From beb14842020682799674ec671bf8a00e35855d1d Mon Sep 17 00:00:00 2001 From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Date: Fri, 6 Dec 2024 14:19:29 -0500 Subject: [PATCH 1/7] API reference: run script w/ team_id and script_name --- docs/REST API/rest-api.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/REST API/rest-api.md b/docs/REST API/rest-api.md index d5acd7735269..774f418d4534 100644 --- a/docs/REST API/rest-api.md +++ b/docs/REST API/rest-api.md @@ -8698,10 +8698,12 @@ By default, script runs time out after 5 minutes. You can modify this default in | Name | Type | In | Description | | ---- | ------- | ---- | -------------------------------------------- | | host_id | integer | body | **Required**. The ID of the host to run the script on. | -| script_id | integer | body | The ID of the existing saved script to run. Only one of either `script_id` or `script_contents` can be included in the request; omit this parameter if using `script_contents`. | -| script_contents | string | body | The contents of the script to run. Only one of either `script_id` or `script_contents` can be included in the request; omit this parameter if using `script_id`. | +| script_id | integer | body | The ID of the existing saved script to run. Only one of either `script_id`, `script_contents`, or `script_name` can be included. | +| script_contents | string | body | The contents of the script to run. Only one of either `script_id`, `script_contents`, or `script_name` can be included. | +| script_name | integer | body | The name of the existing saved script to run. If specified, requires `team_id`. Only one of either `script_id`, `script_contents`, or `script_name` can be included. | +| team_id | integer | body | The ID of the existing saved script to run. If specified, requires `script_name`. Only one of either `script_id`, `script_contents`, or `script_name` can be included in the request. | -> Note that if both `script_id` and `script_contents` are included in the request, this endpoint will respond with an error. +> Note that if any combination of `script_id`, `script_contents`, and `script_name` are included in the request, this endpoint will respond with an error. #### Example From d9f4c2fb379e4421ed5107a31c4f14d417c2744d Mon Sep 17 00:00:00 2001 From: Noah Talerman Date: Mon, 9 Dec 2024 14:55:34 -0500 Subject: [PATCH 2/7] Same change for sync scripts --- docs/Contributing/API-for-contributors.md | 19 +++++++++---------- 1 file changed, 9 insertions(+), 10 deletions(-) diff --git a/docs/Contributing/API-for-contributors.md b/docs/Contributing/API-for-contributors.md index 5355dd4b4fe0..cb8a4e8bf7c5 100644 --- a/docs/Contributing/API-for-contributors.md +++ b/docs/Contributing/API-for-contributors.md @@ -3933,16 +3933,15 @@ Run a live script and get results back (5 minute timeout). Live scripts only run #### Parameters -| Name | Type | In | Description | -| ---- | ------- | ---- | -------------------------------------------- | -| host_id | integer | body | **Required**. The host ID to run the script on. | -| script_id | integer | body | The ID of the existing saved script to run. Only one of either `script_id`, `script_name` or `script_contents` can be included in the request; omit this parameter if using `script_contents` or `script_name`. | -| script_contents | string | body | The contents of the script to run. Only one of either `script_contents`, `script_id` or `script_name` can be included in the request; omit this parameter if using `script_id` or `script_name`. | -| script_name | string | body | The name of the existing saved script to run. Only one of either `script_name`, `script_id` or `script_contents` can be included in the request; omit this parameter if using `script_contents` or `script_id`. | -| team_id | integer | body | ID of the team the saved script referenced by `script_name` belongs to. Default: `0` (hosts assigned to "No team") | - - -> Note that if both `script_id` and `script_contents` are included in the request, this endpoint will respond with an error. +| Name | Type | In | Description | +| ---- | ------- | ---- | -------------------------------------------- | +| host_id | integer | body | **Required**. The ID of the host to run the script on. | +| script_id | integer | body | The ID of the existing saved script to run. Only one of either `script_id`, `script_contents`, or `script_name` can be included. | +| script_contents | string | body | The contents of the script to run. Only one of either `script_id`, `script_contents`, or `script_name` can be included. | +| script_name | integer | body | The name of the existing saved script to run. If specified, requires `team_id`. Only one of either `script_id`, `script_contents`, or `script_name` can be included. | +| team_id | integer | body | The ID of the existing saved script to run. If specified, requires `script_name`. Only one of either `script_id`, `script_contents`, or `script_name` can be included in the request. | + +> Note that if any combination of `script_id`, `script_contents`, and `script_name` are included in the request, this endpoint will respond with an error. #### Example From 7f67645be9a8f9584b02e331c53e32aef8c709cd Mon Sep 17 00:00:00 2001 From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Date: Tue, 17 Dec 2024 11:00:42 -0500 Subject: [PATCH 3/7] Agent configuration cleanup --- docs/Configuration/agent-configuration.md | 380 ++++++---------------- 1 file changed, 99 insertions(+), 281 deletions(-) diff --git a/docs/Configuration/agent-configuration.md b/docs/Configuration/agent-configuration.md index eb594e14c5d0..49449789bf32 100644 --- a/docs/Configuration/agent-configuration.md +++ b/docs/Configuration/agent-configuration.md @@ -1,47 +1,59 @@ # Agent configuration -Learn how to update the settings of the agent installed on all your hosts at once. In Fleet, we refer to these settings as **agent options**. +Agent configuration options (agent options) update the settings of Fleet's agent (fleed) installed on all your hosts. -## Overview +You can modify agent options in **Settings > Organization settings > Agent options** or via Fleet's [API](https://fleetdm.com/docs/rest-api/rest-api#modify-configuration) or [YAML](https://fleetdm.com/docs/configuration/yaml-files). -The `agent_options` key in the `config` YAML file controls the settings applied to the agent on all your hosts. These settings are applied when each host checks in and may be configured using the fleetctl command line tool or Fleet UI. +## config -See the [osquery documentation](https://osquery.readthedocs.io/en/stable/installation/cli-flags/#configuration-control-flags) for the available options. This document shows all examples in command line flag format. Remove the dashed lines (`--`) for Fleet to successfully update the setting. For example, use `distributed_interval` instead of `--distributed_interval`. +The `config` section allows you to update settings like performance and and how often the agent checks-in. -Agent options are validated using the latest version of osquery. +- `options` can include the agent settings listed under `osqueryOptions` [here](https://github.com/fleetdm/fleet/blob/main/server/fleet/agent_options_generated.go). These can be updated without a fleetd restart. +- `command_line_flags` can include the agent settings listed under osqueryCommandLineFlags [here](https://github.com/fleetdm/fleet/blob/main/server/fleet/agent_options_generated.go). These are only updated when fleetd restarts. +- `decorators` +- `yara` +- `auto_table_contructions` -When updating agent options, you may see an error similar to this: +### `options` and `command_line_flags` + +To see a description for all available settings, with your host enrolled to Fleet, run `sudo orbit shell` (or the equivalent on Windows) to open an interactive osquery shell. Then run the following osquery query: -```sh -[...] unsupported key provided: "logger_plugin" -If you’re not using the latest osquery, use the fleetctl apply --force command to override validation. +``` +osquery > SELECT name, value, description FROM osquery; ``` -This error indicates that you're providing a config option that isn't valid in the current version of osquery, typically because you're setting a command line flag through the configuration key. This has always been unsupported through the config plugin, but osquery has recently become more opinionated and Fleet now validates the configuration to make sure there aren't errors in the osquery agent. +You can also use this query to verify that settings have taken effect on the hosts. -If you are not using the latest version of osquery, you can create a config YAML file and apply it with `fleetctl` using the `--force` flag to override the validation: +`options` and `command_line_flags` are validated using the latest version of osquery. If you are not using the latest version of osquery, you can create a YAML file and apply it with `fleetctl apply --force` command to override the validation: ```sh fleetctl apply --force -f config.yaml ``` -You can verify that your agent options are valid by using [the `fleetctl apply` command](https://fleetdm.com/docs/using-fleet/fleetctl-cli) with the `--dry-run` flag. This will report any error and do nothing if the configuration was valid. If you don't use the latest version of osquery, you can override validation using the `--force` flag. This will update agent options even if they are invalid. +> If you revoked an old enroll secret, this feature won't update for hosts that enrolled to Fleet using this old enroll secret. This is because fleetd uses the enroll secret to receive new flags from Fleet. For these hosts, all existing features will work as expected. + +How to rotate enroll secrets: + +1. Check which hosts need a new enroll secret by running the following query: `SELECT * FROM orbit_info WHERE enrolled = false`. + +> The hosts that don't have Fleetd installed will return an error because the `orbit_info` table doesn't exist. You can safely ignore these errors. -Existing options will be overwritten by the application of this file. +2. In Fleet, head to the Hosts page and select **Add hosts** to find the fleetctl package command with an active enroll secret. -### Example Agent options YAML +3. Copy and run the fleetctl package command to create a new package. Distribute this package to the hosts that returned results in step 1. + +4. Done! + +### decorators + +In the `decorators` key, you can specify queries to include additional information in your osquery results logs. + +Use `load` for details you want to update values when the configuration loads, `always` to update every time a scheduled query is run, and `interval` if you want to update on a schedule. ```yaml -apiVersion: v1 -kind: config -spec: - agent_options: +agent_options: config: - options: - distributed_interval: 3 - distributed_tls_max_attempts: 3 - logger_tls_endpoint: /api/osquery/log - logger_tls_period: 10 + options: ~ decorators: load: - "SELECT version FROM osquery_info" @@ -50,128 +62,81 @@ spec: - "SELECT user AS username FROM logged_in_users WHERE user <> '' ORDER BY time LIMIT 1" interval: 3600: "SELECT total_seconds AS uptime FROM uptime" - overrides: - # Note configs in overrides take precedence over the default config defined - # under the config key above. Be aware that these overrides are NOT merged - # with the top-level configuration!! This means that settings values defined - # on the top-level config.options section will not be propagated to the platform - # override sections. So for example, the config.options.distributed_interval value - # will be discarded on a platform override section, and only the section value - # for distributed_interval will be used. If the given setting is not specified - # in the override section, its default value will be enforced. - # Going back to the example, if the override section is windows, - # overrides.platforms.windows.distributed_interval will have to be set again to 5 - # for this setting to be enforced as expected, otherwise the setting will get - # its default value (60 in the case of distributed_interval). - # Hosts receive overrides based on the platform returned by `SELECT platform FROM os_version`. - # In this example, the base config would be used for Windows and CentOS hosts, - # while Mac and Ubuntu hosts would receive their respective overrides. - platforms: - darwin: - options: - distributed_interval: 10 - distributed_tls_max_attempts: 10 - logger_tls_endpoint: /api/osquery/log - logger_tls_period: 300 - docker_socket: /var/run/docker.sock - file_paths: - users: - - /Users/%/Library/%% - - /Users/%/Documents/%% - etc: - - /etc/%% - - ubuntu: - options: - distributed_interval: 10 - distributed_tls_max_attempts: 3 - logger_tls_endpoint: /api/osquery/log - logger_tls_period: 60 - schedule_timeout: 60 - docker_socket: /etc/run/docker.sock - file_paths: - homes: - - /root/.ssh/%% - - /home/%/.ssh/%% - etc: - - /etc/%% - tmp: - - /tmp/%% - exclude_paths: - homes: - - /home/not_to_monitor/.ssh/%% - tmp: - - /tmp/too_many_events/ - decorators: - load: - - "SELECT * FROM cpuid" - - "SELECT * FROM docker_info" - interval: - 3600: "SELECT total_seconds AS uptime FROM uptime" - host_expiry_settings: - # ... ``` -## Command line flags - -> This feature requires [Fleetd, the Fleet agent manager](https://fleetdm.com/announcements/introducing-orbit-your-fleet-agent-manager). +### yara -The `command_line_flags` key inside of `agent_options` allows you to remotely manage the osquery command line flags. These command line flags are options that typically require osquery to restart for them to take effect. But with Fleetd, you can use the `command_line_flags` key to take care of that. Fleetd will write these to the flagfile on the host and pass it to osquery. - -To see the full list of these osquery command line flags, please run `osquery` with the `--help` switch. - -> YAML `command_line_flags` are not additive and will replace any osquery command line flags in the CLI. - -Just like the other `agent_options` above, remove the dashed lines (`--`) for Fleet to successfully update them. +You can use Fleet to configure the `yara` and `yara_events` osquery tables. Fore more information on YARA configuration and continuous monitoring using the `yara_events` table, check out the [YARA-based scanning with osquery section](https://osquery.readthedocs.io/en/stable/deployment/yara/) of the osquery documentation. -Here is an example of using the `command_line_flags` key: +The following is an example Fleet configuration file with YARA configuration. The values are taken from an example config supplied in the above link to the osquery documentation. ```yaml agent_options: - command_line_flags: # requires Fleet's agent (fleetd) - verbose: true - disable_watchdog: false - disable_tables: chrome_extensions - logger_path: /path/to/logger + config: + yara: + file_paths: + system_binaries: + - sig_group_1 + tmp: + - sig_group_1 + - sig_group_2 + signatures: + sig_group_1: + - /Users/wxs/sigs/foo.sig + - /Users/wxs/sigs/bar.sig + sig_group_2: + - /Users/wxs/sigs/baz.sig ``` -Note that the `command_line_flags` key does not support the `overrides` key, which is documented below. - -You can verify that these flags have taken effect on the hosts by running a query against the `osquery_flags` table. +### auto_table_construction -> If you revoked an old enroll secret, this feature won't update for hosts that were added to Fleet using this old enroll secret. This is because Fleetd uses the enroll secret to receive new flags from Fleet. For these hosts, all existing features will work as expected. - -For further documentation on how to rotate enroll secrets, please see [this guide](https://fleetdm.com/docs/configuration/configuration-files#rotating-enroll-secrets). - -If you prefer to deploy a new package with the updated enroll secret: - -1. Check which hosts need a new enroll secret by running the following query: `SELECT * FROM orbit_info WHERE enrolled = false`. - -> The hosts that don't have Fleetd installed will return an error because the `orbit_info` table doesn't exist. You can safely ignore these errors. - -2. In Fleet, head to the Hosts page and select **Add hosts** to find the fleetctl package command with an active enroll secret. - -3. Copy and run the fleetctl package command to create a new package. Distribute this package to the hosts that returned results in step 1. - -4. Done! +You can use Fleet to query local SQLite databases as tables. For more information on creating ATC configuration from a SQLite database, check out the [Automatic Table Construction section](https://osquery.readthedocs.io/en/stable/deployment/configuration/#automatic-table-construction) of the osquery documentation. +If you already know what your ATC configuration needs to look like, you can add it to an options config file: +```yaml +agent_options: + config: + options: + # ... + overrides: + platforms: + darwin: + auto_table_construction: + tcc_system_entries: + # This query and columns are restricted for compatability. Open TCC.db with sqlite on + # your endpoints to expand this out. + query: "SELECT service, client, last_modified FROM access" + # Note that TCC.db requires fleetd to have full-disk access, ensure that endpoints have + # this enabled. + path: "/Library/Application Support/com.apple.TCC/TCC.db" + columns: + - "service" + - "client" + - "last_modified" +``` -> In order for these options to be applied to your hosts, the `osquery` agent must be configured to use the `tls` config plugin and pointed to the correct endpoint. If you are using Fleetd to enroll your hosts, this is done automatically. +If you're editing this directly from the UI consider copying and pasting the following at the end of your agent configuration block: -```go -"--config_plugin=tls", -"--config_tls_endpoint=" + path.Join(prefix, "/api/v1/osquery/config") ``` - -```yaml -apiVersion: v1 -kind: config -spec: - agent_options: +overrides: + platforms: + darwin: + auto_table_construction: + tcc_system_entries: + # This query and columns are restricted for compatability. Open TCC.db with sqlite on + # your endpoints to expand this out. + query: "SELECT service, client, last_modified FROM access" + # Note that TCC.db requires Orbit to have full-disk access, ensure that endpoints have + # this enabled. + path: "/Library/Application Support/com.apple.TCC/TCC.db" + columns: + - "service" + - "client" + - "last_modified" ``` -## Extensions +## extensions > This feature requires [Fleetd, the Fleet agent manager](https://fleetdm.com/announcements/introducing-orbit-your-fleet-agent-manager), along with a custom TUF auto-update server (a Fleet Premium feature). @@ -263,7 +228,7 @@ In the above example: - the `hello_world_macos` extension is deployed to macOS hosts that are members of the 'Zoom installed' label. - the `hello_world_linux` extension is deployed to Linux hosts that are members of the 'Ubuntu Linux' **and** 'Zoom installed' labels. -### Configure fleetd update channels +## update_channels _Available in Fleet Premium v4.43.0 and fleetd v1.20.0_ @@ -304,89 +269,13 @@ This update startup loop can be fixed by any one of these actions: A. Downgrading channel `A` to < `1.20.0`. B. Upgrading channel `B` to >= `1.20.0`. -## Config - -The config key sets the osqueryd configuration options for your agents. In a plain osquery deployment, these would typically be set in `osquery.conf`. Each key below represents a corresponding key in the osquery documentation. - -For detailed information on osquery configuration options, check out the [osquery configuration docs](https://osquery.readthedocs.io/en/stable/deployment/configuration/). - -```yaml -agent_options: - config: - options: ~ - decorators: ~ - yara: ~ - -``` - -### Options - -In the `options` key, you can set your osqueryd options and feature flags. - -Any command line only flags must be set using the `command_line_flags` key for Orbit agents, or by modifying the osquery flags on your hosts if you're using plain osquery. - -To see a full list of flags, broken down by the method you can use to set them (configuration options vs command line flags), you can run `osqueryd --help` on a plain osquery agent. For Orbit agents, run `sudo orbit osqueryd --help`. The options will be shown there in command line format as `--key value`. In `yaml` format, that would become `key: value`. - -```yaml -agent_options: - config: - options: - distributed_interval: 3 - distributed_tls_max_attempts: 3 - logger_tls_endpoint: /api/osquery/log - logger_tls_period: 10 -``` -### Decorators - -In the `decorators` key, you can specify queries to include additional information in your osquery results logs. - -Use `load` for details you want to update values when the configuration loads, `always` to update every time a scheduled query is run, and `interval` if you want to update on a schedule. - -```yaml -agent_options: - config: - options: ~ - decorators: - load: - - "SELECT version FROM osquery_info" - - "SELECT uuid AS host_uuid FROM system_info" - always: - - "SELECT user AS username FROM logged_in_users WHERE user <> '' ORDER BY time LIMIT 1" - interval: - 3600: "SELECT total_seconds AS uptime FROM uptime" -``` - -### Yara - -You can use Fleet to configure the `yara` and `yara_events` osquery tables. Fore more information on YARA configuration and continuous monitoring using the `yara_events` table, check out the [YARA-based scanning with osquery section](https://osquery.readthedocs.io/en/stable/deployment/yara/) of the osquery documentation. - -The following is an example Fleet configuration file with YARA configuration. The values are taken from an example config supplied in the above link to the osquery documentation. - -```yaml -agent_options: - config: - yara: - file_paths: - system_binaries: - - sig_group_1 - tmp: - - sig_group_1 - - sig_group_2 - signatures: - sig_group_1: - - /Users/wxs/sigs/foo.sig - - /Users/wxs/sigs/bar.sig - sig_group_2: - - /Users/wxs/sigs/baz.sig -``` - -## Overrides +## overrides The `overrides` key allows you to segment hosts, by their platform, and supply these groups with unique osquery configuration options. When you choose to use the overrides option for a specific platform, all options specified in the default configuration will be ignored for that platform. In the example file below, all Darwin and Ubuntu hosts will **only** receive the options specified in their respective overrides sections. -> IMPORTANT: If a given option is not specified in a platform override section, its default value will be enforced. +If a given option is not specified in a platform override section, its default value will be enforced. ```yaml agent_options: @@ -413,7 +302,9 @@ agent_options: - /etc/%% ``` -## Script execution timeout +Note that the `command_line_flags` key is not supported in the `overrides`. + +## script_execution_timeout The `script_execution_timeout` allows you to change the default script execution timeout. @@ -426,78 +317,5 @@ The `script_execution_timeout` allows you to change