osquery-1/specs/shell_history.table

11 lines
450 B
Plaintext

table_name("shell_history")
description("A line-delimited (command) table of per-user .*_history data.")
schema([
Column("uid", BIGINT, "Shell history owner", additional=True),
Column("command", TEXT, "Unparsed date/line/command history line"),
Column("history_file", TEXT, "Path to the .*_history for this user"),
ForeignKey(column="uid", table="users"),
])
attributes(user_data=True)
implementation("shell_history@genShellHistory")