osquery-1/specs/darwin/apps.table
seph a73ffad3bf tables: Add constraints and testing (#6105)
Co-Authored-By: Teddy Reed <teddy@casualhacking.io>
2019-12-12 20:45:15 -05:00

34 lines
1.7 KiB
Plaintext

table_name("apps")
description("OS X applications installed in known search paths (e.g., /Applications).")
schema([
Column("name", TEXT, "Name of the Name.app folder"),
Column("path", TEXT, "Absolute and full Name.app path", index=True),
Column("bundle_executable", TEXT,
"Info properties CFBundleExecutable label"),
Column("bundle_identifier", TEXT,
"Info properties CFBundleIdentifier label"),
Column("bundle_name", TEXT, "Info properties CFBundleName label"),
Column("bundle_short_version", TEXT,
"Info properties CFBundleShortVersionString label"),
Column("bundle_version", TEXT, "Info properties CFBundleVersion label"),
Column("bundle_package_type", TEXT,
"Info properties CFBundlePackageType label"),
Column("environment", TEXT, "Application-set environment variables"),
Column("element", TEXT, "Does the app identify as a background agent"),
Column("compiler", TEXT, "Info properties DTCompiler label"),
Column("development_region", TEXT,
"Info properties CFBundleDevelopmentRegion label"),
Column("display_name", TEXT, "Info properties CFBundleDisplayName label"),
Column("info_string", TEXT, "Info properties CFBundleGetInfoString label"),
Column("minimum_system_version", TEXT,
"Minimum version of OS X required for the app to run"),
Column("category", TEXT,
"The UTI that categorizes the app for the App Store"),
Column("applescript_enabled", TEXT,
"Info properties NSAppleScriptEnabled label"),
Column("copyright", TEXT, "Info properties NSHumanReadableCopyright label"),
Column("last_opened_time", DOUBLE, "The time that the app was last used"),
])
attributes(cacheable=True)
implementation("apps@genApps")