From af475c7d6dc00a676f44d39b89e0c0a61630fc83 Mon Sep 17 00:00:00 2001 From: Brock Walters <153771548+nonpunctual@users.noreply.github.com> Date: Thu, 30 Jan 2025 12:42:04 -0500 Subject: [PATCH] Update ioreg.yml (#25889) Added example query. --------- Co-authored-by: Eric --- schema/osquery_fleet_schema.json | 1 + schema/tables/ioreg.yml | 14 +++++++++++++- 2 files changed, 14 insertions(+), 1 deletion(-) diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index 01f1cff313..997cf18eab 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -12582,6 +12582,7 @@ "platforms": [ "darwin" ], + "examples": "Find HID Device Protocol data:\n\n```\n WITH protocols as (\n SELECT \n MAX (case WHEN key = \"USB Address\" THEN value END) as usb_address,\n MAX (case WHEN key = \"bDeviceProtocol\" THEN value END) as protocol\n from ioreg where r=true and c=\"IOUSBDevice\" group by parent\n) \nSELECT * FROM usb_devices join protocols using (usb_address)\n```", "columns": [ { "name": "c", diff --git a/schema/tables/ioreg.yml b/schema/tables/ioreg.yml index 727749f0f0..326ac6883c 100644 --- a/schema/tables/ioreg.yml +++ b/schema/tables/ioreg.yml @@ -4,6 +4,18 @@ evented: false notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher). platforms: - darwin +examples: |- + Find HID Device Protocol data: + + ``` + WITH protocols as ( + SELECT + MAX (case WHEN key = "USB Address" THEN value END) as usb_address, + MAX (case WHEN key = "bDeviceProtocol" THEN value END) as protocol + from ioreg where r=true and c="IOUSBDevice" group by parent + ) + SELECT * FROM usb_devices join protocols using (usb_address) + ``` columns: - name: c description: List properties of objects with the given class. @@ -48,4 +60,4 @@ columns: - name: query description: The query is printed in this column. type: text - required: false \ No newline at end of file + required: false