fleet/schema/tables/user_ssh_keys.yml

name: user_ssh_keys
examples: |-
  ```
  SELECT * FROM users CROSS JOIN user_ssh_keys USING (uid);
  ```

  Identify SSH keys stored in clear text in user directories
  
  ```
  SELECT * FROM users JOIN user_ssh_keys USING (uid) WHERE encrypted = 0;
  ```
columns:
  - name: pid_with_namespace
    platforms:
      - linux
  - name: uid
notes: Querying this table requires joining against the `users` table. [Learn more](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)
Add Fleet override schema files (#8278) * create schema/tables, add yaml schema tables * Update osquery-table-details.ejs * Generate schema from schema/tables/ folder * Create generate-yaml-tables-from-json.js * update created table files * update fleet override validation * update error messages, add fleetRepoUrl * Delete generate-yaml-tables-from-json.js * Update osquery-table-details.ejs * Update whitespace in table examples * Revert "Update osquery-table-details.ejs" This reverts commit 2e9d63208f59997d492375ebaf1d0ec7e4afe468. * add YAML tables generated from updated Fleet schema * lint fixes * update arp_cache and docker_containers tables 2022-10-18 19:13:42 +00:00			`name: user_ssh_keys`
Schema: change default block scalar used in schema override files (#19296) Closes: #19271 Closes: #19286 Changes: - Updated the example in the schema folder readme - Updated the block scalar used in Fleet's osquery override documentation (`>-` » `\|-`) and removed extra newlines - Updated the block scalar used in URLs used to create new yaml override files - Regenerated osqeury_fleet_schema.json 2024-05-27 23:18:56 +00:00			`examples: \|-`
Update schema overrides to clarify which tables require joining against users (#18045) For #16784. These tables require joining against `users`: + `chrome_extension_content_scripts` + `chrome_extensions` + `firefox_addons` + `vscode_extensions` + `browser_plugins` + `crashes` + `preferences` + `safari_extensions` + `ssh_configs` + `user_ssh_keys` + `authorized_keys` + `known_hosts` + `shell_history` --------- Co-authored-by: Eric <eashaw@sailsjs.com> 2024-04-05 16:11:18 +00:00			```
			`SELECT * FROM users CROSS JOIN user_ssh_keys USING (uid);`
			```

Add Fleet override schema files (#8278) * create schema/tables, add yaml schema tables * Update osquery-table-details.ejs * Generate schema from schema/tables/ folder * Create generate-yaml-tables-from-json.js * update created table files * update fleet override validation * update error messages, add fleetRepoUrl * Delete generate-yaml-tables-from-json.js * Update osquery-table-details.ejs * Update whitespace in table examples * Revert "Update osquery-table-details.ejs" This reverts commit 2e9d63208f59997d492375ebaf1d0ec7e4afe468. * add YAML tables generated from updated Fleet schema * lint fixes * update arp_cache and docker_containers tables 2022-10-18 19:13:42 +00:00			`Identify SSH keys stored in clear text in user directories`

			```
Fix typo in example query (#15097) Fix typo in example query for user_ssh_keys table 2023-11-10 21:11:30 +00:00			`SELECT * FROM users JOIN user_ssh_keys USING (uid) WHERE encrypted = 0;`
Add Fleet override schema files (#8278) * create schema/tables, add yaml schema tables * Update osquery-table-details.ejs * Generate schema from schema/tables/ folder * Create generate-yaml-tables-from-json.js * update created table files * update fleet override validation * update error messages, add fleetRepoUrl * Delete generate-yaml-tables-from-json.js * Update osquery-table-details.ejs * Update whitespace in table examples * Revert "Update osquery-table-details.ejs" This reverts commit 2e9d63208f59997d492375ebaf1d0ec7e4afe468. * add YAML tables generated from updated Fleet schema * lint fixes * update arp_cache and docker_containers tables 2022-10-18 19:13:42 +00:00			```
			`columns:`
			`- name: pid_with_namespace`
			`platforms:`
			`- linux`
			`- name: uid`
Update schema overrides to clarify which tables require joining against users (#18045) For #16784. These tables require joining against `users`: + `chrome_extension_content_scripts` + `chrome_extensions` + `firefox_addons` + `vscode_extensions` + `browser_plugins` + `crashes` + `preferences` + `safari_extensions` + `ssh_configs` + `user_ssh_keys` + `authorized_keys` + `known_hosts` + `shell_history` --------- Co-authored-by: Eric <eashaw@sailsjs.com> 2024-04-05 16:11:18 +00:00			notes: Querying this table requires joining against the `users` table. [Learn more](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)