fleet/schema/tables/xprotect_reports.yml
2023-06-28 11:33:06 -07:00

13 lines
440 B
YAML

name: xprotect_reports
examples: >-
See all Xprotect activity reports, if any are present. This indicates
potentially malicious software was blocked by Xprotect.
```
SELECT * FROM xprotect_reports;
```
notes: |
- In [very specific circumstances](https://github.com/osquery/osquery/issues/6588#issuecomment-1410934706) this table will return empty because xprotect will detect and remediate without generating an eicar file.