the default script execution script_execution_timeout: 600 ``` -## Auto table construction - -You can use Fleet to query local SQLite databases as tables. For more information on creating ATC configuration from a SQLite database, check out the [Automatic Table Construction section](https://osquery.readthedocs.io/en/stable/deployment/configuration/#automatic-table-construction) of the osquery documentation. - -If you already know what your ATC configuration needs to look like, you can add it to an options config file: - -```yaml -agent_options: - config: - options: - # ... - overrides: - platforms: - darwin: - auto_table_construction: - tcc_system_entries: - # This query and columns are restricted for compatability. Open TCC.db with sqlite on - # your endpoints to expand this out. - query: "SELECT service, client, last_modified FROM access" - # Note that TCC.db requires fleetd to have full-disk access, ensure that endpoints have - # this enabled. - path: "/Library/Application Support/com.apple.TCC/TCC.db" - columns: - - "service" - - "client" - - "last_modified" -``` - -If you're editing this directly from the UI consider copying and pasting the following at the end of your agent configuration block: - -``` -overrides: - platforms: - darwin: - auto_table_construction: - tcc_system_entries: - # This query and columns are restricted for compatability. Open TCC.db with sqlite on - # your endpoints to expand this out. - query: "SELECT service, client, last_modified FROM access" - # Note that TCC.db requires Orbit to have full-disk access, ensure that endpoints have - # this enabled. - path: "/Library/Application Support/com.apple.TCC/TCC.db" - columns: - - "service" - - "client" - - "last_modified" -``` - -## Update agent options in Fleet UI - - - - -Fleet allows you to update the settings of the agent installed on all your hosts at once. In Fleet, these settings are called "agent options." - -The default agent options are good to start. - -How to update agent options: - -1. In the top navigation, select your avatar and select **Settings**. Only users with the [admin role](https://fleetdm.com/docs/using-fleet/permissions) can access the pages in **Settings**. - -2. On the Organization settings page, select **Agent options** on the left side of the page. - -3. Use Fleet's YAML editor to configure your osquery options, decorators, or set command line flags. - -4. Place your new setting one level below the `options` key. The new setting's key should be below and one tab to the right of `options`. - -5. Select **Save**. - -The agents may take several seconds to update because Fleet has to wait for the hosts to check in. Additionally, hosts enrolled with removed enroll secrets must properly rotate their secret to have the new changes take effect. - - - From 9a16978fefe0ef1e58a8b9952de57d2d5e10aa29 Mon Sep 17 00:00:00 2001 From: Noah Talerman <47070608+noahtalerman@users.noreply.github.com> Date: Tue, 17 Dec 2024 13:27:41 -0500 Subject: [PATCH 4/7] Move --forced under "Advanced" --- docs/Configuration/agent-configuration.md | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/docs/Configuration/agent-configuration.md b/docs/Configuration/agent-configuration.md index 49449789bf32..06a0f0481134 100644 --- a/docs/Configuration/agent-configuration.md +++ b/docs/Configuration/agent-configuration.md @@ -2,7 +2,7 @@ Agent configuration options (agent options) update the settings of Fleet's agent (fleed) installed on all your hosts. -You can modify agent options in **Settings > Organization settings > Agent options** or via Fleet's [API](https://fleetdm.com/docs/rest-api/rest-api#modify-configuration) or [YAML](https://fleetdm.com/docs/configuration/yaml-files). +You can modify agent options in **Settings > Organization settings > Agent options** or via Fleet's [API](https://fleetdm.com/docs/rest-api/rest-api#modify-configuration) or [YAML files](https://fleetdm.com/docs/configuration/yaml-files). ## config @@ -16,13 +16,15 @@ The `config` section allows you to update settings like performance and and how ### `options` and `command_line_flags` -To see a description for all available settings, with your host enrolled to Fleet, run `sudo orbit shell` (or the equivalent on Windows) to open an interactive osquery shell. Then run the following osquery query: +To see a description for all available settings, first [enroll your host](https://fleetdm.com/guides/enroll-hosts) to Fleet and then run `sudo orbit shell` to open an interactive osquery shell. Then run the following osquery query: ``` osquery > SELECT name, value, description FROM osquery; ``` -You can also use this query to verify that settings have taken effect on the hosts. +You can also run this query to verify that the latest settings have been applied to your hosts. + +#### Advanced `options` and `command_line_flags` are validated using the latest version of osquery. If you are not using the latest version of osquery, you can create a YAML file and apply it with `fleetctl apply --force` command to override the validation: From 19be8659ceac7bfc96ba4cfb7af58781cf00499a Mon Sep 17 00:00:00 2001 From: Noah Talerman Date: Wed, 18 Dec 2024 10:25:14 -0500 Subject: [PATCH 5/7] Stopped at YARA --- docs/Configuration/agent-configuration.md | 104 +- website/.sailsrc | 18260 ++++++++++++++++++++ 2 files changed, 18315 insertions(+), 49 deletions(-) diff --git a/docs/Configuration/agent-configuration.md b/docs/Configuration/agent-configuration.md index 06a0f0481134..29fc80f5d7dd 100644 --- a/docs/Configuration/agent-configuration.md +++ b/docs/Configuration/agent-configuration.md @@ -1,6 +1,6 @@ # Agent configuration -Agent configuration options (agent options) update the settings of Fleet's agent (fleed) installed on all your hosts. +Agent configuration options (agent options) update the settings of [Fleet's agent (fleed)](https://fleetdm.com/docs/get-started/anatomy#fleetd) installed on all your hosts. You can modify agent options in **Settings > Organization settings > Agent options** or via Fleet's [API](https://fleetdm.com/docs/rest-api/rest-api#modify-configuration) or [YAML files](https://fleetdm.com/docs/configuration/yaml-files). @@ -8,15 +8,53 @@ You can modify agent options in **Settings > Organization settings > Agent optio The `config` section allows you to update settings like performance and and how often the agent checks-in. -- `options` can include the agent settings listed under `osqueryOptions` [here](https://github.com/fleetdm/fleet/blob/main/server/fleet/agent_options_generated.go). These can be updated without a fleetd restart. -- `command_line_flags` can include the agent settings listed under osqueryCommandLineFlags [here](https://github.com/fleetdm/fleet/blob/main/server/fleet/agent_options_generated.go). These are only updated when fleetd restarts. +####Example + +```yaml +config: + options: + distributed_interval: 3 + distributed_tls_max_attempts: 3 + logger_tls_endpoint: /api/osquery/log + logger_tls_period: 10 + command_line_flags: # requires Fleet's agent (fleetd) + verbose: true + disable_watchdog: false + disable_tables: chrome_extensions + logger_path: /path/to/logger + decorators: + load: + - "SELECT version FROM osquery_info" + - "SELECT uuid AS host_uuid FROM system_info" + always: + - "SELECT user AS username FROM logged_in_users WHERE user <> '' ORDER BY time LIMIT 1" + interval: + 3600: "SELECT total_seconds AS uptime FROM uptime" + yara: + file_paths: + system_binaries: + - sig_group_1 + tmp: + - sig_group_1 + - sig_group_2 + signatures: + sig_group_1: + - /Users/wxs/sigs/foo.sig + - /Users/wxs/sigs/bar.sig + sig_group_2: + - /Users/wxs/sigs/baz.sig +``` + - `decorators` - `yara` - `auto_table_contructions` -### `options` and `command_line_flags` +### options and command_line_flags -To see a description for all available settings, first [enroll your host](https://fleetdm.com/guides/enroll-hosts) to Fleet and then run `sudo orbit shell` to open an interactive osquery shell. Then run the following osquery query: +- `options` include the agent settings listed under `osqueryOptions` [here](https://github.com/fleetdm/fleet/blob/main/server/fleet/agent_options_generated.go). These can be updated without a fleetd restart. +- `command_line_flags` include the agent settings listed under osqueryCommandLineFlags [here](https://github.com/fleetdm/fleet/blob/main/server/fleet/agent_options_generated.go). These are only updated when fleetd restarts. + +To see a description for all available settings, first [enroll your host](https://fleetdm.com/guides/enroll-hosts) to Fleet. Then, open your **Terminal** app and run `sudo orbit shell` to open an interactive osquery shell. Then run the following osquery query: ``` osquery > SELECT name, value, description FROM osquery; @@ -24,15 +62,7 @@ osquery > SELECT name, value, description FROM osquery; You can also run this query to verify that the latest settings have been applied to your hosts. -#### Advanced - -`options` and `command_line_flags` are validated using the latest version of osquery. If you are not using the latest version of osquery, you can create a YAML file and apply it with `fleetctl apply --force` command to override the validation: - -```sh -fleetctl apply --force -f config.yaml -``` - -> If you revoked an old enroll secret, this feature won't update for hosts that enrolled to Fleet using this old enroll secret. This is because fleetd uses the enroll secret to receive new flags from Fleet. For these hosts, all existing features will work as expected. +> If you revoked an old enroll secret, the `command_line_flags` won't update for hosts that enrolled to Fleet using this old enroll secret. This is because fleetd uses the enroll secret to receive new flags from Fleet. For these hosts, all existing features will work as expected. How to rotate enroll secrets: @@ -46,50 +76,26 @@ How to rotate enroll secrets: 4. Done! +#### Advanced + +`options` and `command_line_flags` are validated using the latest version of osquery. If you are not using the latest version of osquery, you can create a YAML file and apply it with `fleetctl apply --force` command to override the validation: + +```sh +fleetctl apply --force -f config.yaml +``` + ### decorators In the `decorators` key, you can specify queries to include additional information in your osquery results logs. -Use `load` for details you want to update values when the configuration loads, `always` to update every time a scheduled query is run, and `interval` if you want to update on a schedule. - -```yaml -agent_options: - config: - options: ~ - decorators: - load: - - "SELECT version FROM osquery_info" - - "SELECT uuid AS host_uuid FROM system_info" - always: - - "SELECT user AS username FROM logged_in_users WHERE user <> '' ORDER BY time LIMIT 1" - interval: - 3600: "SELECT total_seconds AS uptime FROM uptime" -``` +- `load` is are queries you want to update values when the configuration loads. +- `always` are queries to update every time a scheduled query is run. +- `interval` are queries you want to update on a schedule. ### yara You can use Fleet to configure the `yara` and `yara_events` osquery tables. Fore more information on YARA configuration and continuous monitoring using the `yara_events` table, check out the [YARA-based scanning with osquery section](https://osquery.readthedocs.io/en/stable/deployment/yara/) of the osquery documentation. -The following is an example Fleet configuration file with YARA configuration. The values are taken from an example config supplied in the above link to the osquery documentation. - -```yaml -agent_options: - config: - yara: - file_paths: - system_binaries: - - sig_group_1 - tmp: - - sig_group_1 - - sig_group_2 - signatures: - sig_group_1: - - /Users/wxs/sigs/foo.sig - - /Users/wxs/sigs/bar.sig - sig_group_2: - - /Users/wxs/sigs/baz.sig -``` - ### auto_table_construction You can use Fleet to query local SQLite databases as tables. For more information on creating ATC configuration from a SQLite database, check out the [Automatic Table Construction section](https://osquery.readthedocs.io/en/stable/deployment/configuration/#automatic-table-construction) of the osquery documentation. diff --git a/website/.sailsrc b/website/.sailsrc index 391fdf869cce..678392b5fe9c 100644 --- a/website/.sailsrc +++ b/website/.sailsrc @@ -7,5 +7,18265 @@ "_generatedWith": { "sails": "1.2.5", "sails-generate": "2.0.0" + }, + "builtStaticContent": { + "queries": [ + { + "name": "Ensure a password is required to wake the computer from sleep or screen saver is enabled", + "platforms": "macOS", + "platform": "darwin", + "description": "Checks that password is required to wake the computer from sleep or screen saver is enabled.", + "resolution": "Automated method:\nAsk your system administrator to deploy an MDM profile that ensures a password is required to wake the computer from sleep or screen saver is enabled.\nGraphical method:\n Perform the following steps to ensure a password is required to wake the computer from sleep or screen saver is enabled:\n 1. Open System Settings\n 2. Select Lock Screen\n 3. Verify that \"Require password after screensaver begins or display is turned\n off\" is set with \"After 0 seconds\" or \"After 5 seconds\"\n", + "query": "SELECT 1 WHERE \n EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.screensaver' AND \n name='askForPassword' AND \n (value = 1 OR value = 'true') AND \n username = ''\n )\n AND EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.screensaver' AND \n name='askForPasswordDelay' AND \n value <= 5 AND \n username = ''\n )\n AND NOT EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.screensaver' AND \n name='askForPassword' AND \n (value != 1 AND value != 'true')\n )\n AND NOT EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.screensaver' AND \n name='askForPasswordDelay' AND \n value > 5\n ); ", + "purpose": "Informational", + "tags": [ + "compliance", + "cis", + "cis_level1", + "premium" + ], + "contributors": [ + { + "name": "sharon-fdm", + "handle": "sharon-fdm", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/sharon-fdm" + } + ], + "kind": "policy", + "slug": "ensure-a-password-is-required-to-wake-the-computer-from-sleep-or-screen-saver-is-enabled", + "requiresMdm": false + }, + { + "name": "Ensure auto-update is enabled", + "platforms": "macOS", + "platform": "darwin", + "description": "Checks that the system is configured via MDM to automatically install updates.", + "resolution": "Ask your system administrator to deploy an MDM profile that enables automatic updates.", + "query": "SELECT 1 WHERE \n EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.SoftwareUpdate' AND \n name='AutomaticCheckEnabled' AND \n (value = 1 OR value = 'true') AND \n username = ''\n )\n AND NOT EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.SoftwareUpdate' AND \n name='AutomaticCheckEnabled' AND \n (value != 1 AND value != 'true')\n ); \n", + "purpose": "Informational", + "tags": [ + "compliance", + "cis", + "cis_level1", + "premium" + ], + "contributors": [ + { + "name": "sharon-fdm", + "handle": "sharon-fdm", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/sharon-fdm" + } + ], + "kind": "policy", + "slug": "ensure-auto-update-is-enabled", + "requiresMdm": false + }, + { + "name": "Ensure 'Minimum password length' is set to '14 or more characters'", + "platforms": "win10", + "platform": "windows", + "description": "This policy setting determines the least number of characters that make up a password for a user account.\n", + "resolution": "Automatic method:\nAsk your system administrator to establish the recommended configuration via GP, set the following UI path to 14 or more characters\n'Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Minimum password length'\n", + "query": "SELECT 1 FROM security_profile_info WHERE minimum_password_length >= 14;\n", + "purpose": "Informational", + "tags": [ + "compliance", + "cis", + "cis_level1", + "premium" + ], + "contributors": [ + { + "name": "marcosd4h", + "handle": "marcosd4h", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/marcosd4h" + } + ], + "kind": "policy", + "slug": "ensure-minimum-password-length-is-set-to-14-or-more-characters", + "requiresMdm": false + }, + { + "name": "Get OpenSSL versions", + "platform": "linux", + "description": "Retrieves the OpenSSL version.", + "query": "SELECT name AS name, version AS version, 'deb_packages' AS source FROM deb_packages WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'apt_sources' AS source FROM apt_sources WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'rpm_packages' AS source FROM rpm_packages WHERE name LIKE 'openssl%';", + "purpose": "Informational", + "tags": [ + "inventory" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "get-open-ssl-versions", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get authorized SSH keys", + "platform": "darwin, linux", + "description": "Presence of authorized SSH keys may be unusual on laptops. Could be completely normal on servers, but may be worth auditing for unusual keys and/or changes.", + "query": "SELECT username, authorized_keys. * FROM users CROSS JOIN authorized_keys USING (uid);", + "purpose": "Informational", + "remediation": "Check out the linked table (https://github.com/fleetdm/fleet/blob/32b4d53e7f1428ce43b0f9fa52838cbe7b413eed/handbook/queries/detect-hosts-with-high-severity-vulnerable-versions-of-openssl.md#table-of-vulnerable-openssl-versions) to determine if the installed version is a high severity vulnerability and view the corresponding CVE(s)", + "tags": [ + "built-in", + "ssh" + ], + "contributors": [ + { + "name": "mike-j-thomas", + "handle": "mike-j-thomas", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/mike-j-thomas" + } + ], + "kind": "query", + "slug": "get-authorized-ssh-keys", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get authorized keys for Domain Joined Accounts", + "platform": "darwin, linux", + "description": "List authorized_keys for each user on the system.", + "query": "SELECT * FROM users CROSS JOIN authorized_keys USING(uid) WHERE username IN (SELECT distinct(username) FROM last);", + "purpose": "Informational", + "tags": [ + "active directory", + "ssh" + ], + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-authorized-keys-for-domain-joined-accounts", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get crashes", + "platform": "darwin", + "description": "Retrieve application, system, and mobile app crash logs.", + "query": "SELECT uid, datetime, responsible, exception_type, identifier, version, crash_path FROM users CROSS JOIN crashes USING (uid);", + "purpose": "Informational", + "tags": [ + "troubleshooting" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "get-crashes", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get installed Chrome Extensions", + "platform": "darwin, linux, windows", + "description": "List installed Chrome Extensions for all users.", + "query": "SELECT * FROM users CROSS JOIN chrome_extensions USING (uid);", + "purpose": "Informational", + "tags": [ + "browser", + "built-in", + "inventory" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "get-installed-chrome-extensions", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get installed Linux software", + "platform": "linux", + "description": "Get all software installed on a Linux computer, including browser plugins and installed packages. Note that this does not include other running processes in the processes table.", + "query": "SELECT name AS name, version AS version, 'Package (APT)' AS type, 'apt_sources' AS source FROM apt_sources UNION SELECT name AS name, version AS version, 'Package (deb)' AS type, 'deb_packages' AS source FROM deb_packages UNION SELECT package AS name, version AS version, 'Package (Portage)' AS type, 'portage_packages' AS source FROM portage_packages UNION SELECT name AS name, version AS version, 'Package (RPM)' AS type, 'rpm_packages' AS source FROM rpm_packages UNION SELECT name AS name, '' AS version, 'Package (YUM)' AS type, 'yum_sources' AS source FROM yum_sources UNION SELECT name AS name, version AS version, 'Package (NPM)' AS type, 'npm_packages' AS source FROM npm_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages;", + "purpose": "Informational", + "tags": [ + "inventory", + "built-in" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "get-installed-linux-software", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get installed macOS software", + "platform": "darwin", + "description": "Get all software installed on a macOS computer, including apps, browser plugins, and installed packages. Note that this does not include other running processes in the processes table.", + "query": "SELECT name AS name, bundle_short_version AS version, 'Application (macOS)' AS type, 'apps' AS source FROM apps UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name As name, version AS version, 'Browser plugin (Safari)' AS type, 'safari_extensions' AS source FROM safari_extensions UNION SELECT name AS name, version AS version, 'Package (Homebrew)' AS type, 'homebrew_packages' AS source FROM homebrew_packages;", + "purpose": "Informational", + "tags": [ + "inventory", + "built-in" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "get-installed-mac-os-software", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get installed Safari extensions", + "platform": "darwin", + "description": "Retrieves the list of installed Safari Extensions for all users in the target system.", + "query": "SELECT safari_extensions.