extension/blob/50f94d0d7001c048e0a5564911e46d1952420a80/tables/unifiedlog/unified_log.go#L47-L69),
and modified the example to work.

Since I was there I have also updated the osquery version we use to pull
the JSON to `5.6.0` and fixed a small bug related to the examples we
pull from there.

. . . . . . .

Co-authored-by: Mike McNeil <mikermcneil@users.noreply.github.com>
This commit is contained in:
Roberto Dip
2023-01-10 17:45:53 -06:00
committed by GitHub
co-authored by Mike McNeil
parent 93f39f40c2
commit 5919931a4c
4 changed files with 3703 additions and 787 deletions
Download Patch File Download Diff File Expand all files Collapse all files
website/api/helpers/get-extended-osquery-schema.js
Vendored
+16 -1
View File
@@ -23,7 +23,7 @@ module.exports = {
let YAML = require('yaml');
let topLvlRepoPath = path.resolve(sails.config.appPath, '../');
let VERSION_OF_OSQUERY_SCHEMA_TO_USE = '5.4.0';
let VERSION_OF_OSQUERY_SCHEMA_TO_USE = '5.6.0';
// Getting the specified osquery schema from the osquery/osquery-site GitHub repo.
let rawOsqueryTables = await sails.helpers.http.get('https://raw.githubusercontent.com/osquery/osquery-site/source/src/data/osquery_schema_versions/'+VERSION_OF_OSQUERY_SCHEMA_TO_USE+'.json');
@@ -73,6 +73,21 @@ module.exports = {
expandedTableToPush.fleetRepoUrl = 'https://github.com/fleetdm/fleet/new/main/schema/tables/?filename='+encodeURIComponent('/tables/'+expandedTableToPush.name)+'.yml&value='+encodeURIComponent(sampleYamlSchemaForThisTable);
// As the table might have multiple examples, we grab only one until we
// adjust the UI to better display multiple examples (paddings, UX,
// etc.)
//
// We pick the last example in the array as they progressively build in
// complexity and the last is usually the richest.
//
// TODO: adjust the UI to show all examples.
let examplesFromOsquerySchema = expandedTableToPush.examples;
if (examplesFromOsquerySchema.length > 0) {
// Examples are parsed as markdown, so we wrap the example in a code
// fence so it renders as a code block.
expandedTableToPush.examples = '```\n' + examplesFromOsquerySchema[examplesFromOsquerySchema.length - 1] + '\n```';
}
expandedTables.push(expandedTableToPush);
} else { // If this table exists in the Fleet overrides schema, we'll override the values
if(fleetOverridesForTable.platforms !== undefined) {