Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 22 Packages Projects Releases Wiki Activity
Files
2bd7fec8a70e0dcb201be2de2623edfc0063f601
fleet/schema/tables
T
History
Sharon Katz 7d26e7e475 Add adobe_plugins osquery extension table (#45208) 
Closes #45206

## Summary

- Adds a new `adobe_plugins` osquery extension table to fleetd (macOS +
Windows)
- Parses CEP (`CSXS/manifest.xml`) and UXP (`manifest.json`) manifests
for rich metadata
- Falls back to filesystem info for native plug-ins where no manifest
exists
- Supports a `scan_level` WHERE constraint: `standard` (default) or
`deep`

## Table schema

| Column | Type | Description |
| --- | --- | --- |
| `path` | TEXT | Full path to the plugin directory or file |
| `name` | TEXT | Plugin display name (from manifest or directory name)
|
| `version` | TEXT | Plugin version (from manifest) |
| `vendor` | TEXT | Plugin author/publisher (from manifest) |
| `bundle_id` | TEXT | Plugin bundle identifier (from manifest) |
| `host_application` | TEXT | Target app(s): Photoshop, Illustrator,
Premiere Pro, etc. |
| `extension_type` | TEXT | `CEP`, `UXP`, or `native` |
| `user` | TEXT | Username for user-scoped installs; empty for
system-wide |
| `platform` | TEXT | `darwin` or `windows` |
| `scan_level` | TEXT | WHERE constraint only — `standard` (default) or
`deep` |

## How I tested it

> **Note:** Manual testing was done by installing two real open-source
CEP extensions (downloaded from GitHub) on a macOS host without a full
Adobe CC installation. This validates the table logic, manifest parsing,
and osquery integration end-to-end against real-world manifest formats.
**QA should test against machines with full Adobe Creative Cloud
installations** (Photoshop, Premiere, Illustrator, etc.) to verify the
scan paths match what Adobe actually ships, and to exercise `scan_level
= 'deep'` with real native plug-in directories. Expect a few more dev
cycles after QA feedback.

### 1. Unit tests — 22 passing

```
$ go test ./orbit/pkg/table/adobe_plugins/... -v
--- PASS: TestParseCEPPlugin/valid_manifest
--- PASS: TestParseCEPPlugin/missing_manifest_falls_back_to_dir_name
--- PASS: TestParseCEPPlugin/malformed_manifest_falls_back_to_dir_name
--- PASS: TestParseUXPPlugin/valid_manifest
--- PASS: TestParseUXPPlugin/missing_manifest_falls_back_to_dir_name
--- PASS: TestParseUXPPlugin/manifest_with_id_but_no_name_uses_id
--- PASS: TestParseNativePlugin/* (5 subtests)
--- PASS: TestResolveHostApps/* (7 subtests)
--- PASS: TestScanEntry/* (2 subtests)
PASS
```

### 2. Cross-platform compilation

```
$ go build ./orbit/pkg/table/adobe_plugins/...                  # macOS ✅
$ GOOS=windows go build ./orbit/pkg/table/adobe_plugins/...     # Windows ✅
$ GOOS=linux go build ./orbit/pkg/table/adobe_plugins/...       # Linux stub ✅
$ go build ./orbit/cmd/fleetd_tables/                           # Full fleetd binary ✅
$ go vet ./orbit/pkg/table/adobe_plugins/...                    # Clean ✅
```

### 3. Manual end-to-end testing on macOS (osquery 5.23.0)

#### Setup

Built the fleetd extension binary, then installed two **real open-source
CEP extensions** from GitHub into the user-scoped scan path
(`~/Library/Application Support/Adobe/CEP/extensions/`):

1. **[adobe-discord-rpc](https://github.com/Kuredew/adobe-discord-rpc)**
— a real CEP extension targeting 11 Adobe apps. Has no `<Author>`
element (tests missing-vendor edge case). Complex manifest with many
host app codes.

