fleet/schema/tables/preferences.yml
Rachael Shaw 55df14a23e
Update schema overrides to clarify which tables require joining against users (#18045)
For #16784.

These tables require joining against `users`:
+ `chrome_extension_content_scripts`
+ `chrome_extensions`
+ `firefox_addons`
+ `vscode_extensions`
+ `browser_plugins`
+ `crashes`
+ `preferences`
+ `safari_extensions`
+ `ssh_configs`
+ `user_ssh_keys`
+ `authorized_keys`
+ `known_hosts`
+ `shell_history`

---------

Co-authored-by: Eric <eashaw@sailsjs.com>
2024-04-05 11:11:18 -05:00

15 lines
462 B
YAML

name: preferences
examples: >-
This table reads a huge amount of preferences, including on third-party apps.
```
SELECT * FROM users CROSS JOIN preferences USING (username);
```
notes: >-
- Querying this table requires joining against the `users` table. [Learn more](https://fleetdm.com/guides/osquery-consider-joining-against-the-users-table)
- The `value` column will be empty for keys that contain binary data.
columns:
- name: username