mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-07 01:55:20 +00:00
a105924804
1. Example queries will run with an (optional) integration test. 2. Fix bad accesses with OS X package BOMs 3. Move spec files from ./osquery/tables/specs to ./specs 4. Remove server parsers (netlib) from client builds.
11 lines
534 B
Plaintext
11 lines
534 B
Plaintext
table_name("extended_attributes")
|
|
description("Get the extended attributes for files (similar to Windows ADS)")
|
|
schema([
|
|
Column("path", TEXT, "Absolute file path", required=True),
|
|
Column("directory", TEXT, "Directory of file(s)", required=True),
|
|
Column("key", TEXT, "Name of the value generated from the extended attribute"),
|
|
Column("value", TEXT, "The parsed information from the attribute"),
|
|
Column("base64", INTEGER, "1 if the value is base64 encoded else 0"),
|
|
])
|
|
implementation("extended_attributes@genXattr")
|