valitydev/osquery-1
14
0
Fork 0
mirror of https://github.com/valitydev/osquery-1.git synced 2024-11-07 09:58:54 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

[#2216] Add notice text for required table predicates (#2225)

Browse Source
This commit is contained in:
Peter 2016-07-08 12:33:37 -03:00 committed by Teddy Reed
parent 54557b16e7
commit 51f5fa9095
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/wiki/introduction/sql.md
View File

@ -12,6 +12,8 @@ The osquery SQL language is a superset of SQLite's, please read [SQL as understo
`SELECT` only! All mutation-based verbs exist, like `INSERT`, `UPDATE`, `DELETE`, and `ALTER` but they do not do anything-- except if you're fancy and creating run-time tables or `VIEW`s. ;)
> NOTICE: Several tables, `file` for example, require a predicate for one of the columns, and **will not work without it**. See [Tables with arguments](#tables-with-arguments) for more information.
Before diving into the osquery SQL customizations, please familiarize yourself with the osquery [development shell](../introduction/using-osqueryi.md). This shell is designed for ad-hoc exploration of your OS and SQL query prototyping. Then fire up `osqueryi` as your user or as a superuser and try some of the concepts below.
### Shell help
@ -123,7 +125,7 @@ We can expand upon this later using subqueries and more tables.
### Tables with arguments
Several tables, `file` for example, represent concepts that require arguments. Consider `SELECT * FROM file`, you do not want this to trigger a complete walk of the mounted file systems. It is an ambiguous concept without some sort of argument or input parameter. These tables, and their columns, are flagged in the [table documentation](https://osquery.io/docs/tables/) as requiring a column or as using a column to generate additional information.
Several tables, `file` for example, represent concepts that require arguments. Consider `SELECT * FROM file`, you do not want this to trigger a complete walk of the mounted file systems. It is an ambiguous concept without some sort of argument or input parameter. These tables, and their columns, are flagged by a *dropper icon* in the [table documentation](https://osquery.io/docs/tables/) as requiring a column or as using a column to generate additional information.
Let's exercise the `file` table:
```