fleet/schema/tables/xprotect_reports.yml
Eric 02437a098e
Schema: change default block scalar used in schema override files (#19296)
Closes: #19271
Closes: #19286

Changes:
- Updated the example in the schema folder readme
- Updated the block scalar used in Fleet's osquery override
documentation (`>-` » `|-`) and removed extra newlines
- Updated the block scalar used in URLs used to create new yaml override
files
- Regenerated osqeury_fleet_schema.json
2024-05-27 18:18:56 -05:00

10 lines
439 B
YAML

name: xprotect_reports
examples: |-
See all Xprotect activity reports, if any are present. This indicates
potentially malicious software was blocked by Xprotect.
```
SELECT * FROM xprotect_reports;
```
notes: |-
- In [very specific circumstances](https://github.com/osquery/osquery/issues/6588#issuecomment-1410934706) this table will return empty because xprotect will detect and remediate without generating an eicar file.