2. **[cep-template](https://github.com/khanyuinc/cep-template)** — a CEP
starter template targeting After Effects only. Minimal manifest.

```bash
# Build extension
go build -o build/fleetd-tables-test ./orbit/cmd/fleetd_tables/

# Install real extensions
CEP_DIR="$HOME/Library/Application Support/Adobe/CEP/extensions"
mkdir -p "$CEP_DIR/adobe-discord-rpc/CSXS"
# downloaded CSXS/manifest.xml from GitHub into the directory
mkdir -p "$CEP_DIR/cep-template/CSXS"
# downloaded CSXS/manifest.xml from GitHub into the directory
```

#### Running the query

```bash
OSQUERYD="/opt/orbit/bin/osqueryd/macos-app/stable/osquery.app/Contents/MacOS/osqueryd"
$OSQUERYD -S --allow_unsafe --extensions_timeout=10 \
  --extensions_require=com.fleetdm.fleetd_tables.osquery_extension.v1 \
  --extension build/fleetd-tables-test \
  --json "SELECT * FROM adobe_plugins;"
```

#### Actual output (verbatim)

```json
[
  {
    "bundle_id": "com.kureichi.discordrpc",
    "extension_type": "CEP",
    "host_application": "After Effects, Photoshop, Premiere Pro, InCopy, Audition, Dreamweaver, Animate, InDesign, Illustrator, Prelude",
    "name": "adobe-discord-rpc",
    "path": "/Users/sharonkatz/Library/Application Support/Adobe/CEP/extensions/adobe-discord-rpc",
    "platform": "darwin",
    "scan_level": "",
    "user": "sharonkatz",
    "vendor": "",
    "version": "3.1.1"
  },
  {
    "bundle_id": "com.yourcompany",
    "extension_type": "CEP",
    "host_application": "After Effects",
    "name": "cep-template",
    "path": "/Users/sharonkatz/Library/Application Support/Adobe/CEP/extensions/cep-template",
    "platform": "darwin",
    "scan_level": "",
    "user": "sharonkatz",
    "vendor": "",
    "version": "1.0"
  }
]
```

#### osqueryi table output

```
+-------------------+---------+-------------------------+----------------------------------------------------------------------------------------------------------------+----------------+------------+
| name              | version | bundle_id               | host_application                                                                                               | extension_type | user       |
+-------------------+---------+-------------------------+----------------------------------------------------------------------------------------------------------------+----------------+------------+
| adobe-discord-rpc | 3.1.1   | com.kureichi.discordrpc | After Effects, Photoshop, Premiere Pro, InCopy, Audition, Dreamweaver, Animate, InDesign, Illustrator, Prelude | CEP            | sharonkatz |
| cep-template      | 1.0     | com.yourcompany         | After Effects                                                                                                  | CEP            | sharonkatz |
+-------------------+---------+-------------------------+----------------------------------------------------------------------------------------------------------------+----------------+------------+
```

#### What this verified

| Scenario | Result |
| --- | --- |
| Real CEP manifest with 11 host apps | ✅ All codes resolved (AEFT→After
Effects, PHSP/PHXS→Photoshop, PPRO→Premiere Pro, etc.) |
| Missing `<Author>` element | ✅ `vendor` is empty string, no crash |
| Minimal CEP manifest (single host) | ✅ `host_application=After
Effects`, version/bundle_id correct |
| User-scoped detection | ✅ `user=sharonkatz` populated |
| Schema registration | ✅ `.schema adobe_plugins` shows all 10 columns |
| No Adobe installed + no plugins | ✅ 0 rows, no error |
| Deep scan with no app bundles | ✅ 0 extra rows, no error |

### Windows

Not tested yet — Windows paths are implemented and cross-compile, but
need manual verification on a Windows host with Adobe CC.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

## Release Notes

* **New Features**
  * Added Adobe plugins osquery table for macOS and Windows platforms
  * Discovers and catalogs Adobe CEP, UXP, and native plugins
* Extracts plugin metadata including version, vendor, host applications,
and installation paths
  * Supports configurable scan depth for comprehensive plugin discovery

<!-- review_stack_entry_start -->

[![Review Change
Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/fleetdm/fleet/pull/45208)

