osquery-1/specs/users.table
2015-07-15 23:23:42 -07:00

19 lines
733 B
Plaintext

table_name("users")
description("Local system users.")
schema([
Column("uid", BIGINT, "User ID"),
Column("gid", BIGINT, "Group ID (unsigned)"),
Column("uid_signed", BIGINT, "User ID as int64 signed (Apple)"),
Column("gid_signed", BIGINT, "Default group ID as int64 signed (Apple)"),
Column("username", TEXT, "Username"),
Column("description", TEXT, "Optional user description"),
Column("directory", TEXT, "User's home directory"),
Column("shell", TEXT, "User's configured default shell"),
])
implementation("users@genUsers")
examples([
"select * from users where uid = 1000",
"select * from users where username = 'root'",
"select count(*) from users u, user_groups ug where u.uid = ug.uid",
])