From f5fbfc43a4c3e365999170940face0c8b79ac392 Mon Sep 17 00:00:00 2001
From: Brock Walters <153771548+nonpunctual@users.noreply.github.com>
Date: Tue, 16 Sep 2025 19:19:34 -0400
Subject: [PATCH] Create system_profiler.yml (#33084)

Updated explanation & example queries.

---------

Co-authored-by: Eric <eashaw@sailsjs.com>
---
 schema/tables/system_profiler.yml | 87 +++++++++++++++++++++++++++++++
 1 file changed, 87 insertions(+)
 create mode 100644 schema/tables/system_profiler.yml

diff --git a/schema/tables/system_profiler.yml b/schema/tables/system_profiler.yml
new file mode 100644
index 0000000000..4d52faf644
--- /dev/null
+++ b/schema/tables/system_profiler.yml
@@ -0,0 +1,87 @@
+name: system_profiler
+description: |-
+  The macOS system_profiler binary reports on the hardware and software configuration of a Mac. It can generate detailed, plain text, XML or json reports which can be exported from the Terminal or generated as .spx files and read by the macOS System Information.app based on "data types". 
+examples: |- 
+  
+  Collect Mac Activation Lock Status:
+
+  ```
+  SELECT json_extract (value,'$.activation_lock_status')
+  FROM system_profiler
+  WHERE data_type='SPHardwareDataType';
+  ```
+  
+  Collect Mac Hardware UUID (platform_uuid):
+
+  ```
+  SELECT json_extract (value,'$.platform_UUID')
+  FROM system_profiler
+  WHERE data_type='SPHardwareDataType';
+  ```
+  
+  Collect Mac Serial Number:
+
+  ```
+  SELECT json_extract (value,'$.serial_number')
+  FROM system_profiler
+  WHERE data_type='SPHardwareDataType';
+  ```
+  
+notes: |-
+
+  The system_profiler binary is a rich source of macOS data which can be used in many ways to enhance Mac management.
+  
+  Not all System Profiler data types are available via the system_profiler osquery table. Some data types are legacy & others are OS version-specific. 
+  
+  The following data types are available from the system_profiler binary as of macOS 26:
+  
+  - SPParallelATADataType
+  - SPUniversalAccessDataType
+  - SPSecureElementDataType
+  - SPApplicationsDataType
+  - SPAudioDataType
+  - SPBluetoothDataType
+  - SPCameraDataType
+  - SPCardReaderDataType
+  - SPiBridgeDataType
+  - SPDeveloperToolsDataType
+  - SPDiagnosticsDataType
+  - SPDisabledSoftwareDataType
+  - SPDiscBurningDataType
+  - SPEthernetDataType
+  - SPExtensionsDataType
+  - SPFibreChannelDataType
+  - SPFirewallDataType
+  - SPFontsDataType
+  - SPFrameworksDataType
+  - SPDisplaysDataType
+  - SPHardwareDataType
+  - SPInstallHistoryDataType
+  - SPInternationalDataType
+  - SPNetworkLocationDataType
+  - SPLogsDataType
+  - SPManagedClientDataType
+  - SPMemoryDataType
+  - SPNVMeDataType
+  - SPNetworkDataType
+  - SPPCIDataType
+  - SPParallelSCSIDataType
+  - SPPowerDataType
+  - SPPrefPaneDataType
+  - SPPrintersSoftwareDataType
+  - SPPrintersDataType
+  - SPConfigurationProfileDataType
+  - SPRawCameraDataType
+  - SPLegacySoftwareDataType
+  - SPSASDataType
+  - SPSerialATADataType
+  - SPSPIDataType
+  - SPSmartCardsDataType
+  - SPSoftwareDataType
+  - SPStartupItemDataType
+  - SPStorageDataType
+  - SPSyncServicesDataType
+  - SPThunderboltDataType
+  - SPUSBHostDataType
+  - SPNetworkVolumeDataType
+  - SPAirPortDataType