mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-07 18:08:53 +00:00
21 lines
860 B
Plaintext
21 lines
860 B
Plaintext
table_name("package_receipts", aliases=["packages"])
|
|
description("OS X package receipt details.")
|
|
schema([
|
|
Column("package_id", TEXT, "Package domain identifier", index=True),
|
|
Column("package_filename", TEXT, "Filename of original .pkg file",
|
|
index=True, hidden=True),
|
|
Column("version", TEXT, "Installed package version", index=True),
|
|
Column("location", TEXT, "Optional relative install path on volume"),
|
|
Column("install_time", DOUBLE, "Timestamp of install time"),
|
|
Column("installer_name", TEXT, "Name of installer process"),
|
|
Column("path", TEXT, "Path of receipt plist", additional=True),
|
|
])
|
|
implementation("packages@genPackageReceipts")
|
|
examples([
|
|
"select * from package_bom where path = '/var/db/receipts/com.apple.pkg.MobileDevice.bom'"
|
|
])
|
|
fuzz_paths([
|
|
"/private/var/db/receipts/",
|
|
"/Library/Receipts/",
|
|
])
|