Add docs for new tables (#15046)

- Add documentation for new tables so that they show up on fleetdm.com
and the sidebar in the Fleet UI

---------

Co-authored-by: Rachael Shaw <r@rachael.wtf>
Co-authored-by: Jack-Daniyel Strong <jack@jdstrong.com>
Co-authored-by: Eric <eashaw@sailsjs.com>

articles/fleet-4.40.0.md

@@ -1,4 +1,4 @@
-# Fleet 4.40.0 | <!-- More Data, --> Rapid Security Response, CIS Benchmark updates.
+# Fleet 4.40.0 | More Data, Rapid Security Response, CIS Benchmark updates.
 
 ![Fleet 4.40.0](../website/assets/images/articles/fleet-4.40.0-1600x900@2x.png)
 
@@ -7,12 +7,12 @@ For upgrade instructions, see our [upgrade guide](https://fleetdm.com/docs/deplo
 
 ## Highlights
 
-<!-- * More osquery tables -->
+* More osquery tables
 * RSR version in host details
 * CIS Benchmarks for Windows 10 updates
 
 
-<!-- ### More osquery tables
+### More osquery tables
 
 Fleet has introduced an enhancement by adding new osquery [tables](https://fleetdm.com/tables) into
 the `fleetd` daemon, expanding the range of queryable data points for Fleet users. This development
@@ -21,7 +21,6 @@ osquery community and thinking long-term. Users can now utilize an enriched data
 community-driven extensions, enabling them to query and gather detailed data on various aspects of
 their devices, such as FileVault status for macOS, Firefox preferences, the status of Windows
 updates, and more.
-// -->
 
 ### RSR version in host details
 
@@ -109,5 +108,5 @@ Visit our [Upgrade guide](https://fleetdm.com/docs/deploying/upgrading-fleet) in
 <meta name="authorFullName" value="JD Strong">
 <meta name="authorGitHubUsername" value="spokanemac">
 <meta name="publishedOn" value="2023-11-06">
-<meta name="articleTitle" value="Fleet 4.40.0 | Rapid Security Response, CIS Benchmark updates.">
+<meta name="articleTitle" value="Fleet 4.40.0 | More Data, Rapid Security Response, CIS Benchmark updates.">
 <meta name="articleImageUrl" value="../website/assets/images/articles/fleet-4.40.0-1600x900@2x.png">

schema/tables/app_icons.yml

@@ -0,0 +1,19 @@
+name: app_icons
+description: Icons and their locations for macOS applications.
+evented: false
+notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
+platforms:
+  - darwin
+columns:
+  - name: path
+    description: The icon's path.
+    type: text
+    required: false
+  - name: icon
+    description: The icon.
+    type: text
+    required: false
+  - name: hash
+    description: The icon's hash.
+    type: text
+    required: false

schema/tables/cryptoinfo.yml

@@ -0,0 +1,37 @@
+name: cryptoinfo
+description: Get info about the a certificate on the host.
+evented: false
+notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
+platforms:
+  - darwin
+  - windows
+  - linux
+columns:
+  - name: path
+    description: Path to the certificate.
+    type: text
+    required: true
+  - name: passphrase
+    description: The passphrase for the certificate.
+    type: text
+    required: false
+  - name: key
+    description: A specific item that describes the drive.
+    type: text
+    required: false
+  - name: value
+    description: The value for the specified key.
+    type: text
+    required: false
+  - name: fullkey
+    description: The expanded name of the specific item that describes the drive.
+    type: text
+    required: false
+  - name: parent
+    description: The key's parent.
+    type: text
+    required: false
+  - name: query
+    description: The query is printed in this column. For example the SQL `SELECT * FROM cryuptsetup_status WHERE name = 'LUKS_DRIVE' will print "*"` in the query column.
+    type: text
+    required: false

schema/tables/cryptsetup_status.yml

@@ -0,0 +1,31 @@
+name: cryptsetup_status
+description: Get info about the encrypted drive on the host.
+evented: false
+notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
+platforms:
+  - linux
+columns:
+  - name: name
+    required: true
+    description: The name of the drive.
+    type: text
+  - name: key
+    description: A specific item that describes the drive.
+    type: text
+    required: false
+  - name: value
+    description: The value for the specified key.
+    type: text
+    required: false
+  - name: fullkey
+    description: The expanded name of the specific item that describes the drive.
+    type: text
+    required: false
+  - name: parent
+    description: The key's parent.
+    type: text
+    required: false
+  - name: query
+    description: The query is printed in this column. For example the SQL `SELECT * FROM cryuptsetup_status WHERE name = 'LUKS_DRIVE'` will print "*" in the query column.
+    type: text
+    required: false