<!-- review_stack_entry_end -->
<!-- end of auto-generated comment: release notes by coderabbit.ai -->
2026-05-14 14:46:48 -04:00
..
account_policy_data.yml
Update account_policy_data.yml (#22684)
2024-10-07 11:05:17 -05:00
acpi_tables.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
ad_config.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
adobe_plugins.yml
Add adobe_plugins osquery extension table (#45208)
2026-05-14 14:46:48 -04:00
alf_exceptions.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
alf_explicit_auths.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
alf.yml
Update alf.yml (#27416)
2025-03-21 18:41:44 -05:00
apfs_physical_stores.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
apfs_volumes.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
app_icons.yml
…
app_schemes.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
app_sso_platform.yml
Additions and fixes for app_sso_platform table (#41048)
2026-03-06 08:07:20 -08:00
apps.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
apt_sources.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
arp_cache.yml
Update arp_cache.yml (#19406)
2024-06-03 10:40:23 -04:00
asl.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
augeas.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
authdb.yml
Update authdb.yml (#19477)
2024-06-04 11:27:15 -04:00
authorization_mechanisms.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
authorizations.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
authorized_keys.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
azure_instance_metadata.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
azure_instance_tags.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
battery.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
bitlocker_info.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
bitlocker_key_protectors.yml
Add ability to determine Bitlocker protectors (#31090)
2025-07-24 18:30:55 -04:00
block_devices.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
browser_plugins.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
carbon_black_info.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
certificates.yml
Remove note about using the certificates table sparingly (#23700)
2024-11-12 12:06:12 -06:00
chrome_extension_content_scripts.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
chrome_extensions.yml
Changed CROSS JOIN to INNER JOIN to fix syntax error (#30851)
2025-07-16 09:00:29 -05:00
cis_audit.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
codesign.yml
Add missing schema change for codesign table (#29920)
2025-06-11 15:04:15 -03:00
containerd_containers.yml
Add containerd_containers table to fleetd (#29384)
2025-05-27 10:55:38 -07:00
containerd_mounts.yml
Add containerd_mounts table for fleetd (#39276)
2026-02-10 13:57:13 -03:00
corestorage_logical_volume_families.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
corestorage_logical_volumes.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
cpu_info.yml
Create cpu_info.yml (#19435)
2024-06-03 21:17:14 -04:00
cpu_time.yml
Update cpu_time.yml (#19432)
2024-06-03 17:05:48 -04:00
cpuid.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
crashes.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
crontab.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
crowdstrike_falcon.yml
Preview of v4.77.0 doc changes (#35924)
2025-12-02 17:24:15 -06:00
cryptoinfo.yml
Update cryptoinfo.yml (#21762)
2024-09-03 12:24:24 -05:00
cryptsetup_luks_salt.yml
Re-verify Linux disk encryption #26693 (#29034)
2025-05-22 16:15:26 -04:00
cryptsetup_status.yml
…
csrutil_info.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
cups_destinations.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
cups_jobs.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
curl_certificate.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
curl.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
dconf_read.yml
Added dconf_read table and documentation to enable fleet desktop on Fedora and Debian (#27684)
2025-04-01 18:54:22 -03:00
deb_packages.yml
…
device_firmware.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
disk_encryption.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
disk_events.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
disk_info.yml
update docs about disk_info table (#28795)
2025-05-06 15:28:07 -05:00
disk_space.yml
Add disk_space fleetd table for accurate macOS disk space reporting (#41575)
2026-03-17 12:59:17 -03:00
dns_cache.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
dns_resolvers.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
docker_container_envs.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
docker_container_labels.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
docker_container_mounts.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
docker_container_networks.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
docker_container_ports.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
docker_containers.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
docker_images.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
docker_volumes.yml
…
dscl.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
etc_hosts.yml
Update etc_hosts.yml (#19640)
2024-06-11 11:44:07 -04:00
etc_services.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
event_taps.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
executable_hashes.yml
Add schema for executable_hashes (#38492)
2026-01-20 13:23:22 -03:00
falcon_kernel_check.yml
…
falconctl_options.yml
Update falconctl_options.yml (#18536)
2024-04-25 11:41:51 -04:00
file_contents.yml
Add yaml_to_json and file_contents tables to fleetd (#35297)
2025-11-12 09:33:18 -08:00
file_lines.yml
Add yaml_to_json and file_contents tables to fleetd (#35297)
2025-11-12 09:33:18 -08:00
file.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
filevault_prk.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
filevault_status.yml
