Closes: #18240
Changes:
- Updated the schema override files to use only one YAML block scalar
(`>-`)
- Updated the template yaml included in the link to create a new
override file in get-extended-osquery-schema helper to use the `>-`
block scalar
- regenerated osquery_fleet_schema.json
Changes:
- Deleted `schema/fleet_schema.json` (This file was previously used when
merging the osquery schema with Fleet's overrides before we switched to
using YAML override files).
- Updated the description of the `generate-merged-schema` script.
Changes:
- Updated the `build-static-content` script to remove support for the
`requires_user_context` column attribute
- Updated `get-extended-osquery-schema` to not set a
`requires_user_context` value in the merged schema json.
- Regenerated `schema/osquery_fleet_schema.json`
For #17577
# Checklist for submitter
If some of the following don't apply, delete the relevant line.
- [x] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [x] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [x] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux. (performed only on macOS)
Closes: #17883
Changes:
- Updated the `get-extended-osquery-schema` helper to set the `type`
values of columns of tables with Fleet overrides to be lowercase.
- Regenerated `osquery_fleet_schema.json`
Related to: https://github.com/fleetdm/fleet/issues/17861
Changes:
- Updated `get-extended-osquery-schema` helper to remove `examples`
values from the merged schema JSON if they are an empty array.
- regenerated `osqeury_fleet_schema.json`
Closes: https://github.com/fleetdm/fleet/issues/17188
Changes:
- Updated `get-extended-osquery-schema.js` to only include the last
example from the osquery schema if a table has an override file that
does not contain an `examples` value.
- Regenerated osquery_fleet_schema.json with the correct `examples`
values
Changes:
- Added a newline before the code block in the example of the
`vscode_extensions` table override to fix the formatting of the page
generated for this table (see screenshot)
- Ran the `generate-merged-schema` script to regenerate
`osquery_fleet_schema.json`
<img width="860" alt="image"
src="https://github.com/fleetdm/fleet/assets/7445991/1f6f1b37-1240-4d16-b102-f67ecff5fb28">
For https://github.com/fleetdm/fleet/issues/13891
Changes:
- Updated the version of the osquery schema used to generate
osqeury_fleet_schema.json (`5.9.1` » `5.11.0`)
- Removed the table override file for the `atom_packages` table (It was
removed from the osquery schema, our override file was previously hiding
the table)
- Ran the `generate-merged-schema` script to regenerate
osquery_fleet_schema.json
- To address the bug, we decided to document the current behavior: The
`process_file_events table` will only emit events for changes and files
in directories that existed before osquery starts.
- Add documentation for new tables so that they show up on fleetdm.com
and the sidebar in the Fleet UI
---------
Co-authored-by: Rachael Shaw <r@rachael.wtf>
Co-authored-by: Jack-Daniyel Strong <jack@jdstrong.com>
Co-authored-by: Eric <eashaw@sailsjs.com>
When running a live query recently, I noticed some columns in the
results that we didn't have documented, and realized we weren't using
the latest osquery schema version when regenerating the merged schema.
According to the docs, [we support the latest version of
osquery](https://fleetdm.com/docs/using-fleet/enroll-hosts#supported-osquery-versions),
so figure we ought to update the schema version to the latest.
---------
Co-authored-by: Eric <eashaw@sailsjs.com>
Related to: #14166
Changes:
- updated the override column descriptions for the `system_info` and
`chrome_extensions` tables to include the descriptions from the osquery
schema.
Closes: #13722
Changes:
- Updated the `get-extended-osquery-schema` helper to sort the merged
schema by table name.
- Regenerated `/schema/osquery_fleet_schema.JSON`
#10292, #12554
When scanning tens of thousands of files for permissions, using the
`find` command exposed as a fleetd table is more performant than trying
to use the `file` table. This change caused the watchdog to *stop*
killing osquery because of exceeding memory or CPU limit.
- [X] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- ~[ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)~
- ~[ ] Documented any permissions changes~
- ~[ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)~
- ~[ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.~
- [X] Added/updated tests
- [X] Manual QA for all new/changed functionality
- For Orbit and Fleet Desktop changes:
- [X] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- ~[ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).~
