diff --git a/schema/osquery_fleet_schema.json b/schema/osquery_fleet_schema.json index 4624549bf7..0a72676a8c 100644 --- a/schema/osquery_fleet_schema.json +++ b/schema/osquery_fleet_schema.json @@ -11308,7 +11308,7 @@ "evented": false, "cacheable": false, "notes": "* On Windows, `gid` and `gid_signed` are always the same", - "examples": "See all groups with the IsHidden OpenDirectory attribute\n\n```\nSELECT * FROM groups WHERE is_hidden='1';\n```", + "examples": "See all groups with the `IsHidden` OpenDirectory attribute:\n\n```\nSELECT * FROM groups WHERE is_hidden='1';\n```\n\nCollect the users that are members of the `admin` group:\n\n```\nSELECT * FROM groups JOIN user_groups USING (gid) JOIN users USING (uid) WHERE groupname='admin';\n```", "columns": [ { "name": "gid", diff --git a/schema/tables/groups.yml b/schema/tables/groups.yml index 6c3275ebb3..f5d42b254f 100644 --- a/schema/tables/groups.yml +++ b/schema/tables/groups.yml @@ -1,10 +1,16 @@ name: groups examples: |- - See all groups with the IsHidden OpenDirectory attribute + See all groups with the `IsHidden` OpenDirectory attribute: ``` SELECT * FROM groups WHERE is_hidden='1'; ``` + + Collect the users that are members of the `admin` group: + + ``` + SELECT * FROM groups JOIN user_groups USING (gid) JOIN users USING (uid) WHERE groupname='admin'; + ``` columns: - name: group_sid platforms: