From 7fb3d12477e595e8a8a8f5d0d92037236f30bdcd Mon Sep 17 00:00:00 2001
From: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
Date: Fri, 14 Jun 2024 17:34:02 -0400
Subject: [PATCH] Update sip_config.yml (#19747)

Update sip_config table per #16993
---
 schema/tables/sip_config.yml | 24 ++++++++++++++++++++++--
 1 file changed, 22 insertions(+), 2 deletions(-)

diff --git a/schema/tables/sip_config.yml b/schema/tables/sip_config.yml
index a783dfbce3..2fff0d92a9 100644
--- a/schema/tables/sip_config.yml
+++ b/schema/tables/sip_config.yml
@@ -1,7 +1,27 @@
 name: sip_config
+description: macOS System Integrity Protection (SIP) protects the Mac by preventing the execution of unauthorized code. The `sip_config` osquery table collects the current SIP status of a Mac.
 examples: |-
-  View the status of System Integrity Protection.
+  Basic query:
   
   ```
-  SELECT config_flag, enabled FROM sip_config WHERE config_flag='sip';
+  SELECT * FROM sip_config;
   ```
+
+  This query displays the current SIP status (SIP is enabled if the value=1):
+
+  ```
+  SELECT enabled FROM sip_config WHERE config_flag='sip';
+  ```
+notes: |-
+  SIP:
+  - automatically authorizes apps users download from the App Store
+  - authorizes apps developers notarize and distribute directly to users
+  - prevents launching of other apps unless users or administrators modify "Gatekeeper" settings
+
+  Organizations that develop software for Apple operating systems on the Mac may allow users to disable SIP. Because SIP is a basic and critical macOS security protection it is important to monitor SIP status on Hosts.
+
+  Links:
+  
+  - [About System Integrity Protection](https://support.apple.com/en-us/102149)
+  - [Disabling and Enabling System Integrity Protection](https://developer.apple.com/documentation/security/disabling_and_enabling_system_integrity_protection/)
+  - [Gatekeeper and runtime protection in macOS](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web)