From 282af8244fa5ba47ee06ef770382fd5911ea7bf0 Mon Sep 17 00:00:00 2001 From: Mo Zhu Date: Wed, 21 Jun 2023 10:29:49 -0700 Subject: [PATCH] Update screenlock table doc to be more explicit about its limitations (#12432) Co-authored-by: Eric --- schema/tables/screenlock.yml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 schema/tables/screenlock.yml diff --git a/schema/tables/screenlock.yml b/schema/tables/screenlock.yml new file mode 100644 index 0000000000..73677b8004 --- /dev/null +++ b/schema/tables/screenlock.yml @@ -0,0 +1,7 @@ +name: screenlock +description: >- + macOS screenlock status +notes: >- + - Only fetches results for osquery's current logged-in user context. If osquery is running as root, this table will return no results. + + - The user must also have recently logged in in order to show the latest setting.