fleet/schema/tables/certificates.yml

name: certificates
description: "[Certificate
  authorities](https://en.wikipedia.org/wiki/Certificate_authority) installed in
  Keychains/ca-bundles."
examples: >-
  Replace 1QAZ2WSX with your Apple Developer ID, if you have one. This query
  will then let you identify Macs that have a copy of your code signing and
  notarization certificates.

  ```

  SELECT * FROM certificates WHERE common_"name" LIKE '%%1QAZ2SWX%%';

  ```
columns:
  - name: sid
    platforms:
      - windows
  - name: store_location
    platforms:
      - windows
  - name: store
    platforms:
      - windows
  - name: username
    platforms:
      - windows
  - name: store_id
    platforms:
      - windows
  - name: issuer2
    platforms:
      - linux
      - darwin
  - name: subject2
    platforms:
      - linux
      - darwin
notes: >-
  - This table should be used sparingly as it uses an Apple API which occasionally corrupts the underlying certificate. Learn more [here](https://github.com/fleetdm/fleet/issues/13065#issuecomment-1658849614).
Add Fleet override schema files (#8278) * create schema/tables, add yaml schema tables * Update osquery-table-details.ejs * Generate schema from schema/tables/ folder * Create generate-yaml-tables-from-json.js * update created table files * update fleet override validation * update error messages, add fleetRepoUrl * Delete generate-yaml-tables-from-json.js * Update osquery-table-details.ejs * Update whitespace in table examples * Revert "Update osquery-table-details.ejs" This reverts commit 2e9d63208f59997d492375ebaf1d0ec7e4afe468. * add YAML tables generated from updated Fleet schema * lint fixes * update arp_cache and docker_containers tables 2022-10-18 19:13:42 +00:00			`name: certificates`
			`description: "[Certificate`
			`authorities](https://en.wikipedia.org/wiki/Certificate_authority) installed in`
			`Keychains/ca-bundles."`
			`examples: >-`
			`Replace 1QAZ2WSX with your Apple Developer ID, if you have one. This query`
			`will then let you identify Macs that have a copy of your code signing and`
			`notarization certificates.`

			```

			`SELECT * FROM certificates WHERE common_"name" LIKE '%%1QAZ2SWX%%';`

			```
			`columns:`
			`- name: sid`
			`platforms:`
			`- windows`
			`- name: store_location`
			`platforms:`
			`- windows`
			`- name: store`
			`platforms:`
			`- windows`
			`- name: username`
			`platforms:`
			`- windows`
			`- name: store_id`
			`platforms:`
			`- windows`
			`- name: issuer2`
			`platforms:`
			`- linux`
			`- darwin`
			`- name: subject2`
			`platforms:`
			`- linux`
			`- darwin`
Update certificates.yml to include warning about potential corruption… (#13976) Partially addresses #13065 2023-09-25 17:33:53 +00:00			`notes: >-`
			`- This table should be used sparingly as it uses an Apple API which occasionally corrupts the underlying certificate. Learn more [here](https://github.com/fleetdm/fleet/issues/13065#issuecomment-1658849614).`