osquery-1/specs/darwin/extended_attributes.table

table_name("extended_attributes")
description("Get the extended attributes for files (similar to Windows ADS)")
schema([
    Column("path", TEXT, "Absolute file path", required=True),
    Column("directory", TEXT, "Directory of file(s)", required=True),
    Column("key", TEXT, "Name of the value generated from the extended attribute"),
    Column("value", TEXT, "The parsed information from the attribute"),
    Column("base64", INTEGER, "1 if the value is base64 encoded else 0"),
])
implementation("extended_attributes@genXattr")
Better extended attributes For the second time in a couple of weeks, I've rewritten the xattr table into a new extended_attributes table. If we find an attribute that we don't have a parser for, we will check if it contains non printable characters. If it does, we'll base64 it. If it doesn't, we will just output the unencoded string. 2015-04-09 00:41:54 +00:00			`table_name("extended_attributes")`
			`description("Get the extended attributes for files (similar to Windows ADS)")`
			`schema([`
			`Column("path", TEXT, "Absolute file path", required=True),`
			`Column("directory", TEXT, "Directory of file(s)", required=True),`
			`Column("key", TEXT, "Name of the value generated from the extended attribute"),`
			`Column("value", TEXT, "The parsed information from the attribute"),`
Various fixes, checks 2015-04-11 22:57:12 +00:00			`Column("base64", INTEGER, "1 if the value is base64 encoded else 0"),`
Better extended attributes For the second time in a couple of weeks, I've rewritten the xattr table into a new extended_attributes table. If we find an attribute that we don't have a parser for, we will check if it contains non printable characters. If it does, we'll base64 it. If it doesn't, we will just output the unencoded string. 2015-04-09 00:41:54 +00:00			`])`
			`implementation("extended_attributes@genXattr")`