mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-06 17:45:22 +00:00
411556b9a5
This is for consistency with the decisions taken for PR osquery/osquery#6413 and osquery/osquery#6414. We also update the integration test helper to accept custom constraints, in the case the table has required columns.
22 lines
896 B
Plaintext
22 lines
896 B
Plaintext
table_name("hash")
|
|
description("Filesystem hash data.")
|
|
schema([
|
|
Column("path", TEXT, "Must provide a path or directory", index=True, required=True),
|
|
Column("directory", TEXT, "Must provide a path or directory", required=True),
|
|
Column("md5", TEXT, "MD5 hash of provided filesystem data"),
|
|
Column("sha1", TEXT, "SHA1 hash of provided filesystem data"),
|
|
Column("sha256", TEXT, "SHA256 hash of provided filesystem data"),
|
|
])
|
|
extended_schema(POSIX, [
|
|
Column("ssdeep", TEXT, "ssdeep hash of provided filesystem data"),
|
|
])
|
|
extended_schema(LINUX, [
|
|
Column("pid_with_namespace", INTEGER, "Pids that contain a namespace", additional=True, hidden=True),
|
|
Column("mount_namespace_id", TEXT, "Mount namespace id", hidden=True),
|
|
])
|
|
implementation("hash@genHash")
|
|
examples([
|
|
"select * from hash where path = '/etc/passwd'",
|
|
"select * from hash where directory = '/etc/'",
|
|
])
|