* FROM users join safari_extensions USING (uid);", + "purpose": "Informational", + "tags": [ + "browser", + "built-in", + "inventory" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "get-installed-safari-extensions", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get installed Windows software", + "platform": "windows", + "description": "Get all software installed on a Windows computer, including programs, browser plugins, and installed packages. Note that this does not include other running processes in the processes table.", + "query": "SELECT name AS name, version AS version, 'Program (Windows)' AS type, 'programs' AS source FROM programs UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (IE)' AS type, 'ie_extensions' AS source FROM ie_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name AS name, version AS version, 'Package (Chocolatey)' AS type, 'chocolatey_packages' AS source FROM chocolatey_packages;", + "purpose": "Informational", + "tags": [ + "inventory", + "built-in" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "get-installed-windows-software", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get laptops with failing batteries", + "platform": "darwin", + "description": "Lists all laptops with under-performing or failing batteries.", + "query": "SELECT * FROM battery WHERE health != 'Good' AND condition NOT IN ('', 'Normal');", + "purpose": "Informational", + "tags": [ + "troubleshooting", + "hardware", + "inventory" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "get-laptops-with-failing-batteries", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get current users with active shell/console on the system", + "platform": "darwin, linux, windows", + "description": "Get current users with active shell/console on the system and associated process", + "query": "SELECT user,host,time, p.name, p.cmdline, p.cwd, p.root FROM logged_in_users liu, processes p WHERE liu.pid = p.pid and liu.type='user' and liu.user <> '' ORDER BY time;", + "purpose": "Informational", + "tags": [ + "hunting", + "built-in" + ], + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-current-users-with-active-shell-console-on-the-system", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get unencrypted SSH keys for local accounts", + "platform": "darwin, linux, windows", + "description": "Identify SSH keys created without a passphrase which can be used in Lateral Movement (MITRE. TA0008)", + "query": "SELECT uid, username, description, path, encrypted FROM users CROSS JOIN user_ssh_keys using (uid) WHERE encrypted=0;", + "purpose": "Informational", + "tags": [ + "inventory", + "compliance", + "ssh", + "built-in" + ], + "remediation": "First, make the user aware about the impact of SSH keys. Then rotate the unencrypted keys detected.", + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-unencrypted-ssh-keys-for-local-accounts", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get unencrypted SSH keys for domain-joined accounts", + "platform": "darwin, linux, windows", + "description": "Identify SSH keys created without a passphrase which can be used in Lateral Movement (MITRE. TA0008)", + "query": "SELECT uid, username, description, path, encrypted FROM users CROSS JOIN user_ssh_keys using (uid) WHERE encrypted=0 and username in (SELECT distinct(username) FROM last);", + "purpose": "Informational", + "tags": [ + "inventory", + "compliance", + "ssh", + "active directory" + ], + "remediation": "First, make the user aware about the impact of SSH keys. Then rotate the unencrypted keys detected.", + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-unencrypted-ssh-keys-for-domain-joined-accounts", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get dynamic linker hijacking on Linux (MITRE. T1574.006)", + "platform": "linux", + "description": "Detect any processes that run with LD_PRELOAD environment variable", + "query": "SELECT env.pid, env.key, env.value, p.name,p.path, p.cmdline, p.cwd FROM process_envs env join processes p USING (pid) WHERE key='LD_PRELOAD';", + "purpose": "Informational", + "tags": [ + "hunting", + "attack", + "t1574" + ], + "remediation": "Identify the process/binary detected and confirm with the system's owner.", + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-dynamic-linker-hijacking-on-linux-mitre-t-1574-006", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get dynamic linker hijacking on macOS (MITRE. T1574.006)", + "platform": "darwin", + "description": "Detect any processes that run with DYLD_INSERT_LIBRARIES environment variable", + "query": "SELECT env.pid, env.key, env.value, p.name,p.path, p.cmdline, p.cwd FROM process_envs env join processes p USING (pid) WHERE key='DYLD_INSERT_LIBRARIES';", + "purpose": "Informational", + "tags": [ + "hunting", + "attack", + "t1574" + ], + "remediation": "Identify the process/binary detected and confirm with the system's owner.", + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-dynamic-linker-hijacking-on-mac-os-mitre-t-1574-006", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get etc hosts entries", + "platform": "darwin, linux", + "description": "Line-parsed /etc/hosts", + "query": "SELECT * FROM etc_hosts WHERE address not in ('127.0.0.1', '::1');", + "purpose": "informational", + "tags": [ + "hunting", + "inventory" + ], + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-etc-hosts-entries", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get network interfaces", + "platform": "darwin, linux, windows", + "description": "Network interfaces MAC address", + "query": "SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details d USING (interface) WHERE address not in ('127.0.0.1', '::1');", + "purpose": "informational", + "tags": [ + "hunting", + "inventory" + ], + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-network-interfaces", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get local user accounts", + "platform": "darwin, linux, windows", + "description": "Local user accounts (including domain accounts that have logged on locally (Windows)).", + "query": "SELECT uid, gid, username, description, directory, shell FROM users;", + "purpose": "informational", + "tags": [ + "hunting", + "inventory" + ], + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-local-user-accounts", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get active user accounts on servers", + "platform": "linux", + "description": "Domain Joined environments normally have root or other service only accounts and users are SSH-ing using their Domain Accounts.", + "query": "SELECT * FROM shadow WHERE password_status='active' and username!='root';", + "purpose": "informational", + "tags": [ + "hunting", + "inventory", + "active directory" + ], + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-active-user-accounts-on-servers", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get Nmap scanner", + "platform": "darwin, linux, windows", + "description": "Get Nmap scanner process, as well as its user, parent, and process details.", + "query": "SELECT p.pid, name, p.path, cmdline, cwd, start_time, parent, (SELECT name FROM processes WHERE pid=p.parent) AS parent_name, (SELECT username FROM users WHERE uid=p.uid) AS username FROM processes as p WHERE cmdline like 'nmap%';", + "purpose": "Informational", + "tags": [ + "hunting", + "attack", + "t1046" + ], + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-nmap-scanner", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get Docker contained processes on a system", + "platform": "darwin, linux", + "description": "Docker containers Processes, can be used on normal systems or a kubenode.", + "query": "SELECT c.id, c.name, c.image, c.image_id, c.command, c.created, c.state, c.status, p.cmdline FROM docker_containers c CROSS JOIN docker_container_processes p using(id);", + "purpose": "Informational", + "tags": [ + "built-in", + "containers", + "inventory" + ], + "contributors": [ + { + "name": "anelshaer", + "handle": "anelshaer", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/anelshaer" + } + ], + "kind": "query", + "slug": "get-docker-contained-processes-on-a-system", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get Windows print spooler remote code execution vulnerability", + "platform": "windows", + "description": "Detects devices that are potentially vulnerable to CVE-2021-1675 because the print spooler service is not disabled.", + "query": "SELECT CASE cnt WHEN 2 THEN \"TRUE\" ELSE \"FALSE\" END \"Vulnerable\" FROM (SELECT name start_type, COUNT(name) AS cnt FROM services WHERE name = 'NTDS' or (name = 'Spooler' and start_type <> 'DISABLED')) WHERE cnt = 2;", + "purpose": "Informational", + "tags": [ + "vulnerability" + ], + "contributors": [ + { + "name": "maravedi", + "handle": "maravedi", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/maravedi" + } + ], + "kind": "query", + "slug": "get-windows-print-spooler-remote-code-execution-vulnerability", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get local users and their privileges", + "platform": "darwin, linux, windows", + "description": "Collects the local user accounts and their respective user group.", + "query": "SELECT uid, username, type, groupname FROM users u JOIN groups g ON g.gid = u.gid;", + "purpose": "informational", + "tags": [ + "inventory" + ], + "contributors": [ + { + "name": "noahtalerman", + "handle": "noahtalerman", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/noahtalerman" + } + ], + "kind": "query", + "slug": "get-local-users-and-their-privileges", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get processes that no longer exist on disk", + "platform": "linux, darwin, windows", + "description": "Lists all processes of which the binary which launched them no longer exists on disk. Attackers often delete files from disk after launching a process to mask presence.", + "query": "SELECT name, path, pid FROM processes WHERE on_disk = 0;", + "purpose": "Incident response", + "tags": [ + "hunting", + "built-in" + ], + "contributors": [ + { + "name": "alphabrevity", + "handle": "alphabrevity", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/alphabrevity" + } + ], + "kind": "query", + "slug": "get-processes-that-no-longer-exist-on-disk", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get user files matching a specific hash", + "platform": "darwin, linux", + "description": "Looks for specific hash in the Users/ directories for files that are less than 50MB (osquery file size limitation.)", + "query": "SELECT path, sha256 FROM hash WHERE path IN (SELECT path FROM file WHERE size < 50000000 AND path LIKE '/Users/%/Documents/%%') AND sha256 = '16d28cd1d78b823c4f961a6da78d67a8975d66cde68581798778ed1f98a56d75';", + "purpose": "Informational", + "tags": [ + "hunting", + "built-in" + ], + "contributors": [ + { + "name": "alphabrevity", + "handle": "alphabrevity", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/alphabrevity" + } + ], + "kind": "query", + "slug": "get-user-files-matching-a-specific-hash", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get local administrator accounts on macOS", + "platform": "darwin", + "description": "The query allows you to check macOS systems for local administrator accounts.", + "query": "SELECT uid, username, type FROM users u JOIN groups g ON g.gid = u.gid;", + "purpose": "Informational", + "tags": [ + "hunting", + "inventory" + ], + "contributors": [ + { + "name": "alphabrevity", + "handle": "alphabrevity", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/alphabrevity" + } + ], + "kind": "query", + "slug": "get-local-administrator-accounts-on-mac-os", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get all listening ports, by process", + "platform": "linux, darwin, windows", + "description": "List ports that are listening on all interfaces, along with the process to which they are attached.", + "query": "SELECT lp.address, lp.pid, lp.port, lp.protocol, p.name, p.path, p.cmdline FROM listening_ports lp JOIN processes p ON lp.pid = p.pid WHERE lp.address = \"0.0.0.0\";", + "purpose": "Informational", + "tags": [ + "hunting", + "network" + ], + "contributors": [ + { + "name": "alphabrevity", + "handle": "alphabrevity", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/alphabrevity" + } + ], + "kind": "query", + "slug": "get-all-listening-ports-by-process", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get whether TeamViewer is installed/running", + "platform": "windows", + "description": "Looks for the TeamViewer service running on machines. This is often used when attackers gain access to a machine, running TeamViewer to allow them to access a machine.", + "query": "SELECT display_name,status,s.pid,p.path FROM services AS s JOIN processes AS p USING(pid) WHERE s.name LIKE \"%teamviewer%\";", + "purpose": "Informational", + "tags": [ + "hunting", + "inventory" + ], + "contributors": [ + { + "name": "alphabrevity", + "handle": "alphabrevity", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/alphabrevity" + } + ], + "kind": "query", + "slug": "get-whether-team-viewer-is-installed-running", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get malicious Python backdoors", + "platform": "darwin, linux, windows", + "description": "Watches for the backdoored Python packages installed on the system. See (http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/index.html)", + "query": "SELECT CASE cnt WHEN 0 THEN \"NONE_INSTALLED\" ELSE \"INSTALLED\" END AS \"Malicious Python Packages\", package_name, package_version FROM (SELECT COUNT(name) AS cnt, name AS package_name, version AS package_version, path AS package_path FROM python_packages WHERE package_name IN ('acquisition', 'apidev-coop', 'bzip', 'crypt', 'django-server', 'pwd', 'setup-tools', 'telnet', 'urlib3', 'urllib'));", + "purpose": "Informational", + "tags": [ + "hunting", + "inventory", + "malware" + ], + "contributors": [ + { + "name": "alphabrevity", + "handle": "alphabrevity", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/alphabrevity" + } + ], + "kind": "query", + "slug": "get-malicious-python-backdoors", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Check for artifacts of the Floxif trojan", + "platform": "windows", + "description": "Checks for artifacts from the Floxif trojan on Windows machines.", + "query": "SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Piriform\\\\Agomo%';", + "purpose": "Informational", + "tags": [ + "hunting", + "malware" + ], + "contributors": [ + { + "name": "micheal-o", + "handle": "micheal-o", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/micheal-o" + } + ], + "kind": "query", + "slug": "check-for-artifacts-of-the-floxif-trojan", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get Shimcache table", + "platform": "windows", + "description": "Returns forensic data showing evidence of likely file execution, in addition to the last modified timestamp of the file, order of execution, full file path order of execution, and the order in which files were executed.", + "query": "select * from Shimcache", + "purpose": "Informational", + "tags": [ + "hunting" + ], + "contributors": [ + { + "name": "puffyCid", + "handle": "puffyCid", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/puffyCid" + } + ], + "kind": "query", + "slug": "get-shimcache-table", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get running docker containers", + "platform": "darwin, linux", + "description": "Returns the running Docker containers", + "query": "SELECT id, name, image, image_id, state, status FROM docker_containers WHERE state = \"running\";", + "purpose": "Informational", + "tags": [ + "containers", + "inventory" + ], + "contributors": [ + { + "name": "DominusKelvin", + "handle": "DominusKelvin", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/DominusKelvin" + } + ], + "kind": "query", + "slug": "get-running-docker-containers", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get applications hogging memory", + "platform": "darwin, linux, windows", + "description": "Returns top 10 applications or processes hogging memory the most.", + "query": "SELECT pid, name, ROUND((total_size * '10e-7'), 2) AS memory_used FROM processes ORDER BY total_size DESC LIMIT 10;", + "purpose": "Informational", + "tags": [ + "troubleshooting" + ], + "contributors": [ + { + "name": "DominusKelvin", + "handle": "DominusKelvin", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/DominusKelvin" + } + ], + "kind": "query", + "slug": "get-applications-hogging-memory", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get servers with root login in the last 24 hours", + "platform": "darwin, linux, windows", + "description": "Returns servers with root login in the last 24 hours and the time the users were logged in.", + "query": "SELECT * FROM last WHERE username = \"root\" AND time > (( SELECT unix_time FROM time ) - 86400 );", + "purpose": "Informational", + "tags": [ + "hunting" + ], + "contributors": [ + { + "name": "DominusKelvin", + "handle": "DominusKelvin", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/DominusKelvin" + } + ], + "kind": "query", + "slug": "get-servers-with-root-login-in-the-last-24-hours", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Detect active processes with Log4j running", + "platform": "darwin, linux", + "description": "Returns a list of active processes and the Jar paths which are using Log4j. Version numbers are usually within the Jar filename. Note: This query is resource intensive and has caused problems on systems with limited swap space. Test on some systems before running this widely.", + "query": "WITH target_jars AS (\n SELECT DISTINCT path\n FROM (\n WITH split(word, str) AS(\n SELECT '', cmdline || ' '\n FROM processes\n UNION ALL\n SELECT substr(str, 0, instr(str, ' ')), substr(str, instr(str, ' ') + 1)\n FROM split\n WHERE str != '')\n SELECT word AS path\n FROM split\n WHERE word LIKE '%.jar'\n UNION ALL\n SELECT path\n FROM process_open_files\n WHERE path LIKE '%.jar'\n )\n)\nSELECT path, matches\nFROM yara\nWHERE path IN (SELECT path FROM target_jars)\n AND count > 0\n AND sigrule IN (\n 'rule log4jJndiLookup {\n strings:\n $jndilookup = \"JndiLookup\"\n condition:\n $jndilookup\n }',\n 'rule log4jJavaClass {\n strings:\n $javaclass = \"org/apache/logging/log4j\"\n condition:\n $javaclass\n }'\n );\n", + "purpose": "Detection", + "tags": [ + "vulnerability" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + }, + { + "name": "tgauda", + "handle": "tgauda", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/tgauda" + } + ], + "kind": "query", + "slug": "detect-active-processes-with-log-4-j-running", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get applications that were opened within the last 24 hours", + "platform": "darwin", + "description": "Returns applications that were opened within the last 24 hours starting with the last opened application.", + "query": "SELECT * FROM apps WHERE last_opened_time > (( SELECT unix_time FROM time ) - 86400 ) ORDER BY last_opened_time DESC;", + "purpose": "Informational", + "tags": [ + "inventory" + ], + "contributors": [ + { + "name": "DominusKelvin", + "handle": "DominusKelvin", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/DominusKelvin" + } + ], + "kind": "query", + "slug": "get-applications-that-were-opened-within-the-last-24-hours", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get applications that are not in the Applications directory", + "platform": "darwin", + "description": "Returns applications that are not in the `/Applications` directory", + "query": "SELECT * FROM apps WHERE path NOT LIKE '/Applications/%';", + "purpose": "Informational", + "tags": [ + "hunting", + "inventory" + ], + "contributors": [ + { + "name": "DominusKelvin", + "handle": "DominusKelvin", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/DominusKelvin" + } + ], + "kind": "query", + "slug": "get-applications-that-are-not-in-the-applications-directory", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get subscription-based applications that have not been opened for the last 30 days", + "platform": "darwin", + "description": "Returns applications that are subscription-based and have not been opened for the last 30 days. You can replace the list of applications with those specific to your use case.", + "query": "SELECT * FROM apps WHERE path LIKE '/Applications/%' AND name IN (\"Photoshop.app\", \"Adobe XD.app\", \"Sketch.app\", \"Illustrator.app\") AND last_opened_time < (( SELECT unix_time FROM time ) - 2592000000000 );", + "purpose": "Informational", + "tags": [ + "inventory" + ], + "contributors": [ + { + "name": "DominusKelvin", + "handle": "DominusKelvin", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/DominusKelvin" + } + ], + "kind": "query", + "slug": "get-subscription-based-applications-that-have-not-been-opened-for-the-last-30-days", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get operating system information", + "platform": "darwin, windows, linux", + "description": "Returns the operating system name and version on the device.", + "query": "SELECT name, version FROM os_version;", + "purpose": "Informational", + "tags": [ + "inventory", + "built-in" + ], + "contributors": [ + { + "name": "noahtalerman", + "handle": "noahtalerman", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/noahtalerman" + } + ], + "kind": "query", + "slug": "get-operating-system-information", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Gatekeeper enabled", + "query": "SELECT 1 FROM gatekeeper WHERE assessments_enabled = 1;", + "description": "Checks to make sure that the Gatekeeper feature is enabled on macOS devices. Gatekeeper tries to ensure only trusted software is run on a mac machine.", + "resolution": "To enable Gatekeeper, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable.", + "tags": [ + "compliance", + "hardening", + "built-in", + "cis", + "cis2.5.2.1" + ], + "platform": "darwin", + "contributors": [ + { + "name": "groob", + "handle": "groob", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/groob" + } + ], + "kind": "policy", + "slug": "gatekeeper-enabled-mac-os", + "requiresMdm": false, + "critical": true + }, + { + "name": "Full disk encryption enabled ", + "query": "SELECT 1 FROM bitlocker_info WHERE drive_letter='C:' AND protection_status=1;", + "description": "Checks to make sure that full disk encryption is enabled on Windows devices.", + "resolution": "To get additional information, run the following osquery query on the failing device: SELECT * FROM bitlocker_info. In the query results, if protection_status is 2, then the status cannot be determined. If it is 0, it is considered unprotected. Use the additional results (percent_encrypted, conversion_status, etc.) to help narrow down the specific reason why Windows considers the volume unprotected.", + "platform": "windows", + "tags": [ + "compliance", + "hardening", + "built-in" + ], + "contributors": [ + { + "name": "defensivedepth", + "handle": "defensivedepth", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/defensivedepth" + } + ], + "kind": "policy", + "slug": "full-disk-encryption-enabled-windows", + "requiresMdm": false, + "critical": true + }, + { + "name": "Full disk encryption enabled", + "query": "SELECT 1 FROM disk_encryption WHERE user_uuid IS NOT \"\" AND filevault_status = 'on' LIMIT 1;", + "description": "Checks to make sure that full disk encryption (FileVault) is enabled on macOS devices.", + "resolution": "To enable full disk encryption, on the failing device, select System Preferences > Security & Privacy > FileVault > Turn On FileVault.", + "tags": [ + "compliance", + "hardening", + "built-in", + "cis", + "cis2.5.1.1" + ], + "platform": "darwin", + "contributors": [ + { + "name": "groob", + "handle": "groob", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/groob" + } + ], + "kind": "policy", + "slug": "full-disk-encryption-enabled-mac-os", + "requiresMdm": false, + "critical": true + }, + { + "name": "Full disk encryption enabled ", + "query": "SELECT 1 FROM mounts m, disk_encryption d WHERE m.device_alias = d.name AND d.encrypted = 1 AND m.path = '/';", + "description": "Checks if the root drive is encrypted. There are many ways to encrypt Linux systems. This is the default on distributions such as Ubuntu.", + "resolution": "Ensure the image deployed to your Linux workstation includes full disk encryption.", + "platform": "linux", + "tags": [ + "compliance", + "hardening", + "built-in" + ], + "contributors": [ + { + "name": "jbilling", + "handle": "jbilling", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/jbilling" + }, + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "full-disk-encryption-enabled-linux", + "requiresMdm": false, + "critical": true + }, + { + "name": "System Integrity Protection enabled", + "query": "SELECT 1 FROM sip_config WHERE config_flag = 'sip' AND enabled = 1;", + "description": "Checks to make sure that the System Integrity Protection feature is enabled.", + "resolution": "To enable System Integrity Protection, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable.", + "tags": [ + "compliance", + "malware", + "hardening", + "built-in", + "cis", + "cis5.1.2" + ], + "platform": "darwin", + "contributors": [ + { + "name": "groob", + "handle": "groob", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/groob" + } + ], + "kind": "policy", + "slug": "system-integrity-protection-enabled-mac-os", + "requiresMdm": false + }, + { + "name": "Automatic login disabled", + "query": "SELECT 1 FROM managed_policies WHERE domain = 'com.apple.loginwindow' AND name = 'com.apple.login.mcx.DisableAutoLoginClient' AND value = 1 LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent login in without a password.