…
filevault_users.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
find_cmd.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
firefox_addons.yml
Changed CROSS JOIN to INNER JOIN to fix syntax error (#30851)
2025-07-16 09:00:29 -05:00
firefox_preferences.yml
doc: firefox_preferences works on linux and windows (#23967)
2024-11-20 16:46:07 -06:00
firmware_eficheck_integrity_check.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
firmwarepasswd.yml
…
fleed_logs.yml
fleetd_logs table (#19489)
2024-06-11 11:02:50 -04:00
fleetd_pacman_packages.yml
Add fleetd_pacman_packages table for arch linux (#33139)
2025-09-19 10:26:23 -04:00
gatekeeper.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
geolocation.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
go_binaries.yml
Add go_binaries table (#39877)
2026-03-16 13:27:00 -05:00
google_chrome_profiles.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
groups.yml
Update groups.yml (#23828)
2024-11-15 14:25:32 -05:00
hash.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
homebrew_packages.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
icloud_private_relay.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
ie_extensions.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
interface_addresses.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
interface_details.yml
…
interface_ipv6.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
iokit_devicetree.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
iokit_registry.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
ioreg.yml
Update ioreg.yml (#25889)
2025-01-30 12:42:04 -05:00
iptables.yml
Schema: show iptables table documentation (#21956)
2024-09-10 14:30:30 -05:00
kernel_extensions.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
kernel_info.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
kernel_panics.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
keychain_acls.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
keychain_items.yml
Clean up "click here" and "here" link anchors - part 1 (#29731)
2025-06-04 13:54:34 -06:00
known_hosts.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
last.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
launchd.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
listening_ports.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
load_average.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
local_network_permissions.yml
Add wifi_network and local_network_permissions tables to fleetd (#40652)
2026-02-27 11:49:41 -08:00
location_services.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
logged_in_users.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
lsblk.yml
Re-verify Linux disk encryption #26693 (#29034)
2025-05-22 16:15:26 -04:00
macadmins_unified_log.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
macadmins_wifi_network.yml
Update and rename wifi_network.yml to macadmins_wifi_network.yml (#42091)
2026-03-20 10:08:19 -04:00
macos_profiles.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
macos_rsr.yml
Schema: fix example queries (#19426)
2024-05-31 15:42:06 -05:00
macos_soc_power.yml
Fix copy/paste on schema (#42643)
2026-03-30 10:23:37 -03:00
macos_thermal_pressure.yml
Fix copy/paste on schema (#42643)
2026-03-30 10:23:37 -03:00
macos_user_profiles.yml
DCLK: add mechanism to verify user-scoped profiles (#30110)
2025-06-25 09:51:43 -04:00
managed_policies.yml
managed_policies table docs (#28650)
2025-04-30 17:44:14 -04:00
mcp_listening_servers.yml
Refactor notes section in mcp_listening_servers.yml (#39638)
2026-02-23 14:25:27 -06:00
mdls.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
mdm_bridge.yml
mdm_bridge is only supported for device-scoped commands (#38015)
2026-01-26 15:58:01 -06:00
mdm.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
mounts.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
munki_info.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
munki_installs.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
network_interfaces.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
network_quality.yml
Bump macadmins/osquery-extension to v1.4.1 and add network_quality ta… (#44214)
2026-04-27 14:52:27 -03:00
nfs_shares.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
nftables.yml
Add docs for the nftables fleetd table (#24749)
2024-12-13 21:34:24 -03:00
npm_packages.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
ntdomains.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
nvram_info.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
nvram.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
orbit_info.yml
Add update_url column to orbit_info (#25532)
2025-01-17 11:52:21 -03:00
os_version.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
osquery_events.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
osquery_extensions.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
osquery_flags.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
osquery_info.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
osquery_packs.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
osquery_registry.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
osquery_schedule.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
package_bom.yml
Update package_bom.yml (#19634)
2024-06-11 11:13:23 -04:00
package_install_history.yml
Update package_install_history.yml (#19635)
2024-06-11 11:56:22 -04:00
package_receipts.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
parse_ini.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
parse_json.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
parse_jsonl.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
parse_xml.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
password_policy.yml
Schema: fix example queries (#19426)
2024-05-31 15:42:06 -05:00
patches.yml
Create patches.yml (#19700)
2024-06-13 19:29:37 -04:00
pci_devices.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
pipes.yml
