Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 5 Packages Projects Releases Wiki Activity

Schema: Update schema overrides to only use one YAML block scalar (#18351)

Browse Source 
Closes: #18240

Changes:
- Updated the schema override files to use only one YAML block scalar
(`>-`)
- Updated the template yaml included in the link to create a new
override file in get-extended-osquery-schema helper to use the `>-`
block scalar
- regenerated osquery_fleet_schema.json
This commit is contained in:
Eric
2024-04-16 18:35:23 -05:00
committed by GitHub
parent a5c107e082
commit c2f333aebb
26 changed files with 206 additions and 200 deletions
Download Patch File Download Diff File Expand all files Collapse all files
schema/osquery_fleet_schema.json
+162 -162
View File
File diff suppressed because it is too large Load Diff
schema/tables/apfs_physical_stores.yml
+1 -1
View File
@@ -10,7 +10,7 @@ columns:
- name: container_designated_physical_store
type: text
required: false
description: |
description: >-
The disk displayed as the backing store of the container. There may be multiple,
use `apfs_physical_stores` to see all actual physical stores
- name: container_reference
schema/tables/apfs_volumes.yml
+2 -2
View File
@@ -10,7 +10,7 @@ columns:
- name: container_designated_physical_store
type: text
required: false
description: |
description: >-
The disk displayed as the backing store of the container. There may be multiple,
use `apfs_physical_stores` to see all actual physical stores
- name: container_reference
@@ -44,7 +44,7 @@ columns:
- name: role
type: text
required: false
description: |
description: >-
The first role of the volume. User-created volumes will have no role (this will be empty).
System volumes might have roles like "Data", "Hardware", etc.
- name: capacity_in_use
schema/tables/authdb.yml
+2 -2
View File
@@ -6,12 +6,12 @@ columns:
- name: right_name
type: text
required: true
description: |
description: >-
The right_name to query in the `authorizationdb read <right_name>` command.
- name: json_result
type: text
required: false
description: |
description: >-
The JSON output parsed from the plist output of the `authorizationdb read <right_name>` command.
notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
evented: false
schema/tables/chrome_extensions.yml
+1 -1
View File
@@ -20,7 +20,7 @@ examples: >-
SELECT u.username, ce.name, ce.description, ce.version, ce.profile, ce.permissions FROM users u CROSS JOIN chrome_extensions ce USING (uid) WHERE ce.permissions LIKE '%%https://*/*%%';
```
notes: |
notes: >-
Querying this table requires joining against the `users` table. [Learn more](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)
On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).
schema/tables/corestorage_logical_volume_families.yml
+1 -1
View File
@@ -14,7 +14,7 @@ columns:
- name: vg_FreeSpace
type: bigint
required: false
description: |
description: >-
Amount of space, in bytes, in the volume group that have not been allocated by any logical volume
- name: vg_FusionDrive
type: integer
schema/tables/corestorage_logical_volumes.yml
+2 -2
View File
@@ -14,7 +14,7 @@ columns:
- name: vg_FreeSpace
type: bigint
required: false
description: |
description: >-
Amount of space, in bytes, in the volume group that have not been allocated by any logical volume
- name: vg_FusionDrive
type: integer
@@ -119,7 +119,7 @@ columns:
- name: DesignatedPhysicalVolumeIdentifier
type: text
required: false
description: |
description: >-
Identifier of one of the physical volumes that holds this logical volume (e.g disk0s2)
- name: Identifier
type: text
schema/tables/csrutil_info.yml
+1 -1
View File
@@ -6,7 +6,7 @@ columns:
- name: ssv_enabled
type: integer
required: false
description: |
description: >-
Sealed System Volume is a security feature introduced in macOS 11.0 Big Sur.
During system installation, a SHA-256 cryptographic hash is calculated for all immutable system files and stored in a Merkle tree which itself is hashed as the Seal. Both are stored in the metadata of the snapshot created of the System volume.
The seal is verified by the boot loader at startup. macOS will not boot if system files have been tampered with. If validation fails, the user will be instructed to reinstall the operating system.
schema/tables/disk_info.yml
+4 -1
View File
@@ -5,7 +5,9 @@ platforms:
description: Retrieve basic information about the physical disks of a system.
examples: >-
```
SELECT * FROM disk_info;
```
columns:
- name: disk_size
@@ -46,6 +48,7 @@ columns:
platforms:
- windows
evented: false
notes: |
notes: >-
- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).