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables automatic login.", + "tags": [ + "compliance", + "hardening", + "built-in" + ], + "platform": "darwin", + "contributors": [ + { + "name": "groob", + "handle": "groob", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/groob" + } + ], + "kind": "policy", + "slug": "automatic-login-disabled-mac-os", + "requiresMdm": true, + "critical": true + }, + { + "name": "Secure keyboard entry for Terminal application enabled", + "query": "SELECT 1 FROM managed_policies WHERE domain = 'com.apple.Terminal' AND name = 'SecureKeyboardEntry' AND value = 1 LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to enabled secure keyboard entry for the Terminal application.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables secure keyboard entry for the Terminal application.", + "tags": [ + "compliance", + "hardening", + "built-in" + ], + "platform": "darwin", + "contributors": [ + { + "name": "groob", + "handle": "groob", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/groob" + } + ], + "kind": "policy", + "slug": "secure-keyboard-entry-for-terminal-application-enabled-mac-os", + "requiresMdm": true + }, + { + "name": "Get built-in antivirus status on macOS", + "platform": "darwin", + "query": "SELECT path, value AS version FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist') OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist');", + "description": "Reads the version numbers from the Malware Removal Tool (MRT) and built-in antivirus (XProtect) plists", + "purpose": "Informational", + "tags": [ + "compliance", + "malware", + "hardening", + "built-in" + ], + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "query", + "slug": "get-built-in-antivirus-status-on-mac-os", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get antivirus status from the Windows Security Center", + "platform": "windows", + "query": "SELECT antivirus, signatures_up_to_date from windows_security_center CROSS JOIN windows_security_products WHERE type = 'Antivirus';", + "description": "Selects the antivirus and signatures status from Windows Security Center.", + "purpose": "Informational", + "tags": [ + "compliance", + "malware", + "hardening", + "built-in" + ], + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "query", + "slug": "get-antivirus-status-from-the-windows-security-center", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get antivirus (ClamAV/clamd) and updater (freshclam) process status", + "platform": "linux", + "query": "SELECT pid, state, cmdline, name FROM processes WHERE name='clamd' OR name='freshclam';", + "description": "Selects the clamd and freshclam processes to ensure AV and its updater are running", + "purpose": "Informational", + "tags": [ + "compliance", + "malware", + "hardening", + "built-in" + ], + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "query", + "slug": "get-antivirus-clam-av-clamd-and-updater-freshclam-process-status", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Antivirus healthy", + "query": "SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist' AND value>=2162) OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist' and value>=1.93)) WHERE score == 1;", + "description": "Checks the version of Malware Removal Tool (MRT) and the built-in macOS AV (Xprotect). Replace version numbers with the latest version regularly.", + "resolution": "To enable automatic security definition updates, on the failing device, select System Preferences > Software Update > Advanced > Turn on Install system data files and security updates.", + "tags": [ + "compliance", + "malware", + "hardening", + "built-in", + "template" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "antivirus-healthy-mac-os", + "requiresMdm": false + }, + { + "name": "Antivirus healthy ", + "query": "SELECT 1 from windows_security_center wsc CROSS JOIN windows_security_products wsp WHERE antivirus = 'Good' AND type = 'Antivirus' AND signatures_up_to_date=1;", + "description": "Checks the status of antivirus and signature updates from the Windows Security Center.", + "resolution": "Ensure Windows Defender or your third-party antivirus is running, up to date, and visible in the Windows Security Center.", + "tags": [ + "compliance", + "malware", + "hardening", + "built-in" + ], + "platform": "windows", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "antivirus-healthy-windows", + "requiresMdm": false + }, + { + "name": "Antivirus healthy ", + "query": "SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM processes WHERE (name = 'clamd') OR (name = 'freshclam')) WHERE score == 1;", + "description": "Checks that both ClamAV's daemon and its updater service (freshclam) are running.", + "resolution": "Ensure ClamAV and Freshclam are installed and running.", + "tags": [ + "compliance", + "malware", + "hardening", + "built-in" + ], + "platform": "linux", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "antivirus-healthy-linux", + "requiresMdm": false + }, + { + "name": "MDM enrolled", + "query": "SELECT 1 from mdm WHERE enrolled='true';", + "description": "Required: osquery deployed with Orbit, or manual installation of macadmins/osquery-extension. Checks that a mac is enrolled to MDM. Add a AND on identity_certificate_uuid to check for a specific MDM.", + "resolution": "Enroll device to MDM", + "tags": [ + "compliance", + "hardening", + "built-in" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "mdm-enrolled-mac-os", + "requiresMdm": false, + "critical": true + }, + { + "name": "Docker application is up to date or not present", + "query": "SELECT 1 WHERE EXISTS (SELECT 1 FROM apps a1 WHERE a1.bundle_identifier = 'com.electron.dockerdesktop' AND a1.bundle_short_version>='4.6.1') OR NOT EXISTS (SELECT 1 FROM apps a2 WHERE a2.bundle_identifier = 'com.electron.dockerdesktop');", + "description": "Checks if the application (Docker Desktop example) is installed and up to date, or not installed. Fails if the application is installed and on a lower version. You can copy this query and replace the bundle_identifier and bundle_version values to apply the same type of policy to other applications.", + "resolution": "Update Docker or remove it if not used.", + "tags": [ + "inventory", + "vulnerability", + "built-in" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "docker-application-is-up-to-date-or-not-present-mac-os", + "requiresMdm": false + }, + { + "name": "SSH keys encrypted", + "query": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM users CROSS JOIN user_ssh_keys USING (uid) WHERE encrypted='0');", + "description": "Required: osquery must have Full Disk Access. Policy passes if all keys are encrypted, including if no keys are present.", + "resolution": "Use this command to encrypt existing SSH keys by providing the path to the file: ssh-keygen -o -p -f /path/to/file", + "tags": [ + "compliance", + "ssh", + "built-in" + ], + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "platform": "darwin,linux,windows", + "kind": "policy", + "slug": "ssh-keys-encrypted", + "requiresMdm": false + }, + { + "name": "Suspicious autostart ", + "query": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM startup_items WHERE path = \"regsvr32\" AND args LIKE \"%http%\");", + "description": "Checks for an autostart that is attempting to load a dynamic link library (DLL) from the internet.", + "resolution": "Remove the suspicious startup entry.", + "tags": [ + "malware", + "hunting" + ], + "platform": "windows", + "contributors": [ + { + "name": "kswagler-rh", + "handle": "kswagler-rh", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/kswagler-rh" + } + ], + "kind": "policy", + "slug": "suspicious-autostart-windows", + "requiresMdm": false + }, + { + "name": "Firewall enabled", + "query": "SELECT 1 FROM alf WHERE global_state >= 1;", + "description": "Checks if the firewall is enabled.", + "resolution": "In System Preferences, open Security & Privacy, navigate to the Firewall tab and click Turn On Firewall.", + "tags": [ + "hardening", + "compliance", + "built-in", + "cis", + "cis2.5.2.2" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "firewall-enabled-mac-os", + "requiresMdm": false + }, + { + "name": "Screen lock enabled", + "query": "SELECT 1 FROM managed_policies WHERE name='askForPassword' AND value='1';", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to enable screen lock.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables screen lock.", + "tags": [ + "compliance", + "hardening", + "built-in" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "screen-lock-enabled-mac-os", + "requiresMdm": true + }, + { + "name": "Screen lock enabled ", + "query": "SELECT 1 FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\InactivityTimeoutSecs' AND CAST(data as INTEGER) <= 1800;", + "description": "Checks if the screen lock is enabled and configured to lock the system within 30 minutes or less.", + "resolution": "Contact your IT administrator to enable the Interactive Logon: Machine inactivity limit setting with a value of 1800 seconds or lower.", + "tags": [ + "compliance", + "hardening", + "built-in" + ], + "platform": "windows", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "screen-lock-enabled-windows", + "requiresMdm": false + }, + { + "name": "Password requires 10 or more characters", + "query": "SELECT 1 FROM (SELECT cast(lengthtxt as integer(2)) minlength FROM (SELECT SUBSTRING(length, 1, 2) AS lengthtxt FROM (SELECT policy_description, policy_identifier, split(policy_content, '{', 1) AS length FROM password_policy WHERE policy_identifier LIKE '%minLength')) WHERE minlength >= 10);", + "description": "Checks that the password policy requires at least 10 characters. Requires osquery 5.4.0 or newer.", + "resolution": "Contact your IT administrator to make sure your Mac is receiving configuration profiles for password length.", + "platform": "darwin", + "tags": [ + "compliance", + "hardening", + "built-in", + "cis", + "cis5.2.2" + ], + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "password-requires-10-or-more-characters-mac-os", + "requiresMdm": false + }, + { + "name": "Operating system up to date", + "query": "SELECT 1 FROM os_version WHERE version >= '14.1.1';", + "description": "Checks that the operating system is up to date.", + "resolution": "From the Apple menu () in the corner of your screen choose System Preferences. Then select Software Update and select Upgrade Now. You might be asked to restart or enter your password.", + "tags": [ + "compliance", + "cis", + "template", + "cis1.1" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "operating-system-up-to-date-mac-os", + "requiresMdm": false, + "critical": true + }, + { + "name": "Automatic updates enabled", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticCheckEnabled' AND value=1 LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically check for updates.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic updates.", + "tags": [ + "compliance", + "cis", + "cis1.2" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "automatic-updates-enabled-mac-os", + "requiresMdm": true + }, + { + "name": "Automatic update downloads enabled", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticDownload' AND value=1 LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically download updates.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic update downloads.", + "tags": [ + "compliance", + "cis", + "cis1.3" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "automatic-update-downloads-enabled-mac-os", + "requiresMdm": true + }, + { + "name": "Automatic installation of application updates is enabled", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticallyInstallAppUpdates' AND value=1 LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically install updates to App Store applications.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic installation of application updates.", + "tags": [ + "compliance", + "cis", + "cis1.4" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "automatic-installation-of-application-updates-is-enabled-mac-os", + "requiresMdm": true + }, + { + "name": "Automatic security and data file updates is enabled", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='CriticalUpdateInstall' AND value=1 LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically download updates to built-in macOS security tools such as malware removal tools.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic security and data update installation.", + "tags": [ + "compliance", + "cis", + "cis1.5" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "automatic-security-and-data-file-updates-is-enabled-mac-os", + "requiresMdm": true + }, + { + "name": "Automatic installation of operating system updates is enabled", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticallyInstallMacOSUpdates' AND value=1 LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically install operating system updates.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic installation of operating system updates.", + "tags": [ + "compliance", + "cis", + "cis1.6" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "automatic-installation-of-operating-system-updates-is-enabled-mac-os", + "requiresMdm": true + }, + { + "name": "Time and date are configured to be updated automatically", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.applicationaccess' AND name='forceAutomaticDateAndTime' AND value=1 LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically update the time and date.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic time and date configuration.", + "tags": [ + "compliance", + "cis", + "cis2.2.1" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "time-and-date-are-configured-to-be-updated-automatically-mac-os", + "requiresMdm": true + }, + { + "name": "Lock screen after inactivity of 20 minutes or less", + "query": "SELECT 1 WHERE EXISTS (SELECT CAST(value as integer(4)) valueint from managed_policies WHERE domain = 'com.apple.screensaver' AND name = 'askForPasswordDelay' AND valueint <= 60 LIMIT 1) AND EXISTS (SELECT CAST(value as integer(4)) valueint from managed_policies WHERE domain = 'com.apple.screensaver' AND name = 'idleTime' AND valueint <= 1140 LIMIT 1) AND EXISTS (SELECT 1 from managed_policies WHERE domain='com.apple.screensaver' AND name='askForPassword' AND value=1 LIMIT 1);", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to lock the screen after 20 minutes or less.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables the screen saver after inactivity of 20 minutes or less.", + "tags": [ + "compliance", + "cis", + "cis2.3.1", + "cis5.8" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "lock-screen-after-inactivity-of-20-minutes-or-less-mac-os", + "requiresMdm": true + }, + { + "name": "Internet sharing is blocked", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.MCX' AND name='forceInternetSharingOff' AND value='1' LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent Internet sharing.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that prevents Internet sharing.", + "tags": [ + "compliance", + "cis", + "cis2.4.2" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "internet-sharing-is-blocked-mac-os", + "requiresMdm": true + }, + { + "name": "Content caching is disabled", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.applicationaccess' AND name='allowContentCaching' AND value='0' LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to disable content caching.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables content caching.", + "tags": [ + "compliance", + "cis", + "cis2.4.10" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "content-caching-is-disabled-mac-os", + "requiresMdm": true + }, + { + "name": "Ad tracking is limited", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.AdLib' AND name='forceLimitAdTracking' AND value='1' LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to limit advertisement tracking.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables advertisement tracking.", + "tags": [ + "compliance", + "cis", + "cis2.5.6" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "ad-tracking-is-limited-mac-os", + "requiresMdm": true + }, + { + "name": "iCloud Desktop and Document sync is disabled", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.icloud.managed' AND name='DisableCloudSync' AND value='1' LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent iCloud Desktop and Documents sync.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile to prevent iCloud Desktop and Documents sync.", + "tags": [ + "compliance", + "cis", + "cis2.6.1.4" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "i-cloud-desktop-and-document-sync-is-disabled-mac-os", + "requiresMdm": true + }, + { + "name": "Firewall logging is enabled", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.security.firewall' AND name='EnableLogging' AND value='1' LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to log firewall activity.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables firewall logging.", + "tags": [ + "compliance", + "cis", + "cis3.6" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "firewall-logging-is-enabled-mac-os", + "requiresMdm": true + }, + { + "name": "Guest account disabled", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.loginwindow' AND name='DisableGuestAccount' AND value='1' LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent the use of a guest account.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables the guest account.", + "tags": [ + "compliance", + "cis", + "cis6.1.3" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "guest-account-disabled-mac-os", + "requiresMdm": true + }, + { + "name": "Guest access to shared folders is disabled", + "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.AppleFileServer' AND name='guestAccess' AND value='0' LIMIT 1;", + "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent guest access to shared folders.", + "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that prevents guest access to shared folders.", + "tags": [ + "compliance", + "cis", + "cis6.1.4" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "policy", + "slug": "guest-access-to-shared-folders-is-disabled-mac-os", + "requiresMdm": true + }, + { + "name": "No 1Password emergency kit stored in desktop, documents, or downloads folders", + "query": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM file WHERE filename LIKE '%Emergency Kit%.pdf' AND (path LIKE '/Users/%/Desktop/%' OR path LIKE '/Users/%/Documents/%' OR path LIKE '/Users/%/Downloads/%' OR path LIKE '/Users/Shared/%'));", + "description": "Looks for PDF files with file names typically used by 1Password for emergency recovery kits. To protect the performance of your devices, the search is one level deep and limited to the Desktop, Documents, Downloads, and Shared folders.", + "resolution": "Delete 1Password emergency kits from your computer, and empty the trash. 1Password emergency kits should only be printed and stored in a physically secure location.", + "platform": "darwin", + "tags": [ + "compliance", + "built-in" + ], + "contributors": [ + { + "name": "nonpunctual", + "handle": "nonpunctual", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/nonpunctual" + } + ], + "kind": "policy", + "slug": "no-1-password-emergency-kit-stored-in-desktop-documents-or-downloads-folders-mac-os", + "requiresMdm": false + }, + { + "name": "Discover TLS certificates", + "platform": "linux, windows, darwin", + "description": "Retrieves metadata about TLS certificates for servers listening on the local machine. Enables mTLS adoption analysis and cert expiration notifications.", + "query": "SELECT * FROM curl_certificate WHERE hostname IN (SELECT DISTINCT 'localhost:'||port FROM listening_ports WHERE protocol=6 AND address!='127.0.0.1' AND address!