fleet/schema/tables/authorized_keys.yml
Rachael Shaw 55df14a23e
Update schema overrides to clarify which tables require joining against users (#18045)
For #16784.

These tables require joining against `users`:
+ `chrome_extension_content_scripts`
+ `chrome_extensions`
+ `firefox_addons`
+ `vscode_extensions`
+ `browser_plugins`
+ `crashes`
+ `preferences`
+ `safari_extensions`
+ `ssh_configs`
+ `user_ssh_keys`
+ `authorized_keys`
+ `known_hosts`
+ `shell_history`

---------

Co-authored-by: Eric <eashaw@sailsjs.com>
2024-04-05 11:11:18 -05:00

13 lines
353 B
YAML

name: authorized_keys
examples: >-
```
SELECT * FROM users CROSS JOIN authorized_keys USING (uid);
```
columns:
- name: pid_with_namespace
platforms:
- linux
- name: uid
notes: Querying this table requires joining against the `users` table. [Learn more](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)