From 98e825e4343b8125113b6c4daae774176c56964a Mon Sep 17 00:00:00 2001 From: Eric Date: Mon, 5 Feb 2024 17:30:41 -0600 Subject: [PATCH] Update osquery schema version, regenerate merged schema JSON (#16597) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit For https://github.com/fleetdm/fleet/issues/13891 Changes: - Updated the version of the osquery schema used to generate osqeury_fleet_schema.json (`5.9.1` » `5.11.0`) - Removed the table override file for the `atom_packages` table (It was removed from the osquery schema, our override file was previously hiding the table) - Ran the `generate-merged-schema` script to regenerate osquery_fleet_schema.json --- schema/osquery_fleet_schema.json | 370 +++++++++++++++++++++---------- schema/tables/atom_packages.yml | 13 -- website/config/custom.js | 2 +- 3 files changed, 258 insertions(+), 127 deletions(-) delete mode 100644 schema/tables/atom_packages.yml diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index bc4e611e08..df3e245e0c 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -1377,89 +1377,6 @@ ], "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/asl.yml" }, - { - "name": "atom_packages", - "description": "Lists all atom packages in a directory or globally installed in a system.", - "url": "https://fleetdm.com/tables/atom_packages", - "platforms": [ - "darwin", - "linux", - "windows" - ], - "evented": false, - "cacheable": false, - "notes": "", - "examples": [ - "select * from atom_packages" - ], - "columns": [ - { - "name": "name", - "description": "Package display name", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "version", - "description": "Package supplied version", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "description", - "description": "Package supplied description", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "path", - "description": "Package's package.json path", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "license", - "description": "License for package", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "homepage", - "description": "Package supplied homepage", - "type": "text", - "notes": "", - "hidden": false, - "required": false, - "index": false - }, - { - "name": "uid", - "description": "The local user that owns the plugin", - "type": "bigint", - "notes": "", - "hidden": false, - "required": false, - "index": true - } - ], - "hidden": true, - "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/atom_packages.yml" - }, { "name": "augeas", "description": "Configuration files parsed by [augeas](https://augeas.net/).", @@ -4274,7 +4191,7 @@ }, { "name": "serial_number", - "description": "The serial number of the display.", + "description": "The serial number of the display. (may not be unique)", "type": "text", "notes": "", "hidden": false, @@ -6614,7 +6531,7 @@ "notes": "", "hidden": false, "required": false, - "index": true + "index": false }, { "name": "uuid", @@ -9604,7 +9521,7 @@ }, { "name": "team_id", - "description": "Team identifier of thd process", + "description": "Team identifier of the process", "type": "text", "notes": "", "hidden": false, @@ -10446,6 +10363,90 @@ "Windows" ] }, + { + "name": "shortcut_target_path", + "description": "Full path to the file the shortcut points to", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "windows", + "win32", + "cygwin" + ] + }, + { + "name": "shortcut_target_type", + "description": "Display name for the target type", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "windows", + "win32", + "cygwin" + ] + }, + { + "name": "shortcut_target_location", + "description": "Folder name where the shortcut target resides", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "windows", + "win32", + "cygwin" + ] + }, + { + "name": "shortcut_start_in", + "description": "Full path to the working directory to use when executing the shortcut target", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "windows", + "win32", + "cygwin" + ] + }, + { + "name": "shortcut_run", + "description": "Window mode the target of the shortcut should be run in", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "windows", + "win32", + "cygwin" + ] + }, + { + "name": "shortcut_comment", + "description": "Comment on the shortcut", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "windows", + "win32", + "cygwin" + ] + }, { "name": "bsd_flags", "description": "The BSD file flags (chflags). Possible values: NODUMP, UF_IMMUTABLE, UF_APPEND, OPAQUE, HIDDEN, ARCHIVED, SF_IMMUTABLE, SF_APPEND", @@ -13177,7 +13178,7 @@ }, { "name": "keychain_acls", - "description": "Applications that have ACL entries in the keychain.", + "description": "Applications that have ACL entries in the keychain. NOTE: osquery limits frequent access to keychain files. This limit is controlled by keychain_access_interval flag.", "url": "https://fleetdm.com/tables/keychain_acls", "platforms": [ "darwin" @@ -13237,7 +13238,7 @@ }, { "name": "keychain_items", - "description": "Generic details about keychain items.", + "description": "Generic details about keychain items. NOTE: osquery limits frequent access to keychain files. This limit is controlled by keychain_access_interval flag.", "url": "https://fleetdm.com/tables/keychain_items", "platforms": [ "darwin" @@ -20740,13 +20741,13 @@ ], "evented": true, "cacheable": false, - "notes": "", + "notes": "This table will only include events for changes and files in directories that existed before the fleetd agent starts.", "examples": [], "columns": [ { "name": "operation", "description": "Operation type", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20755,7 +20756,7 @@ { "name": "pid", "description": "Process ID", - "type": "bigint", + "type": "BIGINT", "notes": "", "hidden": false, "required": false, @@ -20764,7 +20765,7 @@ { "name": "ppid", "description": "Parent process ID", - "type": "bigint", + "type": "BIGINT", "notes": "", "hidden": false, "required": false, @@ -20773,7 +20774,7 @@ { "name": "time", "description": "Time of execution in UNIX time", - "type": "bigint", + "type": "BIGINT", "notes": "", "hidden": false, "required": false, @@ -20782,7 +20783,7 @@ { "name": "executable", "description": "The executable path", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20791,7 +20792,7 @@ { "name": "partial", "description": "True if this is a partial event (i.e.: this process existed before we started osquery)", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20800,7 +20801,7 @@ { "name": "cwd", "description": "The current working directory of the process", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20809,7 +20810,7 @@ { "name": "path", "description": "The path associated with the event", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20818,7 +20819,7 @@ { "name": "dest_path", "description": "The canonical path associated with the event", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20827,7 +20828,7 @@ { "name": "uid", "description": "The uid of the process performing the action", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20836,7 +20837,7 @@ { "name": "gid", "description": "The gid of the process performing the action", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20845,7 +20846,7 @@ { "name": "auid", "description": "Audit user ID of the process using the file", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20854,7 +20855,7 @@ { "name": "euid", "description": "Effective user ID of the process using the file", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20863,7 +20864,7 @@ { "name": "egid", "description": "Effective group ID of the process using the file", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20872,7 +20873,7 @@ { "name": "fsuid", "description": "Filesystem user ID of the process using the file", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20881,7 +20882,7 @@ { "name": "fsgid", "description": "Filesystem group ID of the process using the file", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20890,7 +20891,7 @@ { "name": "suid", "description": "Saved user ID of the process using the file", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20899,7 +20900,7 @@ { "name": "sgid", "description": "Saved group ID of the process using the file", - "type": "text", + "type": "TEXT", "notes": "", "hidden": false, "required": false, @@ -20908,7 +20909,7 @@ { "name": "uptime", "description": "Time of execution in system uptime", - "type": "bigint", + "type": "BIGINT", "notes": "", "hidden": false, "required": false, @@ -20917,15 +20918,14 @@ { "name": "eid", "description": "Event ID", - "type": "text", + "type": "TEXT", "notes": "", "hidden": true, "required": false, "index": false } ], - "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/linux/process_file_events.table", - "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_file_events.yml&value=name%3A%20process_file_events%0Adescription%3A%20%7C%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_file_events.yml" }, { "name": "process_memory_map", @@ -21265,7 +21265,7 @@ "notes": "", "hidden": false, "required": false, - "index": true + "index": false }, { "name": "fd", @@ -23419,7 +23419,43 @@ }, { "name": "secure_mode", - "description": "Secure mode for Intel-based macOS: 0 disabled, 1 full security, 2 medium security", + "description": "(Intel) Secure mode: 0 disabled, 1 full security, 2 medium security", + "type": "integer", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "macOS" + ] + }, + { + "name": "description", + "description": "(Apple Silicon) Human-readable description: 'Full Security', 'Reduced Security', or 'Permissive Security'", + "type": "text", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "macOS" + ] + }, + { + "name": "kernel_extensions", + "description": "(Apple Silicon) Allow user management of kernel extensions from identified developers (1 if allowed)", + "type": "integer", + "notes": "", + "hidden": true, + "required": false, + "index": false, + "platforms": [ + "macOS" + ] + }, + { + "name": "mdm_operations", + "description": "(Apple Silicon) Allow remote (MDM) management of kernel extensions and automatic software updates (1 if allowed)", "type": "integer", "notes": "", "hidden": true, @@ -27542,6 +27578,105 @@ ], "fleetRepoUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/virtual_memory_info.yml" }, + { + "name": "vscode_extensions", + "description": "Lists all vscode extensions.", + "url": "https://fleetdm.com/tables/vscode_extensions", + "platforms": [ + "darwin", + "linux", + "windows" + ], + "evented": false, + "cacheable": false, + "notes": "", + "examples": "```\nselect * from vscode_extensions\n```", + "columns": [ + { + "name": "name", + "description": "Extension Name", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "uuid", + "description": "Extension UUID", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "version", + "description": "Extension version", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "path", + "description": "Extension path", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "publisher", + "description": "Publisher Name", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "publisher_id", + "description": "Publisher ID", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "installed_at", + "description": "Installed Timestamp", + "type": "bigint", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "prerelease", + "description": "Pre release version", + "type": "integer", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, + { + "name": "uid", + "description": "The local user that owns the plugin", + "type": "bigint", + "notes": "", + "hidden": false, + "required": false, + "index": false + } + ], + "osqueryRepoUrl": "https://github.com/osquery/osquery/blob/master/specs/vscode_extensions.table", + "fleetRepoUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fvscode_extensions.yml&value=name%3A%20vscode_extensions%0Adescription%3A%20%7C%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, { "name": "wifi_networks", "description": "Wi-Fi networks previously connected to by this Mac, or that are otherwise in this computer's known/remembered Wi-Fi networks list.", @@ -29839,6 +29974,15 @@ "required": false, "index": false }, + { + "name": "cloud_id", + "description": "Cloud identifier for the VM", + "type": "text", + "notes": "", + "hidden": false, + "required": false, + "index": false + }, { "name": "name", "description": "Name of the VM", diff --git a/schema/tables/atom_packages.yml b/schema/tables/atom_packages.yml deleted file mode 100644 index 4db7c9286b..0000000000 --- a/schema/tables/atom_packages.yml +++ /dev/null @@ -1,13 +0,0 @@ -name: atom_packages -hidden: true -# examples: >- -# List installed Atom packages and their version. -# -# ``` -# -# SELECT name, version, description FROM atom_packages; -# -# ``` -# columns: -# - name: uid -# requires_user_context: true diff --git a/website/config/custom.js b/website/config/custom.js index 3f7c8bedaf..2d1fb9f96f 100644 --- a/website/config/custom.js +++ b/website/config/custom.js @@ -271,7 +271,7 @@ module.exports.custom = { // The version of osquery to use when generating schema docs // (both in Fleet's query console and on fleetdm.com) - versionOfOsquerySchemaToUseWhenGeneratingDocumentation: '5.9.1', + versionOfOsquerySchemaToUseWhenGeneratingDocumentation: '5.11.0', // ███████╗██╗ ██╗██████╗ ██╗ ██████╗ ██████╗ ███████╗ ██████╗ █████╗ ████████╗ █████╗