osquery-1/specs/darwin/xprotect_reports.table
Teddy Reed a105924804 Move specs to a top-level path, add query examples
1. Example queries will run with an (optional) integration test.
2. Fix bad accesses with OS X package BOMs
3. Move spec files from ./osquery/tables/specs to ./specs
4. Remove server parsers (netlib) from client builds.
2015-06-03 10:39:05 -07:00

9 lines
364 B
Plaintext

table_name("xprotect_reports")
description("Database of XProtect matches (if user generated/sent an XProtect report).")
schema([
Column("name", TEXT, "Description of XProtected malware"),
Column("user_action", TEXT, "Action taken by user after prompted"),
Column("time", TEXT, "Quarantine alert time"),
])
implementation("xprotect@genXProtectReports")