='::1');", + "purpose": "Informational", + "tags": [ + "network", + "tls" + ], + "contributors": [ + { + "name": "nabilschear", + "handle": "nabilschear", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/nabilschear" + } + ], + "kind": "query", + "slug": "discover-tls-certificates", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Discover Python Packages from Running Python Interpreters", + "platform": "linux, darwin", + "description": "Attempt to discover Python environments (in cwd, path to the python binary, and process command line) from running python interpreters and collect Python packages from those environments.", + "query": "SELECT * FROM python_packages WHERE directory IN (SELECT DISTINCT directory FROM (SELECT SUBSTR(path,0,INSTR(path,'/bin/'))||'/lib' AS directory FROM processes WHERE path LIKE '%/bin/%' AND path LIKE '%python%' UNION SELECT SUBSTR(cmdline,0,INSTR(cmdline,'/bin/'))||'/lib' AS directory FROM processes WHERE cmdline LIKE '%python%' AND cmdline LIKE '%/bin/%' AND path LIKE '%python%' UNION SELECT cwd||'/lib' AS directory FROM processes WHERE path LIKE '%python%'));", + "purpose": "Informational", + "tags": [ + "compliance", + "hunting" + ], + "contributors": [ + { + "name": "nabilschear", + "handle": "nabilschear", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/nabilschear" + } + ], + "kind": "query", + "slug": "discover-python-packages-from-running-python-interpreters", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Identify the default mail, http and ftp applications", + "platforms": "macOS", + "platform": "darwin", + "description": "Lists the currently enabled applications configured to handle mailto, http and ftp schemes.", + "query": "SELECT * FROM app_schemes WHERE (scheme='mailto' OR scheme='http' OR scheme='ftp') AND enabled='1';", + "purpose": "Informational", + "tags": [ + "compliance", + "hunting" + ], + "contributors": [ + { + "name": "brunerd", + "handle": "brunerd", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/brunerd" + } + ], + "kind": "query", + "slug": "identify-the-default-mail-http-and-ftp-applications", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Firewall enabled, domain profile ", + "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\EnableFirewall' AND CAST(data as integer) = 1;", + "description": "Checks if a Group Policy configures the computer to enable the domain profile for Windows Firewall. The domain profile applies to networks where the host system can authenticate to a domain controller. Some auditors requires that this setting is configured by a Group Policy.", + "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the domain profile for Windows Firewall.", + "platforms": "Windows", + "tags": [ + "compliance", + "cis", + "cis9.1.1" + ], + "platform": "windows", + "contributors": [ + { + "name": "defensivedepth", + "handle": "defensivedepth", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/defensivedepth" + } + ], + "kind": "policy", + "slug": "firewall-enabled-domain-profile-windows", + "requiresMdm": false + }, + { + "name": "Firewall enabled, private profile ", + "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile\\EnableFirewall' AND CAST(data as integer) = 1;", + "description": "Checks if a Group Policy configures the computer to enable the private profile for Windows Firewall. The private profile applies to networks where the host system is connected to a private or home network. Some auditors requires that this setting is configured by a Group Policy.", + "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the private profile for Windows Firewall.", + "platforms": "Windows", + "tags": [ + "compliance", + "cis", + "cis9.2.1" + ], + "platform": "windows", + "contributors": [ + { + "name": "defensivedepth", + "handle": "defensivedepth", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/defensivedepth" + } + ], + "kind": "policy", + "slug": "firewall-enabled-private-profile-windows", + "requiresMdm": false + }, + { + "name": "Firewall enabled, public profile ", + "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\EnableFirewall' AND CAST(data as integer) = 1;", + "description": "Checks if a Group Policy configures the computer to enable the public profile for Windows Firewall. The public profile applies to networks where the host system is connected to public networks such as Wi-Fi hotspots at coffee shops and airports. Some auditors requires that this setting is configured by a Group Policy.", + "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the public profile for Windows Firewall.", + "platforms": "Windows", + "tags": [ + "compliance", + "cis", + "cis9.3.1" + ], + "platform": "windows", + "contributors": [ + { + "name": "defensivedepth", + "handle": "defensivedepth", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/defensivedepth" + } + ], + "kind": "policy", + "slug": "firewall-enabled-public-profile-windows", + "requiresMdm": false + }, + { + "name": "SMBv1 client driver disabled ", + "query": "SELECT 1 FROM windows_optional_features WHERE name = 'SMB1Protocol-Client' AND state != 1;", + "description": "Checks that the SMBv1 client is disabled.", + "resolution": "Contact your IT administrator to discuss disabling SMBv1 on your system.", + "platforms": "Windows", + "tags": [ + "compliance", + "cis", + "cis18.3.2", + "built-in" + ], + "platform": "windows", + "contributors": [ + { + "name": "defensivedepth", + "handle": "defensivedepth", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/defensivedepth" + } + ], + "kind": "policy", + "slug": "sm-bv-1-client-driver-disabled-windows", + "requiresMdm": false + }, + { + "name": "SMBv1 server disabled ", + "query": "SELECT 1 FROM windows_optional_features WHERE name = 'SMB1Protocol-Server' AND state != 1", + "description": "Checks that the SMBv1 server is disabled.", + "resolution": "Contact your IT administrator to discuss disabling SMBv1 on your system.", + "platforms": "Windows", + "tags": [ + "compliance", + "cis", + "cis18.3.3", + "built-in" + ], + "platform": "windows", + "contributors": [ + { + "name": "defensivedepth", + "handle": "defensivedepth", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/defensivedepth" + } + ], + "kind": "policy", + "slug": "sm-bv-1-server-disabled-windows", + "requiresMdm": false + }, + { + "name": "Link-Local Multicast Name Resolution (LLMNR) disabled ", + "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient\\EnableMulticast' AND CAST(data as integer) = 0;", + "description": "Checks if a Group Policy configures the computer to disable LLMNR. Disabling LLMNR can prevent malicious actors from gaining access to the computer's credentials. Some auditors require that this setting is configured by a Group Policy.", + "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that disables LLMNR on your system.", + "platforms": "Windows", + "tags": [ + "compliance", + "cis", + "cis18.5.4.2" + ], + "platform": "windows", + "contributors": [ + { + "name": "defensivedepth", + "handle": "defensivedepth", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/defensivedepth" + } + ], + "kind": "policy", + "slug": "link-local-multicast-name-resolution-llmnr-disabled-windows", + "requiresMdm": false + }, + { + "name": "Automatic updates enabled ", + "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate' AND CAST(data as integer) = 0;", + "description": "Checks if a Group Policy configures the computer to enable Automatic Updates. When enabled, the computer downloads and installs security and other important updates automatically. Some auditors require that this setting is configured by a Group Policy.", + "resolution": "Contact your IT administrator to ensure your computer is receiving a Group policy that enables Automatic Updates.", + "platforms": "Windows", + "tags": [ + "compliance", + "cis", + "cis18.9.108.2.1" + ], + "platform": "windows", + "contributors": [ + { + "name": "defensivedepth", + "handle": "defensivedepth", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/defensivedepth" + } + ], + "kind": "policy", + "slug": "automatic-updates-enabled-windows", + "requiresMdm": false + }, + { + "name": "Identify Apple development secrets", + "query": "SELECT * FROM keychain_items WHERE label LIKE '%ABCDEFG%';", + "description": "Identifies certificates associated with Apple development signing and notarization. Replace ABCDEFG with your company's identifier.", + "tags": [ + "compliance", + "inventory", + "built-in" + ], + "platform": "darwin", + "contributors": [ + { + "name": "GuillaumeRoss", + "handle": "GuillaumeRoss", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/GuillaumeRoss" + } + ], + "kind": "query", + "slug": "identify-apple-development-secrets-mac-os", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Geolocate via ipapi.co", + "platform": "darwin, linux, windows", + "description": "Geolocate a host using the [ipapi.co](https://ipapi.co) in an emergency. Requires the curl table. [Learn more](https://fleetdm.com/guides/locate-assets-with-osquery).", + "query": "SELECT JSON_EXTRACT(result, '$.ip') AS ip, JSON_EXTRACT(result, '$.city') AS city, JSON_EXTRACT(result, '$.region') AS region, JSON_EXTRACT(result, '$.country') AS country, JSON_EXTRACT(result, '$.latitude') AS latitude, JSON_EXTRACT(result, '$.longitude') AS longitude FROM curl WHERE url = 'http://ipapi.co/json';", + "purpose": "inventory", + "tags": [ + "inventory" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "geolocate-via-ipapi-co", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get Crowdstrike Falcon network content filter status", + "platform": "darwin", + "description": "Get the status of the Crowdstrike Falcon network content filter (as in \"System Settings\" > \"Network > \"Filters\").", + "query": "/* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first \"Enabled\" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;", + "purpose": "Informational", + "tags": [ + "crowdstrike", + "plist", + "network", + "content filter" + ], + "contributors": [ + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "get-crowdstrike-falcon-network-content-filter-status", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "Get a list of Visual Studio Code extensions", + "platform": "darwin, linux, windows", + "description": "Get a list of installed VS Code extensions (requires osquery > 5.11.0).", + "query": "SELECT u.username, vs.* FROM users u CROSS JOIN vscode_extensions vs USING (uid);\n", + "purpose": "Informational", + "tags": [ + "inventory" + ], + "contributors": [ + { + "name": "lucasmrod", + "handle": "lucasmrod", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/lucasmrod" + }, + { + "name": "sharon-fdm", + "handle": "sharon-fdm", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/sharon-fdm" + }, + { + "name": "zwass", + "handle": "zwass", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/zwass" + } + ], + "kind": "query", + "slug": "get-a-list-of-visual-studio-code-extensions", + "resolution": "N/A", + "requiresMdm": false + }, + { + "name": "List osquery table names", + "platform": "darwin, linux, windows", + "description": "List all table names in the schema of the currently installed version of osquery", + "query": "SELECT DISTINCT name FROM osquery_registry;", + "purpose": "Informational", + "tags": [ + "fleet", + "osquery", + "table", + "schema" + ], + "contributors": [ + { + "name": "nonpunctual", + "handle": "nonpunctual", + "avatarUrl": "https://placekitten.com/200/200", + "htmlUrl": "https://github.com/nonpunctual" + } + ], + "kind": "query", + "slug": "list-osquery-table-names", + "resolution": "N/A", + "requiresMdm": false + } + ], + "queryLibraryYmlRepoPath": "docs/01-Using-Fleet/standard-query-library/standard-query-library.yml", + "pricingTable": [ + { + "industryName": "Managed cloud", + "description": "Have Fleet host it for you (currently only available for customers with 300+ hosts. PS. Wish we could host for you? We're working on it! Please let us know if you know of a good partner. In the meantime, join fleetdm.com/support and we're happy to help you deploy Fleet yourself.)", + "pricingTableCategories": [ + "Deployment" + ], + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "name": "Managed cloud" + }, + { + "industryName": "Self-hosted", + "friendlyName": "Host it yourself", + "description": "Deploy Fleet anywhere and host it yourself, even in air-gapped environments except where technologically impossible.", + "pricingTableCategories": [ + "Deployment" + ], + "documentationUrl": "https://fleetdm.com/docs/deploy/introduction", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "buzzwords": [ + "Self-hosted" + ], + "name": "Self-hosted" + }, + { + "industryName": "Multi-tenancy", + "description": "For managed service providers to use a single instance of Fleet for multiple customers.", + "documentationUrl": "https://github.com/fleetdm/fleet/issues/9956", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Deployment" + ], + "usualDepartment": "IT", + "buzzwords": [ + "OEM", + "Private label", + "House brand", + "Clear label", + "Multi-tenancy" + ], + "tier": "Premium", + "name": "Multi-tenancy" + }, + { + "industryName": "Deployment tools", + "description": "Pre-built Terraform modules and Helm charts to help you get up and running.", + "documentationUrl": "https://fleetdm.com/docs/deploy/introduction", + "usualDepartment": "IT", + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Deployment" + ], + "name": "Deployment tools" + }, + { + "industryName": "Private update registry", + "friendlyName": "Update agents from a secret URL", + "description": "Load agent code from a secret URL that you manage.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/update-agents", + "tier": "Premium", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Configuration" + ], + "usualDepartment": "Security", + "name": "Private update registry" + }, + { + "industryName": "Control agent versions", + "description": "Manage agents remotely by setting different versions per-baseline.", + "documentationUrl": "https://fleetdm.com/docs/configuration/agent-configuration#configure-fleetd-update-channels", + "tier": "Premium", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Configuration" + ], + "usualDepartment": "IT", + "waysToUse": [ + { + "description": "Supply-chain Levels for Software Artifacts (SLSA) attestations for the fleetd binary artifacts and server container image to enable verification that the binaries are built and uploaded using GitHub Actions from the Fleet repository at a particular commit SHA coming soon (2024-12-31)." + }, + { + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/20219" + } + ], + "name": "Control agent versions" + }, + { + "industryName": "Command line tool (CLI)", + "friendlyName": "fleetctl", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleetctl-cli", + "productCategories": [ + "Endpoint operations", + "Device management" + ], + "pricingTableCategories": [ + "Configuration" + ], + "usualDepartment": "IT", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "name": "Command line tool (CLI)" + }, + { + "industryName": "GitOps", + "friendlyName": "Manage endpoints in git", + "documentationUrl": "https://github.com/fleetdm/fleet-gitops", + "description": "Fork the best practices GitHub repo and use the included GitHub Actions or GitLab CI/CD pipelines to quickly automate Fleet console and configuration workflow management.", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Configuration" + ], + "usualDepartment": "IT", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "demos": { + "description": "A top savings and investment company wanted workflows and automation so that one bad actor can't brick their fleet. This way, they have to make a pull request first.", + "quote": "I don't want one bad actor to brick my fleet. I want them to make a pull request first.", + "moreInfoUrl": "https://docs.google.com/document/d/1hAQL6P--Tt3syq1MTRONAxhQA_2Vjt3oOJJt_O4xbiE/edit?disco=AAABAVnYvns&usp_dm=true#heading=h.7en766pueek4" + }, + "name": "GitOps" + }, + { + "industryName": "Two-factor authentication", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/5478", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Configuration" + ], + "usualDepartment": "IT", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "waysToUse": [ + { + "description": "Enforce two-factor authentication when logging in to Fleet for added security." + } + ], + "comingSoonOn": "2024-12-31", + "name": "Two-factor authentication", + "comingSoon": true + }, + { + "industryName": "Role-based access control", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/manage-access#manage-access", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Configuration" + ], + "usualDepartment": "IT", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "name": "Role-based access control" + }, + { + "industryName": "Audit logging", + "description": "Log all activity, including queries, scripts, access, etc.", + "demos": [ + { + "description": "See activities for enabling/disabling the activities webhook and editing the destination URL so that I can know when the activities webhook was modified and by who.", + "moreInfoUrl": "https://youtu.be/3Fndgrsk-Ss" + } + ], + "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#list-activities", + "productCategories": [ + "Endpoint operations", + "Device management" + ], + "pricingTableCategories": [ + "Configuration" + ], + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "usualDepartment": "Security", + "waysToUse": [ + { + "description": "Export activity of Fleet admins to your SIEM or data lake" + } + ], + "name": "Audit logging" + }, + { + "industryName": "Scope transparency", + "description": "Let end users see the source code for exactly how they are being monitored, and set clear expectations about what is and isn’t acceptable use of work computers.", + "tier": "Free", + "documentationUrl": "https://fleetdm.com/transparency", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Configuration" + ], + "name": "Scope transparency" + }, + { + "industryName": "Cross-platform MDM support", + "description": "Apple, Windows, and Linux.", + "documentationUrl": "https://fleetdm.com/announcements/debunk-the-cross-platform-myth", + "tier": "Premium", + "jamfProHasFeature": "appleOnly", + "jamfProtectHasFeature": "no", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "name": "Cross-platform MDM support" + }, + { + "industryName": "MDM migration", + "description": "Easily move your devices from your current MDM solution to Fleet.", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-migration-guide", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "name": "MDM migration" + }, + { + "industryName": "Zero-touch setup", + "description": "Zero-touch setup for macOS, iOS/iPadOS, and Windows.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience", + "tier": "Premium", + "jamfProHasFeature": "appleOnly", + "jamfProtectHasFeature": "no", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "waysToUse": [ + { + "description": "Ship a macOS, iOS, or iPadOS device to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup." + }, + { + "description": "Ship a Windows workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup." + }, + { + "description": "Customize the out-of-the-box setup experience for your end users." + }, + { + "description": "Install a bootstrap package to run custom scripts during the setup experience." + }, + { + "description": "Require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new workstation" + } + ], + "demos": [ + { + "description": "Install a bootstrap package to run custom scripts during the setup experience to enforce required configurations.", + "moreInfoUrl": "https://youtu.be/gt7_dAU0VMY" + }, + { + "description": "Connect end users to Wi-Fi by adding your SCEP server.", + "moreInfoUrl": "https://youtu.be/secV4NCGYPg" + } + ], + "name": "Zero-touch setup" + }, + { + "industryName": "Bring your own device (BYOD) enrollment", + "description": "BYOD enrollment for macOS, iOS/iPadOS, Windows, and Android (coming soon) devices.", + "documentationUrl": "https://fleetdm.com/guides/sysadmin-diaries-device-enrollment#byod-enrollment", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "waysToUse": [ + { + "description": "Support ACME as a protocol for MDM certificate generation. Coming soon (2025-03-31)", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/15611" + } + ], + "name": "Bring your own device (BYOD) enrollment" + }, + { + "industryName": "User account sync", + "description": "Sync user accounts via Okta, AD, or any IDP.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "IT", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "waysToUse": [ + { + "description": "Automatically set admin access to Fleet based on your IDP" + } + ], + "name": "User account sync" + }, + { + "industryName": "Human-endpoint mapping", + "friendlyName": "See who logs in on every computer", + "description": "Identify who logs in to any system, including login history and current sessions. Look up any host by the email address of the person using it.", + "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#get-hosts-google-chrome-profiles", + "screenshotSrc": null, + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "IT", + "buzzwords": [ + "Device users", + "human-to-device mapping" + ], + "dri": "mikermcneil", + "demos": [ + { + "description": "Security engineers at a top gaming company wanted to get demographics off their macOS, Windows, and Linux machines about who the user is and who's logged in.", + "moreInfoUrl": "https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit" + }, + { + "description": "Data engineers at a top biotech corporation needed to know who is logged into their devices.", + "quote": "So we don't know exactly what's going on after we deploy the device, we know that they are compliant with the security because we are running these stuff, but we don't know certainly who is running, who is logging in the device?", + "moreInfoUrl": "https://docs.google.com/document/d/17MNI5ykzlFjdVmQ8SPMrT1oR_hY_vkYAJx31F7l7Pv8/edit#heading=h.7en766pueek4" + } + ], + "waysToUse": [ + { + "description": "Look up computer by ActiveDirectory account" + }, + { + "description": "Find device by Google Chrome user" + }, + { + "description": "Identify who logs in to any system, including login history and current sessions." + }, + { + "description": "Look up any host by the email address of the person using it." + }, + { + "description": "Check user login history", + "moreInfoUrl": "https://www.lepide.com/how-to/audit-who-logged-into-a-computer-and-when.html#:~:text=To%20find%20out%20the%20details,logs%20in%20%E2%80%9CWindows%20Logs%E2%80%9D." + }, + { + "description": "See currently logged in users", + "moreInfoUrl": "https://www.top-password.com/blog/see-currently-logged-in-users-in-windows/" + }, + { + "description": "Get demographics off of our machines about who the user is and who's logged in", + "moreInfoUrl": "https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit" + }, + { + "description": "See what servers someone is logged-in on", + "moreInfoUrl": "https://community.spiceworks.com/topic/138171-is-there-a-way-to-see-what-servers-someone-is-logged-in-on" + } + ], + "name": "Human-endpoint mapping" + }, + { + "industryName": "Device inventory", + "description": "Includes a list of all devices and all hardware and software attributes for each device.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/understanding-host-vitals", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14415", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "usualDepartment": "IT", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "waysToUse": [ + { + "description": "Implement software inventory recommendations from the SANS 20 / CIS 18.", + "moreInfoUrl": "https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4" + }, + { + "description": "View a list of all hardware attributes of a device.", + "moreInfoUrl": "https://fleetdm.com/tables/system_info" + }, + { + "description": "View a list of all software and their versions installed on all your hosts.", + "moreInfoUrl": "https://fleetdm.com/docs/get-started/anatomy#software-library" + }, + { + "description": "View a list of software rolled up by title.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14674" + }, + { + "description": "Implement hardware and infrastructure inventory recommendations from the SANS 20 / CIS 18.", + "moreInfoUrl": "https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4" + } + ], + "name": "Device inventory" + }, + { + "industryName": "Search inventory", + "description": "Search devices by IP, serial, hostname, and UUID.