Brief Auto Table Construction docs (#2249)

This commit is contained in:
William Theaker 2020-06-30 09:18:50 -07:00 committed by GitHub
parent 755f63f8c0
commit b5b43e7aa7
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23

View file

@ -231,6 +231,32 @@ spec:
interval:
3600: "SELECT total_seconds AS uptime FROM uptime"
```
### Auto Table Construction
You can use Kolide Fleet to query local SQLite databases as tables. For more information on creating ATC configuration from a SQLite database, see the [Osquery Automatic Table Construction documentation](https://osquery.readthedocs.io/en/stable/deployment/configuration/#automatic-table-construction)
If you already know what your ATC configuration needs to look like, you can add it to an options config file:
```yaml
apiVersion: v1
kind: options
spec:
overrides:
platforms:
darwin:
auto_table_construction:
tcc_system_entries:
query: "select service, client, allowed, prompt_count, last_modified from access"
path: "/Library/Application Support/com.apple.TCC/TCC.db"
columns:
- "service"
- "client"
- "allowed"
- "prompt_count"
- "last_modified"
```
## Fleet Configuration Options
The following file describes configuration options applied to the Fleet server.