osquery-1/specs/darwin/plist.table
2020-01-02 11:48:46 +01:00

14 lines
503 B
Plaintext

table_name("plist")
description("Read and parse a plist file.")
schema([
Column("key", TEXT, "Preference top-level key"),
Column("subkey", TEXT, "Intermediate key path, includes lists/dicts"),
Column("value", TEXT, "String value of most CF types"),
Column("path", TEXT, "(required) read preferences from a plist",
required=True),
])
implementation("system/darwin/preferences@genOSXPlist")
examples([
"select * from plist where path = '/Library/Preferences/loginwindow.plist'"
])