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/learn-how-to-use-fleet#how-to-ask-questions-about-your-device", + "productCategories": [ + "Endpoint operations", + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "IT", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "name": "Search inventory" + }, + { + "industryName": "Targeted device scoping", + "description": "Organize devices with Teams and Labels.", + "documentationUrl": "https://fleetdm.com/guides/managing-labels-in-fleet", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "name": "Targeted device scoping" + }, + { + "industryName": "Enforce disk encryption", + "description": "Encrypt system drives on macOS, Windows, and Linux, manage escrowed encryption keys, and report on disk encryption status (FileVault, BitLocker, LUKS).", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-disk-encryption", + "friendlyName": "Ensure hard disks are encrypted", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "Security", + "tier": "Premium", + "jamfProHasFeature": "appleOnly", + "jamfProtectHasFeature": "no", + "waysToUse": [ + { + "description": "Report on disk encryption status" + }, + { + "description": "Encrypt hard disks on macOS with FileVault" + }, + { + "description": "Escrow FileVault keys on macOS" + }, + { + "description": "Encrypt hard disks on Windows with BitLocker." + } + ], + "name": "Enforce disk encryption" + }, + { + "industryName": "Enforce operating system (OS) updates", + "description": "Keep operating systems up to date for macOS, iOS/iPadOS, Windows, and Android (coming soon) devices.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-macos-updates", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "usualDepartment": "IT", + "productCategories": [ + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "waysToUse": [ + { + "description": "Enforce macOS updates via Nudge." + }, + { + "description": "Progressively enhance from Nudge to DDM-based OS updates.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/17295" + }, + { + "description": "Automatically update Windows after the end user reaches a deadline." + } + ], + "name": "Enforce operating system (OS) updates" + }, + { + "industryName": "Enforce OS settings", + "description": "MDM support for macOS, iOS/iPadOS, Windows, and Android (coming soon) devices. Management support for Linux.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-custom-os-settings", + "usualDepartment": "IT", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "waysToUse": [ + { + "description": "Deploy configuration profiles on macOS and Windows and verify that they're installed.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/13281" + }, + { + "description": "Deploy custom declaration (DDM) profiles on macOS.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14550" + }, + { + "description": "Target profiles to specific hosts using SQL.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/17315" + }, + { + "description": "Automatically re-deploy configuration profiles when they're not installed." + }, + { + "description": "Deploy configuration profiles on iOS/iPadOS." + }, + { + "description": "See a list of the upcoming MDM commands and scripts in unified queue. Coming soon (2024-07-15)", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/15920" + }, + { + "description": "Send MDM commands to tell end users to update their OS.", + "moreInfoUrl": "https://developer.apple.com/documentation/devicemanagement/schedule_an_os_update" + }, + { + "description": "Configure agent options remotely, over the air. (Includes osquery config, and osquery startup flags.).", + "moreInfoUrl": "https://fleetdm.com/docs/configuration/agent-configuration" + } + ], + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "name": "Enforce OS settings" + }, + { + "industryName": "Declarative Device Management (DDM) support for configuration profiles", + "description": "Full support for Apple DDM configuration profiles.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-os-updates#macos", + "tier": "Free", + "jamfProHasFeature": "cloudOnly", + "jamfProtectHasFeature": "cloudOnly", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "name": "Declarative Device Management (DDM) support for configuration profiles" + }, + { + "industryName": "Device health", + "friendlyName": "Automate device health", + "description": "Automatically report system health issues using webhooks or integrations, to notify or quarantine outdated or misconfigured systems that are at higher risk of vulnerabilities or theft.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/automations#automations", + "screenshotSrc": null, + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "yes", + "productCategories": [ + "Device management", + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "IT", + "dri": "mikermcneil", + "buzzwords": [ + "Device trust", + "Zero trust", + "Layer 7 device trust", + "Beyondcorp", + "Device attestation", + "Conditional access" + ], + "waysToUse": [ + { + "description": "Automatically manage the behavior of endpoints that are at higher risk of vulnerabilities or data loss due to their configuration or patch level." + }, + { + "description": "Block access to corporate apps for users whose devices with unexpected settings, like disabled screen lock, passwords that are too short, unencrypted hard disks, and more" + }, + { + "description": "Quickly implement conditional access based on device health using osquery and a simple device health REST API.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14920" + }, + { + "description": "Control and restore access to applications by automatically restricting access when devices do not meet particular security requirements.", + "moreInfoUrl": "https://duo.com/docs/device-health" + } + ], + "demos": [ + { + "description": "Control which laptop and desktop devices can access corporate apps and websites based on what vulnerabilities it might be exposed to based on how the device is configured, whether it's up to date, its MDM enrollment status, and anything else you can build in a SQL query of Fleet's 300 data tables representing information about enrolled host systems. Coming soon (2024-09-30).", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/16236" + }, + { + "description": "Implement multivariate device trust", + "moreInfoUrl": "https://youtu.be/5sFOdpMLXQg?feature=shared&t=1445" + }, + { + "description": "Implement your own version of Google's zero trust model (BeyondCorp)", + "moreInfoUrl": "https://cloud.google.com/beyondcorp" + }, + { + "description": "Get endpoint data into ServiceNow and make your asset management teams happy", + "moreInfoUrl": "https://www.youtube.com/watch?v=aVbU6_9JoM0" + }, + { + "description": "Monitor devices that don't meet your organization's custom security policies" + }, + { + "description": "Quickly report your posture and vulnerabilities to auditors, showing remediation status and timing." + }, + { + "description": "Keep your devices compliant with customizable baselines, or use common benchmarks like CIS." + }, + { + "description": "Discover security misconfigurations that increase attack surface." + }, + { + "description": "Detect suspcious services listening on open ports that should not be connected to the internet, such as Remote Desktop Protocol (RDP).", + "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20statename%20%3D%20%E2%80%9CEnabled%E2%80%9D-,OPEN%20SOCKETS,-Lastly%2C%20an%20examination" + }, + { + "description": "Discover potentially unwanted programs that increase attack surface.", + "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/" + }, + { + "description": "Detect self-signed certifcates" + }, + { + "description": "Detect legacy protocols with safer versions", + "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20self_signed%20%3D%201%3B-,LEGACY%20PROTOCOLS,-This%20section%20will" + }, + { + "description": "Detect exposed secrets on the command line", + "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WDigest%20is%20disabled.-,EXPOSED%20SECRETS,-Often%2C%20to%20create" + }, + { + "description": "Detect and surface issues with devices" + }, + { + "description": "Share device health reports" + }, + { + "description": "Align endpoints with your security policies", + "moreInfoUrl": "https://www.axonius.com/use-cases/cmdb-reconciliation" + }, + { + "description": "Maximize security control coverage" + }, + { + "description": "Uncover gaps in security policies, configurations, and hygiene", + "moreInfoUrl": "https://www.axonius.com/use-cases/coverage-gap-discovery" + }, + { + "description": "Automatically apply security policies to protect endpoints against attack." + }, + { + "description": "Surface security issues in all your deployed endpoints even data centers and factories." + }, + { + "description": "Continually validate controls and policies" + }, + { + "description": "Block access to corporate apps if your end users are failing a specific number of critical policies.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/16206" + }, + { + "description": "A large tech company used the Fleet API to block access to corporate apps for outdated operating system versions with certain \"celebrity\" vulnerabilities.", + "moreInfoUrl": "https://play.goconsensus.com/s4e490bb9" + } + ], + "name": "Device health" + }, + { + "industryName": "Application deployment", + "description": "Deploy applications on macOS, iOS/iPadOS, Linux, Windows, and Android (coming soon). Additionally, install macOS and iOS/iPadOS apps from the App Store.", + "documentationUrl": "https://fleetdm.com/guides/deploy-software-packages", + "tier": "Premium", + "jamfProHasFeature": "appleOnly", + "jamfProtectHasFeature": "no", + "isExperimental": "yes", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/18867", + "waysToUse": [ + { + "description": "Easily configure and install SentinelOne, Crowdstrike, and other security tools.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14921" + }, + { + "description": "Offer licenses for Photoshop and other App Sore apps for your end users." + }, + { + "description": "iOS/iPadOS coming soon (2024-08-11).", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14899" + } + ], + "name": "Application deployment" + }, + { + "industryName": "Self-service application installation", + "description": "Allow end users to install apps through Fleet Desktop for macOS, Linux, and Windows.", + "documentationUrl": "https://fleetdm.com/guides/deploy-software-packages", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "isExperimental": "yes", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/17587", + "waysToUse": [ + { + "description": "Build scripts for Ansible deployments", + "moreInfoUrl": "https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4" + }, + { + "description": "Deploy osquery to macOS via Jamf", + "moreInfoUrl": "https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4" + }, + { + "description": "Package osquery for Linux servers via Workspace One and Windows servers via group policies", + "moreInfoUrl": "https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4" + } + ], + "name": "Self-service application installation" + }, + { + "industryName": "Application management", + "description": "Manage updates and apps on macOS, Windows, and Linux computers.", + "tier": "Premium", + "jamfProHasFeature": "appleOnly", + "jamfProtectHasFeature": "no", + "comingSoonOn": "2024-08-25", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/18865", + "name": "Application management", + "comingSoon": true + }, + { + "industryName": "Script execution", + "friendlyName": "Safely execute custom scripts (macOS, Windows, and Linux)", + "description": "Deploy and execute custom scripts using a REST API, and manage your library of scripts in the UI or a git repo.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/scripts", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "dri": "mikermcneil", + "usualDepartment": "IT", + "productCategories": [ + "Endpoint operations", + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "demos": [ + { + "description": "A large tech company used scripts to fix issues with their security and compliance agents on workstations.", + "moreInfoUrl": "https://youtu.be/o1G0YZAsWzI" + } + ], + "buzzwords": [ + "Remote script execution", + "PowerShell scripts", + "Bash scripts" + ], + "waysToUse": [ + { + "description": "Execute custom macOS scripts (client platform engineering)", + "moreInfoUrl": "https://www.hexnode.com/blogs/executing-custom-mac-scripts-via-mdm/" + }, + { + "description": "Execute custom Windows scripts (client platform engineering)", + "moreInfoUrl": "https://www.hexnode.com/blogs/executing-custom-windows-scripts-via-mdm/" + }, + { + "description": "Use PowerShell scripts on Windows devices", + "moreInfoUrl": "https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension" + }, + { + "description": "Run PowerShell scripts for remediations (security engineering)", + "moreInfoUrl": "https://learn.microsoft.com/en-us/mem/intune/fundamentals/powershell-scripts-remediation" + }, + { + "description": "Download and run remediation scripts", + "moreInfoUrl": "https://help.zscaler.com/deception/downloading-and-running-remediation-script" + }, + { + "description": "Deploy custom scripts", + "moreInfoUrl": "https://scalefusion.com/custom-scripting" + }, + { + "description": "Run scripts on online/offline hosts", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/15529" + }, + { + "description": "Only maintainers and admins can run scripts.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/19055" + } + ], + "name": "Script execution" + }, + { + "industryName": "Device remediation", + "description": "Use Fleet Policies to detect the device state. Automate remediations for issues or allow users to remediate problems in self-service (Fleet Desktop > My device page).", + "documentationUrl": "https://fleetdm.com/securing/end-user-self-remediation", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "usualDepartment": "IT", + "productCategories": [ + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "waysToUse": [ + { + "description": "Send software vulnerability emails to end users to encourage self-remediation." + } + ], + "name": "Device remediation" + }, + { + "industryName": "Maintenance windows", + "friendlyName": "Fleet in your calendar", + "description": "Create a calendar event to auto-remediate failing policies when your end users are free.", + "documentationUrl": "https://github.com/fleetdm/fleet/issues/17230", + "tier": "Premium", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "isExperimental": "yes", + "productCategories": [ + "Device management", + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "name": "Maintenance windows" + }, + { + "industryName": "Send lock and wipe commands", + "description": "Secure your devices with remote lock and wipe commands if lost or stolen.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-commands", + "waysToUse": [ + { + "description": "High-level remote lock for macOS, Windows, and Linux.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/9949" + }, + { + "description": "High-level remote wipe for macOS, Windows, and Linux.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/9951" + } + ], + "tier": "Premium", + "jamfProHasFeature": "appleOnly", + "jamfProtectHasFeature": "no", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Devices" + ], + "name": "Send lock and wipe commands" + }, + { + "industryName": "Queries", + "description": "Scheduled or saved queries with optional AI-generated descriptions, and, live queries for real-time data collection.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleet-ui", + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "IT", + "demos": [ + { + "description": "A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.", + "moreInfoUrl": "https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6" + } + ], + "name": "Queries" + }, + { + "industryName": "Query performance monitoring", + "documentationUrl": "https://fleetdm.com/docs/get-started/faq#will-fleet-slow-down-my-servers-what-about-my-employee-laptops", + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "demos": [ + { + "description": "A top software company needed to understand the performance impact of osquery queries before running them on all of their production Linux servers.", + "moreInfoUrl": "https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg" + }, + { + "description": "A top software company wanted to detect regressions when adding/changing queries and fail builds if queries were too expensive.", + "moreInfoUrl": "https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg" + } + ], + "waysToUse": [ + { + "description": "Monitor performance for automated queries." + }, + { + "description": "Monitor performance for live queries.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/467" + } + ], + "name": "Query performance monitoring" + }, + { + "industryName": "Custom tables", + "friendlyName": "Add tables to osquery with extensions", + "description": "Create your own osquery tables, extensions & automatic table configurations or disable existing tables to maintain PII or privacy.", + "documentationUrl": "https://fleetdm.com/docs/configuration/agent-configuration#extensions", + "moreInfoUrl": "https://github.com/trailofbits/osquery-extensions/blob/3df2b72ad78549e25344c79dbc9bce6808c4d92a/README.md#extensions", + "tier": "Premium", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "IT", + "name": "Custom tables" + }, + { + "industryName": "Remote settings", + "description": "Configure agent options remotely, over the air. (Includes osquery config, and osquery startup flags.).", + "documentationUrl": "https://fleetdm.com/docs/configuration/agent-configuration", + "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/13825", + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "Security", + "name": "Remote settings" + }, + { + "industryName": "Teams", + "friendlyName": "Manage different endpoints differently", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/segment-hosts", + "description": "Teams are what Fleet calls baselines, kinda like security groups or images. Every host in a team matches the same baseline, with minor exceptions. This makes it faster and less risky to maintain computers, leading to faster timelines and fewer tickets.", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "waysToUse": [ + { + "description": "Automate remediation for different applications with different security postures (cloud security engineering)" + } + ], + "name": "Teams" + }, + { + "industryName": "Labels", + "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#add-label", + "friendlyName": "Filter hosts using SQL", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "IT", + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "name": "Labels" + }, + { + "industryName": "Policies", + "description": "A policy is a specific “yes” or “no” query. Use policies to manage security compliance in your organization.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleet-ui", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "IT", + "demos": [ + { + "description": "Policy failure in Fleet to trigger a script run on a host so that I can run scripts on many hosts w/o using a third-party automation tool (ex. Tines).", + "moreInfoUrl": "https://youtu.be/o1G0YZAsWzI" + }, + { + "description": "A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.", + "moreInfoUrl": "https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6" + } + ], + "waysToUse": [ + { + "description": "Trigger a workflow based on a failing policy", + "moreInfoUrl": "https://fleetdm.com/docs/using-fleet/automations#policy-automations" + } + ], + "name": "Policies" + }, + { + "industryName": "File integrity monitoring (FIM)", + "friendlyName": "Detect changes to critical files", + "description": "Specify files to monitor for changes or deletions, then log those events to your SIEM or data lake, including key information such as filepath and checksum.", + "documentationUrl": "https://fleetdm.com/guides/osquery-evented-tables-overview#file-integrity-monitoring-fim", + "screenshotSrc": "", + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "yes", + "usualDepartment": "Security", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "dri": "mikermcneil", + "demos": [ + { + "description": "A top gaming company needed a way to monitor critical files on production Debian servers.", + "quote": "The FIM features are kind of a top priority.", + "moreInfoUrl": "https://docs.google.com/document/d/1pE9U-1E4YDiy6h4TorszrTOiFAauFiORikSUFUqW7Pk/edit" + } + ], + "buzzwords": [ + "File integrity monitoring (FIM)", + "Host-based intrusion detection system (HIDS)", + "Anomaly detection" + ], + "waysToUse": [ + { + "description": "Monitor critical files on production Debian servers" + }, + { + "description": "Detect anomalous filesystem activity", + "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring" + }, + { + "description": "Detect unintended changes", + "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring" + }, + { + "description": "Verify update status and monitor system health", + "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring" + }, + { + "description": "Meet compliance mandates", + "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring" + } + ], + "name": "File integrity monitoring (FIM)" + }, + { + "industryName": "File carving", + "description": "Write the results of complex queries to AWS S3.", + "documentationUrl": "https://fleetdm.com/docs/configuration/fleet-server-configuration#s-3-file-carving-backend", + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "usualDepartment": "Security", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "name": "File carving" + }, + { + "industryName": "Binary authorization", + "friendlyName": "Restrict what programs can run, and what files running programs can access.", + "description": null, + "documentationUrl": null, + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "dri": "mikermcneil", + "usualDepartment": "Security", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "comingSoonOn": "2025-06-30", + "buzzwords": [ + "Mandatory Access Control (MAC)", + "Privilege confinement", + "Binary authorization", + "Santa", + "Binary allowlisting", + "Binary whitelisting" + ], + "demos": [ + { + "description": null, + "moreInfoUrl": null + } + ], + "waysToUse": [ + { + "description": "Confine programs to a limited set of resources." + }, + { + "description": "Report on AppArmor events", + "moreInfoUrl": "https://fleetdm.com/tables/apparmor_events" + }, + { + "description": "Confine programs according to a set of rules that specify which files a program can access.", + "moreInfoUrl": "https://wiki.debian.org/AppArmor" + }, + { + "description": "Proactively protect the system against both known and unknown vulnerabilities." + } + ], + "name": "Binary authorization", + "comingSoon": true + }, + { + "industryName": "Reporting", + "description": "Generate reports based on searchable device