- Available for ChromeOS 91+.
schema/tables/find_cmd.yml
+5 -5
View File
@@ -6,24 +6,24 @@ columns:
- name: directory
type: text
required: true
description: |
description: >-
The directory passed to find as first argument.
- name: type
type: text
required: false
description: |
description: >-
Sets the value of the `-type` flag.
- name: perm
type: text
required: false
description: |
description: >-
Sets the value of the `-perm` flag.
- name: path
type: text
required: false
description: |
description: >-
Contains the found paths.
notes: |
notes: >-
This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet.
Fleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
evented: false
schema/tables/firmware_eficheck_integrity_check.yml
+2 -2
View File
@@ -6,13 +6,13 @@ columns:
- name: chip
type: text
required: false
description: |
description: >-
Contains the chip type, values are "apple", "intel-t1" and "intel-t2".
If chip type is "apple" or "intel-t2" then no eficheck integrity check is executed.
- name: output
type: text
required: false
description: |
description: >-
Output of the `/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check` command.
This value is only valid when chip is "intel-t1".
notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
schema/tables/geolocation.yml
+1 -1
View File
@@ -20,5 +20,5 @@ columns:
type: text
required: false
description: Region
notes: |
notes: >-
- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).
schema/tables/network_interfaces.yml
+2 -1
View File
@@ -16,6 +16,7 @@ columns:
type: text
required: false
description: IPv6 address (only available to extensions force-installed by enterprise policy)
notes: |
notes: >-
- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).
- Requires that the fleetd extension is force-installed by enterprise policy
schema/tables/nvram_info.yml
+1 -1
View File
@@ -6,7 +6,7 @@ columns:
- name: amfi_enabled
type: integer
required: false
description: |
description: >-
Apple Mobile File Integrity (AMFI) was first released in macOS 10.12. The daemon and service block attempts to run unsigned code. AMFI uses lanchd, code signatures, certificates, entitlements, and provisioning profiles to create a filtered entitlement dictionary for an app. AMFI is the macOS kernel module that enforces code-signing and library validation.
Note: AMFI cannot be disabled with SIP enabled, but a change attempt can be made that will appear successful, and report incorrectly as successful. If the AMFI audit fails, and the SIP audit passes, this is still an issue the admin should research.
notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
schema/tables/os_version.yml
+1 -1
View File
@@ -23,5 +23,5 @@ columns:
- name: mount_namespace_id
platforms:
- linux
notes: |
notes: >-
- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).
schema/tables/osquery_info.yml
+1 -1
View File
@@ -54,5 +54,5 @@ examples: >-
SELECT version FROM osquery_info;
```
notes: |
notes: >-
- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).
schema/tables/pmset.yml
+1 -1
View File
@@ -11,7 +11,7 @@ columns:
type: text
required: false
description: Result of the command in JSON format.
notes: |
notes: >-
This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet.
Fleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
evented: false
schema/tables/privacy_preferences.yml
+1 -1
View File
@@ -84,5 +84,5 @@ columns:
description: 1 if enabled else 0 * Available for Chrome 111+
required: false
type: integer
notes: |
notes: >-
- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).
schema/tables/pwd_policy.yml
+6 -6
View File
@@ -6,29 +6,29 @@ columns:
- name: max_failed_attempts
type: integer
required: false
description: |
description: >-
The account lockout threshold specifies the amount of times a user can enter an incorrect password before a lockout will occur. Ensure that a lockout threshold is part of the password policy on the computer.
- name: expires_every_n_days
type: integer
required: false
description: |
description: >-
How many days for a new password to expire.
- name: days_to_expiration
type: integer
required: false
description: |
description: >-
How many days are left for the expiration of the current password.
- name: history_depth
type: integer
required: false
description: |
description: >-
This parameter indicates the depth of password history which a new password can't be identical to.
- name: min_mixed_case_characters
type: integer
required: false
description: |
description: >-
This parameter indicates the minimum number of mixed characters in a password.
notes: |
notes: >-
This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet.
Fleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
evented: false
schema/tables/screenlock.yml
+3 -1
View File
@@ -4,7 +4,9 @@ platforms:
- chrome
description: >-
Returns if the screen locks automatically and the time, in seconds, it takes until the screen is locked automatically while idle. For macOS, this table will return no results if osquery is running as root.
notes: |
notes: >-
- For macOS, this only fetches results for osquery's current logged-in user context. The user must also have recently logged in.
- For ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).
- For ChromeOS, this table is only available for Chrome 73+.
schema/tables/sntp_request.yml
+1 -1
View File
@@ -17,7 +17,7 @@ columns:
type: bigint
required: false
description: Offset between the host's time and the SNTP time in milliseconds.
notes: |
notes: >-
This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet.
Fleetd installers can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
evented: false
schema/tables/software_update.yml
+1 -1
View File
@@ -6,7 +6,7 @@ columns:
- name: software_update_required
type: integer
required: false
description: |
description: >-
If true, means one of the Apple softwares installed on this machine has a new available upgrade.
notes: This table is not a core osquery table. It is included as part of [Fleetd](https://fleetdm.com/docs/using-fleet/orbit), the osquery manager from Fleet. Fleetd can be built with [fleetctl](https://fleetdm.com/docs/using-fleet/adding-hosts#osquery-installer).
evented: false
schema/tables/system_info.yml
+1 -1
View File
@@ -86,5 +86,5 @@ examples: >-
SELECT CPU_type, hardware_vendor, hardware_model, hardware_serial FROM system_info;
```
notes: |
notes: >-
- This table is not a core osquery table. This table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).
schema/tables/users.yml
+1 -1
View File
@@ -61,5 +61,5 @@ columns:
- linux
- name: username
description: Username
notes: |
notes: >-
- On ChromeOS, this table requires the [fleetd Chrome extension](https://fleetdm.com/docs/using-fleet/chromeos).
schema/tables/xprotect_reports.yml
+1 -1
View File
@@ -8,5 +8,5 @@ examples: >-
SELECT * FROM xprotect_reports;
```
notes: |
notes: >-
- In [very specific circumstances](https://github.com/osquery/osquery/issues/6588#issuecomment-1410934706) this table will return empty because xprotect will detect and remediate without generating an eicar file.
website/api/helpers/get-extended-osquery-schema.js
Vendored
+1 -1
View File
@@ -115,7 +115,7 @@ module.exports = {
expandedTableToPush.url = 'https://fleetdm.com/tables/'+encodeURIComponent(expandedTableToPush.name);
// Since we don't have a Fleet override for this table, we'll set the fleetRepoUrl for this table to be a link to create the Fleet override table YAML.
// This is done by adding a 'filename' and 'value' as search parameters to a url that creates a new folder in the schema/tables/ folder.
let sampleYamlSchemaForThisTable =`name: ${expandedTableToPush.name}\ndescription: | # (required) string - The description for this table. Note: this field supports markdown\n\t# Add description here\nexamples: | # (optional) string - An example query for this table. Note: This field supports markdown\n\t# Add examples here\nnotes: | # (optional) string - Notes about this table. Note: This field supports markdown.\n\t# Add notes here\ncolumns: # (required)\n\t- name: # (required) string - The name of the column\n\t description: # (required) string - The column's description\n\t type: # (required) string - the column's data type\n\t required: # (required) boolean - whether or not this column is required to query this table.`;
let sampleYamlSchemaForThisTable =`name: ${expandedTableToPush.name}\ndescription: >- # (required) string - The description for this table. Note: this field supports Markdown\n\t# Add description here\nexamples: >- # (optional) string - An example query for this table. Note: This field supports Markdown\n\t# Add examples here\nnotes: >- # (optional) string - Notes about this table. Note: This field supports Markdown.\n\t# Add notes here\ncolumns: # (required)\n\t- name: # (required) string - The name of the column\n\t description: # (required) string - The column's description. Note: this field supports Markdown\n\t type: # (required) string - the column's data type\n\t required: # (required) boolean - whether or not this column is required to query this table.`;
expandedTableToPush.fleetRepoUrl = 'https://github.com/fleetdm/fleet/new/main/schema?filename='+encodeURIComponent('tables/'+expandedTableToPush.name)+'.yml&value='+encodeURIComponent(sampleYamlSchemaForThisTable);