Update pipes.yml (#19685)
2024-06-12 15:03:16 -04:00
platform_info.yml
Update platform_info.yml (#19637)
2024-06-11 11:30:43 -04:00
plist.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
pmset.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
power_sensors.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
preferences.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
privacy_preferences.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
process_envs.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
process_events.yml
…
process_file_events.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
process_memory_map.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
process_open_files.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
process_open_sockets.yml
Update process_open_sockets.yml (#23033)
2024-10-22 12:41:33 -05:00
processes.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
programs.yml
Update programs.yml (#19742)
2024-06-13 20:50:07 -04:00
puppet_info.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
puppet_logs.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
puppet_state.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
pwd_policy.yml
Update pwd_policy table docs (#33181)
2025-09-24 17:32:54 -05:00
python_packages.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
registry.yml
Create registry.yml (#19711)
2024-06-12 21:11:38 -04:00
routes.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
rpm_packages.yml
…
running_apps.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
safari_extensions.yml
Add FDA requirement + links to safari_extensions.yml (#33069)
2025-09-17 12:48:58 -04:00
santa_allowed.yml
Documentation v4.76.0 (#34943)
2025-11-11 09:30:14 -05:00
santa_denied.yml
Documentation v4.76.0 (#34943)
2025-11-11 09:30:14 -05:00
santa_status.yml
Update fleetdm.com/tables: Fix santa_status columns (#37477)
2025-12-22 09:33:40 -05:00
scheduled_tasks.yml
Create scheduled_tasks.yml (#19739)
2024-06-13 23:01:05 -04:00
screenlock.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
secureboot.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
shared_folders.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
shared_resources.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
sharing_preferences.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
shell_history.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
shimcache.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
signature.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
sip_config.yml
Update sip_config.yml (#19747)
2024-06-14 17:34:02 -04:00
smbios_tables.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
smc_keys.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
sntp_request.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
sofa_security_release_info.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
sofa_unpatched_cves.yml
Add attribution for Mac Admins tables (#19302)
2024-05-28 12:59:35 -04:00
software_update.yml
Update software_update.yml (#19714)
2024-06-13 19:46:41 -04:00
ssh_configs.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
startup_items.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
sudo_info.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
sudoers.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
suid_bin.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
system_controls.yml
Update system_controls.yml (#19478)
2024-06-04 11:26:52 -04:00
system_extensions.yml
Update system_extensions.yml (#25917)
2025-02-03 10:22:50 -05:00
system_info.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
system_profiler.yml
Refine system_profiler table examples and description (#34053)
2025-10-10 15:56:49 -04:00
system_state.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
tcc_access.yml
Design for TCC access fleetd table (#19719)
2024-06-20 11:53:15 -05:00
temperature_sensors.yml
Schema: fix example queries (#19426)
2024-05-31 15:42:06 -05:00
time_machine_backups.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
time_machine_destinations.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
time.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
ulimit_info.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
uptime.yml
Schema: fix example queries (#19426)
2024-05-31 15:42:06 -05:00
usb_devices.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
user_login_settings.yml
Use "Fleet's agent (fleetd)" naming in the docs (#18138)
2024-04-29 11:12:03 -05:00
user_ssh_keys.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
userassist.yml
Update tables schema with note about using "count" (#36636)
2025-12-10 12:11:47 -07:00
users.yml
Table docs: Less confusing parentheses + update DRIs (#40105)
2026-02-20 09:04:54 +00:00
virtual_memory_info.yml
Schema: fix example queries (#19426)
2024-05-31 15:42:06 -05:00
vscode_extensions.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
wifi_networks.yml
Add SQL query for last connected times in wifi_networks (#37919)
2026-02-04 17:40:34 -06:00
wifi_status.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
wifi_survey.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
windows_eventlog.yml
Update windows_eventlog.yml (#24711)
2024-12-12 15:31:32 -06:00
windows_firewall_rules.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
windows_optional_features.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
windows_updates.yml
windows_updates doc update (#19899)
2024-06-20 10:18:39 -05:00
xprotect_entries.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
xprotect_meta.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
xprotect_reports.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00
yaml_to_json.yml
Add example query (#39496)
2026-02-09 14:54:21 -05:00
yara_events.yml
Update tables schema with note about using "count" (#36636)
2025-12-10 12:11:47 -07:00
yum_sources.yml
Schema: change default block scalar used in schema override files (#19296)
2024-05-27 18:18:56 -05:00