schema/tables/falcon_kernel_check.yml

@@ -0,0 +1,19 @@
+name: falcon_kernel_check
+description: Get information about Crowdstrike Falcon agent installed on the host.
+evented: false
+notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
+platforms:
+  - linux
+columns:
+  - name: kernel
+    description: Version of the host's kernel.
+    type: text
+    required: false
+  - name: supported
+    description: Whether or not the host's kernel supports the Crowdstrike Falcon sensor version.
+    type: text
+    required: false
+  - name: sensor_version
+    description: Version of the Crowdstrike Falcon's sensor.
+    type: text
+    required: false

schema/tables/falconctl_options.yml

@@ -0,0 +1,11 @@
+name: falconctl_options
+description: Get information about Crowdstrike Falcon agent installed on the host.
+evented: false
+notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
+platforms:
+  - linux
+columns:
+  - name: options
+    description: "The falconctol options to run. Supported values are listed here: `--aid`, `--apd`,`--aph`, `--app`, `--cid`, `--feature`, `--metadata-query`, `--rfm-reason`,`--rfm-state`, `--tags`, `--version`"
+    type: text
+    required: true

schema/tables/filevault_status.yml

@@ -0,0 +1,11 @@
+name: filevault_status
+description: Get current FileVault status.
+evented: false
+notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
+platforms:
+  - darwin
+columns:
+  - name: status
+    description: FileVault status.
+    type: text
+    required: false

schema/tables/firefox_preferences.yml

@@ -0,0 +1,32 @@
+name: firefox_preferences
+description: Get the filepath where the host's Firefox preferences live. 
+evented: false
+notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
+platforms:
+  - darwin
+columns:
+  - name: path
+    description: The path to the host's Firefox preferences.
+    type: text
+    required: true
+  - name: key
+    description: A specific item that describes the path.
+    type: text
+    required: false
+  - name: value
+    description: The value for the specified key.
+    type: text
+    required: false
+  - name: fullkey
+    description: The expanded name of the specific item that describes the path.
+    type: text
+    required: false
+  - name: parent
+    description: The key's parent.
+    type: text
+    required: false
+  - name: query
+    description: The query is printed in this column. For example the SQL `SELECT * FROM firefox_preferences WHERE path = 'testdata/prefs.js'` will print "*" in the query column.
+    type: text
+    required: false
+  

schema/tables/firmwarepasswd.yml

@@ -0,0 +1,19 @@
+name: firmwarepasswd
+description: "Information on the device's firmware password. Supported on Intel macOS hosts only. Reference: https://support.apple.com/en-us/HT204455"
+evented: false
+notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
+platforms:
+  - darwin
+columns:
+  - name: option_roms_allowed
+    description: Whether or not option ROMs are allowed.
+    required: false
+    type: text
+  - name: password_enabled
+    description: Whether or not the host has a firmware password.
+    required: false
+    type: text
+  - name: mode
+    description: Host's mode setting.
+    required: false
+    type: text

schema/tables/ioreg.yml

@@ -0,0 +1,51 @@
+name: ioreg
+description: Get values from macOS ioreg command. Columns are input options for the command. They match the ioreg command line tool.
+evented: false
+notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
+platforms:
+  - darwin
+columns:
+  - name: c
+    description: List properties of objects with the given class.
+    required: false
+    type: text
+  - name: d
+    description: Limit tree to the given depth.
+    required: false
+    type: text
+  - name: k
+    description: List properties of objects with the given key.
+    required: false
+    type: text
+  - name: "n"
+    description: List properties of objects with the given name.
+    required: false
+    type: text
+  - name: p
+    description: Traverse registry over the given plane (IOService is default).
+    required: false
+    type: text
+  - name: r
+    description: Show subtrees rooted by the given criteria.
+    required: false
+    type: text
+  - name: key
+    description: A specific item that describes the returned value.
+    type: text
+    required: false
+  - name: value
+    description: The value for the specified key.
+    type: text
+    required: false
+  - name: fullkey
+    description: The expanded name of the specific item that describes the value.
+    type: text
+    required: false
+  - name: parent
+    description: The key's parent.
+    type: text
+    required: false
+  - name: query
+    description: The query is printed in this column.
+    type: text
+    required: false

schema/tables/windows_updates.yml

@@ -0,0 +1,35 @@
+name: windows_updates
+description: Returns information about Windows updates that are available for installation.
+evented: false
+notes: This table is not a core osquery table. It is included as part of fleetd, the osquery manager from Fleet. Code based on work by [Kolide](https://github.com/kolide/launcher).
+platforms:
+  - darwin
+columns:
+  - name: locale
+    description: Location of the update.
+    required: false
+    type: text
+  - name: is_default
+    description: Whether or not the update is the default.
+    required: false
+    type: text
+  - name: key
+    description: A specific item that describes the update.
+    type: text
+    required: false
+  - name: value
+    description: The value for the specified key.
+    type: text
+    required: false
+  - name: fullkey
+    description: The expanded name of the specific item that describes the update.
+    type: text
+    required: false
+  - name: parent
+    description: The key's parent.
+    type: text
+    required: false
+  - name: query
+    description: The query is printed in this column.
+    type: text
+    required: false