fleet/schema/tables/keychain_items.yml
Eric e82962e4a7
Add Fleet override schema files (#8278)
* create schema/tables, add yaml schema tables

* Update osquery-table-details.ejs

* Generate schema from schema/tables/ folder

* Create generate-yaml-tables-from-json.js

* update created table files

* update fleet override validation

* update error messages, add fleetRepoUrl

* Delete generate-yaml-tables-from-json.js

* Update osquery-table-details.ejs

* Update whitespace in table examples

* Revert "Update osquery-table-details.ejs"

This reverts commit 2e9d63208f59997d492375ebaf1d0ec7e4afe468.

* add YAML tables generated from updated Fleet schema

* lint fixes

* update arp_cache and docker_containers tables
2022-10-18 14:13:42 -05:00

14 lines
324 B
YAML

name: keychain_items
columns:
- name: created
description: Date item was created
examples: >-
Identify Macs that contain certificates related to Apple application signing
and notarization. (replace with your Apple Developer ID string)
```
SELECT * FROM keychain_items WHERE label LIKE '%8EHZ83LZNU%';
```