mirror of
https://github.com/valitydev/osquery-1.git
synced 2024-11-08 02:18:53 +00:00
a105924804
1. Example queries will run with an (optional) integration test. 2. Fix bad accesses with OS X package BOMs 3. Move spec files from ./osquery/tables/specs to ./specs 4. Remove server parsers (netlib) from client builds.
17 lines
723 B
Plaintext
17 lines
723 B
Plaintext
table_name("package_receipts")
|
|
description("OS X package receipt details.")
|
|
schema([
|
|
Column("package_id", TEXT, "Package domain identifier"),
|
|
Column("package_filename", TEXT, "Filename of original .pkg file"),
|
|
Column("version", TEXT, "Installed package version"),
|
|
Column("location", TEXT, "Optional relative install path on volume"),
|
|
Column("install_time", INTEGER, "Timestamp of install time"),
|
|
Column("installer_name", TEXT, "Name of installer process"),
|
|
Column("path", TEXT, "Path of receipt plist",
|
|
index=True, additional=True),
|
|
])
|
|
implementation("packages@genPackageReceipts")
|
|
examples([
|
|
"select * from package_bom where path = '/var/db/receipts/com.apple.pkg.MobileDevice.bom'"
|
|
])
|