mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-07 09:58:54 +00:00
c2be670806
1. Table implementations (spec files) can mark the table as 'cachable'. 2. Cached results depend on the shortest/quickest interval of scheduled queries that act on results of the table. 3. The table API generator blocks caching on index/additional/required table column options.
15 lines
746 B
Plaintext
15 lines
746 B
Plaintext
table_name("keychain_acls")
|
|
description("Applications that have ACL entries in the keychain.")
|
|
schema([
|
|
Column("keychain_path", TEXT, "The path of the keychain"),
|
|
Column("authorizations", TEXT, "A space delimited set of authorization attributes"),
|
|
Column("path", TEXT, "The path of the authorized application"),
|
|
Column("description", TEXT, "The description included with the ACL entry"),
|
|
Column("label", TEXT, "An optional label tag that may be included with the keychain entry"),
|
|
])
|
|
attributes(cachable=True)
|
|
implementation("keychain_acl@genKeychainACLApps")
|
|
examples([
|
|
"select label, description, authorizations, path, count(path) as c from keychain_acls where label != '' and path != '' group by label having c > 1;",
|
|
])
|