osquery-1/specs/darwin/event_taps.table
2019-10-28 20:27:06 -04:00

11 lines
554 B
Plaintext

table_name("event_taps")
description("Returns information about installed event taps.")
schema([
Column("enabled", INTEGER, "Is the Event Tap enabled"),
Column("event_tap_id", INTEGER, "Unique ID for the Tap"),
Column("event_tapped", TEXT, "The mask that identifies the set of events to be observed."),
Column("process_being_tapped", INTEGER, "The process ID of the target application"),
Column("tapping_process", INTEGER, "The process ID of the application that created the event tap."),
])
implementation("event_taps@genEventTaps")