attributes", + "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#get-query-report", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "IT", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "name": "Reporting" + }, + { + "industryName": "Incident response", + "friendlyName": "Interrogate hosts in real time", + "description": "Live query, triage, figuring out scope of impact, remediate using scripts or MDM commands (e.g. remote wipe), and quarantine or reimage using other systems and APIs (e.g. remove from network, decommission container)", + "documentationUrl": "https://fleetdm.com/securing/how-osquery-can-help-cyber-responders#simplifying-endpoint-visibility-with-osquery-and-fleet", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "dri": "mikermcneil", + "usualDepartment": "Security", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "buzzwords": [], + "demos": [ + { + "description": null, + "moreInfoUrl": null + } + ], + "waysToUse": [ + { + "description": null + } + ], + "name": "Incident response" + }, + { + "industryName": "Custom logging", + "description": "Flexible, configurable logging destinations (AWS Kinesis, Lambda, GCP, Kafka).", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/log-destinations#log-destinations", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "usualDepartment": "Security", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Devices" + ], + "buzzwords": [ + "Real-time export", + "Ship logs" + ], + "name": "Custom logging" + }, + { + "industryName": "Malware detection (YARA/custom IoCs)", + "friendlyName": "Scan files for zero days and malware signatures", + "description": "Use YARA signatures to report and trigger automations when zero days, malware, or unexpected files are detected on a host.", + "documentationUrl": "https://fleetdm.com/tables/yara", + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "yes", + "dri": "mikermcneil", + "usualDepartment": "Security", + "productCategories": [ + "Endpoint operations", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "buzzwords": [ + "YARA scanning", + "Cyber Threat Intelligence (CTI)", + "Indicators of compromise (IOCs)", + "Antivirus (AV)", + "Endpoint protection platform (EPP)", + "Endpoint detection and response (EDR)", + "Malware detection", + "Signature-based malware detection", + "Malware scanning", + "Malware analysis", + "Anomaly detection" + ], + "demos": [ + { + "description": "A top media company used Fleet policies with YARA rules to continuously scan host filesystems for malware signatures provided by internal and external threat intelligence teams.", + "moreInfoUrl": null + } + ], + "waysToUse": [ + { + "description": "Detect suspicious bytecode in JAR files" + }, + { + "description": "Identify suspicious patterns in binaries using YARA signatures" + }, + { + "description": "Continuously scan host filesystems for malware signatures.", + "moreInfoUrl": "https://yara.readthedocs.io/en/stable/writingrules.html" + }, + { + "description": "Monitor for relevent filesystem changes (YARA events) and on-demand YARA signature scans.", + "moreInfoUrl": "https://osquery.readthedocs.io/en/stable/deployment/yara/" + }, + { + "description": "Use YARA for malware detection", + "moreInfoUrl": "https://www.cisa.gov/sites/default/files/FactSheets/NCCIC%20ICS_FactSheet_YARA_S508C.pdf" + }, + { + "description": "Scan for indicators of compromise (IoC) for common malware.", + "moreInfoUrl": "https://github.com/Cisco-Talos/osquery_queries" + }, + { + "description": "Analyze malware using data from osquery, such as endpoint certificates and launch daemons (launchd).", + "moreInfoUrl": "https://medium.com/hackernoon/malware-analysis-using-osquery-part-3-9dc805b67d16" + }, + { + "description": "Detect persistent malware (e.g. WireLurker) in endpoints by generating simple policies that search for their static indicators of compromise (IoCs).", + "moreInfoUrl": "https://osquery.readthedocs.io/en/stable/deployment/anomaly-detection/" + }, + { + "description": "Run a targeted YARA scan with osquery as a lightweight approach to scan anything on a host filesystem, with minimal performance impact. Unlike full system YARA scans which consume considerable CPU resources, an equivalent YARA scan targeted in Fleet can be 8x cheaper (CPU %).", + "moreInfoUrl": "https://www.tripwire.com/state-of-security/signature-socket-based-malware-detection-osquery-yara" + } + ], + "name": "Malware detection (YARA/custom IoCs)" + }, + { + "industryName": "Continuous scanning", + "friendlyName": "Detect vulnerable software", + "documentationUrl": "https://fleetdm.com/vulnerability-management", + "productCategories": [ + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "usualDepartment": "Security", + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "yes", + "buzzwords": [ + "Stakeholder-specific vulnerability categorization (SSVC)", + "Continuous scanning", + "Continuous vulnerability scanning", + "Risk-based vulnerability management" + ], + "waysToUse": [ + { + "description": "Use an SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: \"Track\", \"Track*\", \"Attend\", and \"Act\".", + "moreInfoUrl": "https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc" + }, + { + "description": "Balint Fazakas: I think what offers a better use of CVSS if you break it down to vectors. You may find that a DoS (High Availability Impact) not as relevant for you, or equally a vulnerability requiring user interaction has a very low likelihood of exploit in another scenario. If you want to fine tune your SSVC, it worth using the vectors you care about instead of the score itself. But ultimately you would want to read the description of the vulnerabilities to determine the risk they are posing to your environment. SSVC can assist you to do that in a more efficient way.", + "moreInfoUrl": "https://www.linkedin.com/feed/update/urn:li:activity:7162614115025215488?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7162614115025215488%2C7162681703918985216%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287162681703918985216%2Curn%3Ali%3Aactivity%3A7162614115025215488%29" + }, + { + "description": "Melissa Bischoping: CVSS is never enough to contextualize the urgency or risk of a vulnerability in your environment. It is one metric that needs to be part of an overall risk calculus, but a CVSS of 6 can be a greater threat in your organization than a CVSS of 10 based on the environmental variables and mitigations. Only two 10.0s here, but several lower severity that are resulting in high-impact breaches. Getting a handle on managing that public facing infrastructure and being able to rapidly patch the apps and devices with such exposure needs to be part of an overall plan, but must go hand in hand with mitigations and layers of a zero trust design. CVSS isn’t the sole determination of risk, it’s only one partial piece of data to understand the impact of a vulnerability if exploited.", + "moreInfoUrl": "https://www.linkedin.com/feed/update/urn:li:activity:7162614115025215488?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7162614115025215488%2C7162629486344159232%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287162629486344159232%2Curn%3Ali%3Aactivity%3A7162614115025215488%29" + } + ], + "demos": [ + { + "description": "A top gaming company wanted to replace Qualys for infrastructure vulnerability detection.", + "quote": "So we have some stuff today through Qualys, but it's just not very good. A lot of it is...it's just really noisy. I'm trying to find out specifically, actually what packages are installed where, and then the ability to live query them.", + "moreInfoUrl": "https://docs.google.com/document/d/1JWtRsW1FUTCkZEESJj9-CvXjLXK4219by-C6vvVVyBY/edit" + }, + { + "description": "One of the world's largest, top transportation companies uses Fleet's API to email relevant, actually-installed vulnerabilities to responsible teams so they can fix them.", + "moreInfoUrl": "https://docs.google.com/document/d/1oeCmT077o_5nxzLhnxs7kcg_4Qn1Pn1F5zx10nQOAp8/edit" + } + ], + "name": "Continuous scanning" + }, + { + "industryName": "Vulnerability scores", + "friendlyName": "EPSS and CVSS", + "documentationUrl": "https://fleetdm.com/vulnerability-management", + "tier": "Premium", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "yes", + "usualDepartment": "Security", + "productCategories": [ + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "buzzwords": [ + "Risk scores", + "Cyber risk", + "Risk reduction", + "Security operations effectiveness", + "Peer benchmarking", + "Security program effectiveness", + "Risk-based exposure scoring", + "Threat context", + "Cyber exposure", + "Exposure quantification and benchmarking", + "Optimize security investments", + "Vulnerability assessment" + ], + "demos": [ + { + "description": "Fleet enables a more modern, threat-first prioritization approach to vulnerability management.", + "quote": "In reality, across our inventory of devices, it's unlikely to ever be exploited. I'd rather do that legwork on my team and then go and ask and prioritize work on these infrastructure teams that are already busy with things that could or could not be vulnerable. Being able to be more exact allows us to go to these teams less, which saves everybody time.", + "moreInfoUrl": "https://www.youtube.com/watch?v=G5Ry_vQPaYc&t=131s" + } + ], + "waysToUse": [ + { + "description": "By leveraging EPSS (Exploit Prediction Scoring System), security professionals gain insight on the true risk behind rated CVEs." + }, + { + "description": "An Introduction to EPSS, The Exploit Prediction Scoring System" + }, + { + "moreInfoUrl": "https://www.youtube.com/watch?v=vw1RlZCSRcQ" + }, + { + "description": "By extracting metadata from the National Vulnerability Database (NVD) and Microsoft Security Response Center (MSRC), we can determine which version of software is no longer vulnerable." + } + ], + "name": "Vulnerability scores" + }, + { + "industryName": "CISA KEVs", + "description": "Known exploited vulnerabilities", + "documentationUrl": "https://fleetdm.com/vulnerability-management", + "tier": "Premium", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "yes", + "usualDepartment": "Security", + "productCategories": [ + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "demos": [ + { + "description": null, + "moreInfoUrl": null + } + ], + "waysToUse": [ + { + "description": "Help teams work on vulnerabilities that have actually been exploited (CISA KEVs) or have a high probability of being exploited (EPSS), or whatever is important in your environment." + }, + { + "description": "Use CISA KEVs for vulnerability management" + }, + { + "moreInfoUrl": "https://www.youtube.com/watch?v=Z3mw2oxssYk" + } + ], + "name": "CISA KEVs" + }, + { + "industryName": "Asset discovery", + "documentationUrl": null, + "tier": "Premium", + "comingSoonOn": "2025-06-30", + "usualDepartment": "Security", + "productCategories": [ + "Vulnerability management" + ], + "pricingTableCategories": [ + "Devices" + ], + "name": "Asset discovery", + "comingSoon": true + }, + { + "industryName": "REST API", + "friendlyName": "Automate any feature", + "description": null, + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Integrations" + ], + "usualDepartment": "IT", + "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api", + "screenshotSrc": null, + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "dri": "rachaelshaw", + "name": "REST API" + }, + { + "industryName": "Webhooks", + "friendlyName": "Automations", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/automations#automations", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Integrations" + ], + "usualDepartment": "IT", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "name": "Webhooks" + }, + { + "industryName": "Grant API-only access", + "description": "Grant API-only access to accounts exclusively for automation.", + "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user", + "productCategories": [ + "Endpoint operations" + ], + "pricingTableCategories": [ + "Integrations" + ], + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "name": "Grant API-only access" + }, + { + "industryName": "Single sign on", + "description": "SSO, SAML", + "documentationUrl": "https://fleetdm.com/docs/deploy/single-sign-on-sso#single-sign-on-sso", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Integrations" + ], + "usualDepartment": "IT", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "name": "Single sign on" + }, + { + "industryName": "Automatic user creation (JIT, SCIM)", + "description": "Auto-create and manipulate Fleet users from Okta, etc with just-in-time (JIT) provisioning.", + "documentationUrl": "https://fleetdm.com/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Integrations" + ], + "usualDepartment": "IT", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "name": "Automatic user creation (JIT, SCIM)" + }, + { + "industryName": "Grant Wi-Fi access", + "description": "Help your end users connect to Wi-Fi by adding your Simple Certificate Enrollment Protocol (SCEP) server.", + "documentationUrl": "https://fleetdm.com/guides/ndes-scep-proxy", + "isExperimental": "yes", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Integrations" + ], + "usualDepartment": "IT", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "no", + "name": "Grant Wi-Fi access" + }, + { + "industryName": "Third-party automation", + "friendlyName": "Borrow off-the-shelf tactics from the community", + "documentationUrl": "https://fleetdm.com/integrations", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Integrations" + ], + "usualDepartment": "IT", + "description": "Plug Fleet into other frameworks and tools like Tines, Snowflake, Terraform, Chronicle, Jira, Zendesk, etc", + "moreInfoUrl": "https://fleetdm.com/integrations", + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "waysToUse": [ + { + "description": "(ActiveDirectory) Know who opened your computer and check their device posture before you let them log into anything." + }, + { + "description": "(Ansible) Easily issue MDM commands and standardize data across operating systems." + }, + { + "description": "(AWS) Deploy your own self-managed Fleet in any AWS environment in minutes." + }, + { + "description": "(Azure) Deploy your own self-managed Fleet in the Microsoft Cloud in minutes." + }, + { + "description": "(Chef) Easily issue MDM commands and standardize data across operating systems." + }, + { + "description": "(Elastic) Ingest osquery data and monitor for important changes or events." + }, + { + "description": "(GitHub) Version control using git, enabling collaboration and a GitOps workflow." + }, + { + "description": "(GitLab) Version control using git, enabling collaboration and a GitOps workflow." + }, + { + "description": "(Chronicle) Ingest osquery data and monitor for important changes or events." + }, + { + "description": "(Google Cloud) Deploy your own self-managed Fleet in any GCP environment in minutes." + }, + { + "description": "(Munki) Easily issue MDM commands and standardize data across operating systems." + }, + { + "description": "(Okta) Know who opened your computer and check their device posture before you let them log into anything." + }, + { + "description": "(Snowflake) Ingest osquery data and monitor for important changes or events." + }, + { + "description": "(Splunk) Ingest osquery data and monitor for important changes or events." + }, + { + "description": "(Tines) Build custom workflows that trigger in various situations." + }, + { + "description": "(Webhooks) Configure automations that send webhooks to specific URLs when Fleet detects changes to host, policy, and CVE statuses." + }, + { + "description": "(Zendesk) Automatically create Zendesk tickets in various situations." + }, + { + "description": "(Jira) Automatically create Jira tickets in various situations, including exporting vulnerabilities to Jira and syncing tickets." + } + ], + "buzzwords": [ + "Snowflake", + "Okta", + "Tines", + "Splunk", + "Elastic", + "AWS", + "ActiveDirectory", + "Ansible", + "GitHub", + "GitLab", + "Chronicle", + "Google Cloud", + "Munki", + "Vanta", + "Chef", + "Zendesk", + "Jira" + ], + "name": "Third-party automation" + }, + { + "industryName": "Third-party orchestration", + "friendlyName": "Borrow off-the-shelf tactics from legendary brands", + "documentationUrl": "https://fleetdm.com/integrations", + "description": "Plug Fleet into other frameworks and tools like Puppet, Vanta, etc.", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Integrations" + ], + "usualDepartment": "IT", + "moreInfoUrl": "https://fleetdm.com/integrations", + "tier": "Premium", + "waysToUse": [ + { + "description": "(Vanta) Trigger a workflow based on a failing policy." + }, + { + "description": "(Puppet) Easily issue MDM commands, standardize data across operating systems, and map macOS+Windows settings to computers with the Puppet module." + }, + { + "description": "(Torq) Build custom workflows that trigger in various situations." + }, + { + "description": "(Custom IdP) Manage access to Fleet single sign-on (SSO) through any IdP (using SAML)." + } + ], + "buzzwords": [ + "Vanta", + "Puppet", + "Custom IdP" + ], + "name": "Third-party orchestration" + }, + { + "industryName": "Munki compatibility + visibility", + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "usualDepartment": "IT", + "productCategories": [ + "Device management" + ], + "pricingTableCategories": [ + "Integrations" + ], + "name": "Munki compatibility + visibility" + }, + { + "industryName": "Open-source issue tracker (GitHub)", + "documentationUrl": "https://fleetdm.com/support", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Support" + ], + "tier": "Free", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "name": "Open-source issue tracker (GitHub)" + }, + { + "industryName": "Community Slack channel", + "documentationUrl": "https://fleetdm.com/support", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Support" + ], + "tier": "Free", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "name": "Community Slack channel" + }, + { + "industryName": "Unlimited email support (confidential)", + "documentationUrl": "https://fleetdm.com/support", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Support" + ], + "tier": "Premium", + "jamfProHasFeature": "yes", + "jamfProtectHasFeature": "yes", + "name": "Unlimited email support (confidential)" + }, + { + "industryName": "Phone and video call support", + "documentationUrl": "https://fleetdm.com/support", + "productCategories": [ + "Endpoint operations", + "Device management", + "Vulnerability management" + ], + "pricingTableCategories": [ + "Support" + ], + "tier": "Premium", + "jamfProHasFeature": "no", + "jamfProtectHasFeature": "no", + "name": "Phone and video call support" + } + ], + "markdownPages": [ + { + "url": "/docs", + "title": "Readme.md", + "lastModifiedAt": 1734534697136, + "htmlId": "docs--readme--d133ffb011", + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "README.md", + "meta": {} + }, + { + "url": "/docs/configuration", + "title": "Configuration", + "lastModifiedAt": 1734534697143, + "htmlId": "docs--readme--ddf1e60450", + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Configuration/README.md", + "meta": {} + }, + { + "url": "/docs/configuration/agent-configuration", + "title": "Agent configuration", + "lastModifiedAt": 1734534697150, + "htmlId": "docs--agent-configuration--28ccc33560", + "pageOrderInSectionPath": 300, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Configuration/agent-configuration.md", + "meta": { + "description": "Learn how to use configuration files and the fleetctl command line tool to configure agent options." + } + }, + { + "url": "/docs/configuration/fleet-server-configuration", + "title": "Fleet server configuration", + "lastModifiedAt": 1734534697171, + "htmlId": "docs--fleet-server-configu--5509d828bb", + "pageOrderInSectionPath": 100, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Configuration/fleet-server-configuration.md", + "meta": { + "description": "This page includes resources for configuring the Fleet binary, managing osquery configurations, and running with systemd." + } + }, + { + "url": "/docs/configuration/yaml-files", + "title": "YAML files", + "lastModifiedAt": 1734534697179, + "htmlId": "docs--yaml-files--961f0eb479", + "pageOrderInSectionPath": 1500, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Configuration/yaml-files.md", + "meta": { + "description": "Reference documentation for Fleet's GitOps workflow. See examples and configuration options." + } + }, + { + "url": "/docs/get-started/anatomy", + "title": "Anatomy", + "lastModifiedAt": 1734534697181, + "htmlId": "docs--anatomy--0b7973aa43", + "pageOrderInSectionPath": 200, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Get started/anatomy.md", + "meta": {} + }, + { + "url": "/docs/get-started/faq", + "title": "FAQ", + "lastModifiedAt": 1734534697186, + "htmlId": "docs--faq--33c429aedb", + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Get started/FAQ.md", + "meta": { + "description": "Commonly asked questions and answers about deployment from the Fleet community." + } + }, + { + "url": "/docs/get-started/tutorials-and-guides", + "title": "Tutorials and guides", + "lastModifiedAt": 1734534697187, + "htmlId": "docs--tutorials-and-guides--d7d293cf2a", + "pageOrderInSectionPath": 300, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Get started/tutorials-and-guides.md", + "meta": { + "description": "Links to deployment tutorials and guides for using Fleet." + } + }, + { + "url": "/docs/get-started", + "title": "Get started", + "lastModifiedAt": 1734534697188, + "htmlId": "docs--readme--c02033f051", + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Get started/README.md", + "meta": {} + }, + { + "url": "/docs/get-started/why-fleet", + "title": "Why Fleet", + "lastModifiedAt": 1734534697189, + "htmlId": "docs--why-fleet--6a246a126f", + "pageOrderInSectionPath": 100, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Get started/why-fleet.md", + "meta": {} + }, + { + "url": "/docs/deploy", + "title": "Deploy", + "lastModifiedAt": 1734534697190, + "htmlId": "docs--readme--62a515b41e", + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Deploy/README.md", + "meta": { + "description": "An overview of the deployment documentation for Fleet." + } + }, + { + "url": "/docs/deploy/reference-architectures", + "title": "Reference architectures", + "lastModifiedAt": 1734534697193, + "htmlId": "docs--reference-architectu--3b4bd5bb7d", + "pageOrderInSectionPath": 400, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Deploy/Reference-Architectures.md", + "meta": { + "description": "An opinionated view of running Fleet in a production environment, and configuration strategies to enable high availability." + } + }, + { + "url": "/docs/deploy/upgrading-fleet", + "title": "Upgrading Fleet", + "lastModifiedAt": 1734534697195, + "htmlId": "docs--upgrading-fleet--6e6fc4f536", + "pageOrderInSectionPath": 300, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Deploy/Upgrading-Fleet.md", + "meta": { + "description": "Learn how to upgrade your Fleet instance to the latest version." + } + }, + { + "url": "/docs/rest-api", + "title": "REST API", + "lastModifiedAt": 1734534697196, + "htmlId": "docs--readme--1bffac2a59", + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "REST API/README.md", + "meta": {} + }, + { + "url": "/docs/deploy/deploy-fleet", + "title": "Hosting Fleet", + "lastModifiedAt": 1734534697198, + "htmlId": "docs--deploy-fleet--fa48d6e20d", + "pageOrderInSectionPath": 100, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Deploy/deploy-fleet.md", + "meta": { + "description": "Learn how to easily deploy Fleet on Render or AWS with Terraform." + } + }, + { + "url": "/docs/deploy/single-sign-on-sso", + "title": "Single sign-on (SSO)", + "lastModifiedAt": 1734534697200, + "htmlId": "docs--single-sign-on-sso--16a1231e46", + "pageOrderInSectionPath": 200, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Deploy/single-sign-on-sso.md", + "meta": { + "description": "Learn how to configure single sign-on (SSO)" + } + }, + { + "url": "/docs/rest-api/rest-api", + "title": "REST API", + "lastModifiedAt": 1734534698922, + "htmlId": "docs--rest-api--8d1b37a5fd", + "pageOrderInSectionPath": 30, + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "REST API/rest-api.md", + "meta": { + "description": "Documentation for Fleet's REST API. See example requests and responses for each API endpoint." + } + }, + { + "url": "/docs/using-fleet", + "title": "Using Fleet", + "lastModifiedAt": 1734534698925, + "htmlId": "docs--readme--6c54a58964", + "docNavCategory": "Uncategorized", + "sectionRelativeRepoPath": "Using Fleet/README.md", + "meta": {} + }, + { + "url": "/handbook", + "title": "Readme.md", + "lastModifiedAt": 1734534698932, + "htmlId": "handbook--readme--bc2d5750a9", + "sectionRelativeRepoPath": "README.md", + "meta": { + "maintainedBy": "mikermcneil" + }, + "linksForHandbookIndex": [ + { + "headingText": "Introduction", + "hashLink": "/handbook#introduction" + } + ] + }, + { + "url": "/handbook/company", + "title": "🔭 Company", + "lastModifiedAt": 1734534698935, + "htmlId": "handbook--readme--d66c6b87ff", + "sectionRelativeRepoPath": "company/README.md", + "meta": { + "maintainedBy": "mikermcneil" + }, + "linksForHandbookIndex": [ + { + "headingText": "Purpose", + "hashLink": "/handbook/company#purpose" + }, + { + "headingText": "Culture", + "hashLink": "/handbook/company#culture" + }, + { + "headingText": "Open positions", + "hashLink": "/handbook/company#open-positions" + }, + { + "headingText": "Values", + "hashLink": "/handbook/company#values" + }, + { + "headingText": "History", + "hashLink": "/handbook/company#history" + }, + { + "headingText": "Org chart", + "hashLink": "/handbook/company#org-chart" + }, + { + "headingText": "Advisors", + "hashLink": "/handbook/company#advisors" + } + ] + }, + { + "url": "/handbook/company/communications", + "title": "🛰️ Communications", + "lastModifiedAt": 1734534698948, + "htmlId": "handbook--communications--6a843af48e", + "sectionRelativeRepoPath": "company/communications.md", + "meta": { + "maintainedBy": "mikermcneil" + }, + "linksForHandbookIndex": [ + { + "headingText": "All hands", + "hashLink": "/handbook/company/communications#all-hands" + }, + { + "headingText": "Strategy", + "hashLink": "/handbook/company/communications#strategy" + }, + { + "headingText": "Customer support service level agreements (SLAs)", + "hashLink": "/handbook/company/communications#customer-support-service-level-agreements-sl-as" + }, + { + "headingText": "Directly responsible individuals (DRIs)", + "hashLink": "/handbook/company/communications#directly-responsible-individuals-dr-is" + }, + { + "headingText": "Tech stack admins", + "hashLink": "/handbook/company/communications#tech-stack-admins" + }, + { + "headingText": "Fleetdm.com", + "hashLink": "/handbook/company/communications#fleetdm-com" + }, + { + "headingText": "Marketing programs", + "hashLink": "/handbook/company/communications#marketing-programs" + }, + { + "headingText": "Meetings", + "hashLink": "/handbook/company/communications#meetings" + }, + { + "headingText": "Skip-level 1:1 meetings ", + "hashLink": "/handbook/company/communications#skip-level-1-1-meetings" + }, + { + "headingText": "Zoom", + "hashLink": "/handbook/company/communications#zoom" + }, + { + "headingText": "Levels of confidentiality", + "hashLink": "/handbook/company/communications#levels-of-confidentiality" + }, + { + "headingText": "Google Drive", + "hashLink": "/handbook/company/communications#google-drive" + }, + { + "headingText": "Email relays", + "hashLink": "/handbook/company/communications#email-relays" + }, + { + "headingText": "Slack", + "hashLink": "/handbook/company/communications#slack" + }, + { + "headingText": "GitHub", + "hashLink": "/handbook/company/communications#git-hub" + }, + { + "headingText": "High priority user stories and bugs", + "hashLink": "/handbook/company/communications#high-priority-user-stories-and-bugs" + }, + { + "headingText": "Figma", + "hashLink": "/handbook/company/communications#figma" + }, + { + "headingText": "Spending company money", + "hashLink": "/handbook/company/communications#spending-company-money" + }, + { + "headingText": "Travel", + "hashLink": "/handbook/company/communications#travel" + }, + { + "headingText": "SOC 2", + "hashLink": "/handbook/company/communications#soc-2" + }, + { + "headingText": "Vendor questionnaires ", + "hashLink": "/handbook/company/communications#vendor-questionnaires" + }, + { + "headingText": "Getting a contract reviewed", + "hashLink": "/handbook/company/communications#getting-a-contract-reviewed" + }, + { + "headingText": "Getting a contract signed", + "hashLink": "/handbook/company/communications#getting-a-contract-signed" + }, + { + "headingText": "Trust", + "hashLink": "/handbook/company/communications#trust" + }, + { + "headingText": "Benefits", + "hashLink": "/handbook/company/communications#benefits" + }, + { + "headingText": "Compensation", + "hashLink": "/handbook/company/communications#compensation" + }, + { + "headingText": "Team member onboarding", + "hashLink": "/handbook/company/communications#team-member-onboarding" + }, + { + "headingText": "Feedback", + "hashLink": "/handbook/company/communications#feedback" + }, + { + "headingText": "Equipment", + "hashLink": "/handbook/company/communications#equipment" + }, + { + "headingText": "Writing", + "hashLink": "/handbook/company/communications#writing" + }, + { + "headingText": "Writing in Fleet-flavored Markdown", + "hashLink": "/handbook/company/communications#writing-in-fleet-flavored-markdown" + }, + { + "headingText": "Commonly used terms", + "hashLink": "/handbook/company/communications#commonly-used-terms" + } + ] + }, + { + "url": "/handbook/company/handbook", + "title": "Handbook", + "lastModifiedAt": 1734534698950, + "htmlId": "handbook--handbook--863319719d", + "sectionRelativeRepoPath": "company/handbook.md", + "meta": { + "maintainedBy": "mike-j-thomas" + }, + "linksForHandbookIndex": [ + { + "headingText": "Contributing to the handbook", + "hashLink": "/handbook/company/handbook#contributing-to-the-handbook" + } + ] + }, + { + "url": "/handbook/company/leadership", + "title": "🛠️ Leadership", + "lastModifiedAt": 1734534698955, + "htmlId": "handbook--leadership--fb97554e3a", + "sectionRelativeRepoPath": "company/leadership.md", + "meta": { + "maintainedBy": "mikermcneil" + }, + "linksForHandbookIndex": [ + { + "headingText": "CEO flaws", + "hashLink": "/handbook/company/leadership#ceo-flaws" + }, + { + "headingText": "Contact the CEO", + "hashLink": "/handbook/company/leadership#contact-the-ceo" + }, + { + "headingText": "CEO responsibilities", + "hashLink": "/handbook/company/leadership#ceo-responsibilities" + }, + { + "headingText": "Outline of departmental page structure", + "hashLink": "/handbook/company/leadership#outline-of-departmental-page-structure" + }, + { + "headingText": "Key reviews", + "hashLink": "/handbook/company/leadership#key-reviews" + }, + { + "headingText": "Adding an advisor", + "hashLink": "/handbook/company/leadership#adding-an-advisor" + }, + { + "headingText": "Hiring a consultant", + "hashLink": "/handbook/company/leadership#hiring-a-consultant" + }, + { + "headingText": "Hiring", + "hashLink": "/handbook/company/leadership#hiring" + }, + { + "headingText": "Interviewing", + "hashLink": "/handbook/company/leadership#interviewing" + }, + { + "headingText": "Creating a new position", + "hashLink": "/handbook/company/leadership#creating-a-new-position" + }, + { + "headingText": "Recruiting", + "hashLink": "/handbook/company/leadership#recruiting" + }, + { + "headingText": "Hiring a new team member", + "hashLink": "/handbook/company/leadership#hiring-a-new-team-member" + }, + { + "headingText": "Create a 30-60-90 day plan", + "hashLink": "/handbook/company/leadership#create-a-30-60-90-day-plan" + }, + { + "headingText": "CEO shadow program", + "hashLink": "/handbook/company/leadership#ceo-shadow-program" + }, + { + "headingText": "Tracking hours", + "hashLink": "/handbook/company/leadership#tracking-hours" + }, + { + "headingText": "Communicating departures", + "hashLink": "/handbook/company/leadership#communicating-departures" + }, + { + "headingText": "Request a role change for a Fleetie", + "hashLink": "/handbook/company/leadership#request-a-role-change-for-a-fleetie" + }, + { + "headingText": "Delivering performance feedback", + "hashLink": "/handbook/company/leadership#delivering-performance-feedback" + } + ] + }, + { + "url": "/handbook/company/product-groups", + "title": "🛩️ Product groups", + "lastModifiedAt": 1734534698962, + "htmlId": "handbook--product-groups--9150cdf4bc", + "sectionRelativeRepoPath": "company/product-groups.md", + "meta": { + "maintainedBy": "lukeheath" + }, + "linksForHandbookIndex": [ + { + "headingText": "Product roadmap", + "hashLink": "/handbook/company/product-groups#product-roadmap" + }, + { + "headingText": "What are product groups?", + "hashLink": "/handbook/company/product-groups#what-are-product-groups" + }, + { + "headingText": "Current product groups", + "hashLink": "/handbook/company/product-groups#current-product-groups" + }, + { + "headingText": "Making changes", + "hashLink": "/handbook/company/product-groups#making-changes" + }, + { + "headingText": "Outages", + "hashLink": "/handbook/company/product-groups#outages" + }, + { + "headingText": "Scaling Fleet", + "hashLink": "/handbook/company/product-groups#scaling-fleet" + }, + { + "headingText": "Load testing", + "hashLink": "/handbook/company/product-groups#load-testing" + }, + { + "headingText": "Version support", + "hashLink": "/handbook/company/product-groups#version-support" + }, + { + "headingText": "Release testing", + "hashLink": "/handbook/company/product-groups#release-testing" + }, + { + "headingText": "Feature fest", + "hashLink": "/handbook/company/product-groups#feature-fest" + }, + { + "headingText": "Quality", + "hashLink": "/handbook/company/product-groups#quality" + }, + { + "headingText": "How to reach the developer on-call", + "hashLink": "/handbook/company/product-groups#how-to-reach-the-developer-on-call" + }, + { + "headingText": "Wireframes", + "hashLink": "/handbook/company/product-groups#wireframes" + }, + { + "headingText": "Meetings", + "hashLink": "/handbook/company/product-groups#meetings" + }, + { + "headingText": "Development best practices", + "hashLink": "/handbook/company/product-groups#development-best-practices" + }, + { + "headingText": "Product design conventions", + "hashLink": "/handbook/company/product-groups#product-design-conventions" + }, + { + "headingText": "Scrum at Fleet", + "hashLink": "/handbook/company/product-groups#scrum-at-fleet" + }, + { + "headingText": "Sprints", + "hashLink": "/handbook/company/product-groups#sprints" + }, + { + "headingText": "Outside contributions", + "hashLink": "/handbook/company/product-groups#outside-contributions" + } + ] + }, + { + "url": "/handbook/company/why-this-way", + "title": "💭 Why this way?", + "lastModifiedAt": 1734534698967, + "htmlId": "handbook--why-this-way--e6d06610c1", + "sectionRelativeRepoPath": "company/why-this-way.md", + "meta": { + "maintainedBy": "mikermcneil" + }, + "linksForHandbookIndex": [ + { + "headingText": "Why open source?", + "hashLink": "/handbook/company/why-this-way#why-open-source" + }, + { + "headingText": "Why handbook-first strategy?", + "hashLink": "/handbook/company/why-this-way#why-handbook-first-strategy" + }, + { + "headingText": "Why read documentation?", + "hashLink": "/handbook/company/why-this-way#why-read-documentation" + }, + { + "headingText": "Why the emphasis on training?", + "hashLink": "/handbook/company/why-this-way#why-the-emphasis-on-training" + }, + { + "headingText": "Why direct responsibility?", + "hashLink": "/handbook/company/why-this-way#why-direct-responsibility" + }, + { + "headingText": "Why do we use a wireframe-first approach?", + "hashLink": "/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach" + }, + { + "headingText": "Why do we use one repo?", + "hashLink": "/handbook/company/why-this-way#why-do-we-use-one-repo" + }, + { + "headingText": "Why not continuously generate REST API reference docs from javadoc-style code comments?", + "hashLink": "/handbook/company/why-this-way#why-not-continuously-generate-rest-api-reference-docs-from-javadoc-style-code-comments" + }, + { + "headingText": "Why group Slack channels?", + "hashLink": "/handbook/company/why-this-way#why-group-slack-channels" + }, + { + "headingText": "Why make work visible?", + "hashLink": "/handbook/company/why-this-way#why-make-work-visible" + }, + { + "headingText": "Why agile?", + "hashLink": "/handbook/company/why-this-way#why-agile" + }, + { + "headingText": "Why a three-week cadence?", + "hashLink": "/handbook/company/why-this-way#why-a-three-week-cadence" + }, + { + "headingText": "Why spend so much energy responding to every potential production incident?", + "hashLink": "/handbook/company/why-this-way#why-spend-so-much-energy-responding-to-every-potential-production-incident" + }, + { + "headingText": "Why fix small inconsistencies quickly?", + "hashLink": "/handbook/company/why-this-way#why-fix-small-inconsistencies-quickly" + }, + { + "headingText": "Why make it obvious when stuff breaks?", + "hashLink": "/handbook/company/why-this-way#why-make-it-obvious-when-stuff-breaks" + }, + { + "headingText": "Why keep issue templates simple?", + "hashLink": "/handbook/company/why-this-way#why-keep-issue-templates-simple" + }, + { + "headingText": "Why spend less?", + "hashLink": "/handbook/company/why-this-way#why-spend-less" + }, + { + "headingText": "Why don't we sell like everyone else?", + "hashLink": "/handbook/company/why-this-way#why-don-t-we-sell-like-everyone-else" + }, + { + "headingText": "Why does Fleet support query packs?", + "hashLink": "/handbook/company/why-this-way#why-does-fleet-support-query-packs" + }, + { + "headingText": "Why does Fleet use sentence case?", + "hashLink": "/handbook/company/why-this-way#why-does-fleet-use-sentence-case" + }, + { + "headingText": "Why not use superlatives?", + "hashLink": "/handbook/company/why-this-way#why-not-use-superlatives" + }, + { + "headingText": "Why does Fleet use \"MDM on/off\" instead of \"MDM enrolled/unenrolled\"?", + "hashLink": "/handbook/company/why-this-way#why-does-fleet-use-mdm-on-off-instead-of-mdm-enrolled-unenrolled" + }, + { + "headingText": "Why not mention the CEO in Slack threads?", + "hashLink": "/handbook/company/why-this-way#why-not-mention-the-ceo-in-slack-threads" + } + ] + }, + { + "url": "/handbook/customer-success", + "title": "🌦️ Customer Success", + "lastModifiedAt": 1734534698970, + "htmlId": "handbook--readme--2f11809e31", + "sectionRelativeRepoPath": "customer-success/README.md", + "meta": { + "maintainedBy": "zayhanlon" + }, + "linksForHandbookIndex": [ + { + "headingText": "Team", + "hashLink": "/handbook/customer-success#team" + }, + { + "headingText": "Contact us", + "hashLink": "/handbook/customer-success#contact-us" + }, + { + "headingText": "Responsibilities", + "hashLink": "/handbook/customer-success#responsibilities" + }, + { + "headingText": "Rituals", + "hashLink": "/handbook/customer-success#rituals" + } + ] + }, + { + "url": "/handbook/demand", + "title": "🫧 Demand", + "lastModifiedAt": 1734534698974, + "htmlId": "handbook--readme--cd1abd2fbc", + "sectionRelativeRepoPath": "demand/README.md", + "meta": { + "maintainedBy": "Drew-P-Drawers" + }, + "linksForHandbookIndex": [ + { + "headingText": "Team", + "hashLink": "/handbook/demand#team" + }, + { + "headingText": "Contact us", + "hashLink": "/handbook/demand#contact-us" + }, + { + "headingText": "Responsibilities", + "hashLink": "/handbook/demand#responsibilities" + }, + { + "headingText": "Rituals", + "hashLink": "/handbook/demand#rituals" + } + ] + }, + { + "url": "/handbook/digital-experience", + "title": "🌐 Digital Experience", + "lastModifiedAt": 1734534698982, + "htmlId": "handbook--readme--584ce6144f", + "sectionRelativeRepoPath": "digital-experience/README.md", + "meta": { + "maintainedBy": "Sampfluger88" + }, + "linksForHandbookIndex": [ + { + "headingText": "Team", + "hashLink": "/handbook/digital-experience#team" + }, + { + "headingText": "Contact us", + "hashLink": "/handbook/digital-experience#contact-us" + }, + { + "headingText": "Responsibilities", + "hashLink": "/handbook/digital-experience#responsibilities" + }, + { + "headingText": "Rituals", + "hashLink": "/handbook/digital-experience#rituals" + } + ] + }, + { + "url": "/handbook/digital-experience/security", + "title": "Security", + "lastModifiedAt": 1734534698999, + "htmlId": "handbook--security--3e0da72c47", + "sectionRelativeRepoPath": "digital-experience/security.md", + "meta": { + "maintainedBy": "hollidayn" + }, + "linksForHandbookIndex": [ + { + "headingText": "Fleet security", + "hashLink": "/handbook/digital-experience/security#fleet-security" + }, + { + "headingText": "How we protect end-user devices", + "hashLink": "/handbook/digital-experience/security#how-we-protect-end-user-devices" + }, + { + "headingText": "FAQ", + "hashLink": "/handbook/digital-experience/security#faq" + }, + { + "headingText": "GitHub security", + "hashLink": "/handbook/digital-experience/security#git-hub-security" + }, + { + "headingText": "Google Workspace security", + "hashLink": "/handbook/digital-experience/security#google-workspace-security" + }, + { + "headingText": "Vendor questionnaires ", + "hashLink": "/handbook/digital-experience/security#vendor-questionnaires" + }, + { + "headingText": "Scoping", + "hashLink": "/handbook/digital-experience/security#scoping" + }, + { + "headingText": "Service monitoring and logging", + "hashLink": "/handbook/digital-experience/security#service-monitoring-and-logging" + }, + { + "headingText": "Governance and risk management", + "hashLink": "/handbook/digital-experience/security#governance-and-risk-management" + }, + { + "headingText": "Network security", + "hashLink": "/handbook/digital-experience/security#network-security" + }, + { + "headingText": "Privacy", + "hashLink": "/handbook/digital-experience/security#privacy" + }, + { + "headingText": "Sub-processors", + "hashLink": "/handbook/digital-experience/security#sub-processors" + }, + { + "headingText": "Security policies", + "hashLink": "/handbook/digital-experience/security#security-policies" + }, + { + "headingText": "Business continuity plan", + "hashLink": "/handbook/digital-experience/security#business-continuity-plan" + }, + { + "headingText": "Data management policy", + "hashLink": "/handbook/digital-experience/security#data-management-policy" + }, + { + "headingText": "Encryption policy", + "hashLink": "/handbook/digital-experience/security#encryption-policy" + }, + { + "headingText": "Information security roles and responsibilities", + "hashLink": "/handbook/digital-experience/security#information-security-roles-and-responsibilities" + }, + { + "headingText": "Network and system hardening standards", + "hashLink": "/handbook/digital-experience/security#network-and-system-hardening-standards" + }, + { + "headingText": "Application security", + "hashLink": "/handbook/digital-experience/security#application-security" + }, + { + "headingText": "Vulnerability management", + "hashLink": "/handbook/digital-experience/security#vulnerability-management" + }, + { + "headingText": "Trust report", + "hashLink": "/handbook/digital-experience/security#trust-report" + }, + { + "headingText": "Securtiy audits", + "hashLink": "/handbook/digital-experience/security#securtiy-audits" + } + ] + }, + { + "url": "/handbook/engineering/load-testing", + "title": "Load testing", + "lastModifiedAt": 1734534699001, + "htmlId": "handbook--load-testing--a569c0b971", + "sectionRelativeRepoPath": "engineering/Load-testing.md", + "meta": { + "maintainedBy": "lukeheath", + "description": "This page outlines the most recent results of a semi-annual load test of the Fleet server." + }, + "linksForHandbookIndex": [ + { + "headingText": "Test parameters", + "hashLink": "/handbook/engineering/load-testing#test-parameters" + }, + { + "headingText": "Results", + "hashLink": "/handbook/engineering/load-testing#results" + }, + { + "headingText": "How we are simulating osquery", + "hashLink": "/handbook/engineering/load-testing#how-we-are-simulating-osquery" + }, + { + "headingText": "Infrastructure setup", + "hashLink": "/handbook/engineering/load-testing#infrastructure-setup" + }, + { + "headingText": "Limitations", + "hashLink": "/handbook/engineering/load-testing#limitations" + } + ] + }, + { + "url": "/handbook/engineering/debugging", + "title": "Debugging", + "lastModifiedAt": 1734534699002, + "htmlId": "handbook--debugging--3ca4b159dc", + "sectionRelativeRepoPath": "engineering/Debugging.md", + "meta": { + "maintainedBy": "lukeheath", + "description": "A guide to triaging and diagnosing issues in Fleet." + }, + "linksForHandbookIndex": [ + { + "headingText": "Goals of this guide", + "hashLink": "/handbook/engineering/debugging#goals-of-this-guide" + }, + { + "headingText": "Basic data that is needed", + "hashLink": "/handbook/engineering/debugging#basic-data-that-is-needed" + }, + { + "headingText": "Triaging the issue", + "hashLink": "/handbook/engineering/debugging#triaging-the-issue" + } + ] + }, + { + "url": "/handbook/engineering/scaling-fleet", + "title": "Scaling Fleet", + "lastModifiedAt": 1734534699004, + "htmlId": "handbook--scaling-fleet--282b4f1482", + "sectionRelativeRepoPath": "engineering/scaling-fleet.md", + "meta": { + "maintainedBy": "lukeheath" + } + }, + { + "url": "/handbook/engineering", + "title": "🚀 Engineering", + "lastModifiedAt": 1734534699009, + "htmlId": "handbook--readme--84714ade8c", + "sectionRelativeRepoPath": "engineering/README.md", + "meta": { + "maintainedBy": "lukeheath" + }, + "linksForHandbookIndex": [ + { + "headingText": "Team", + "hashLink": "/handbook/engineering#team" + }, + { + "headingText": "Contact us", + "hashLink": "/handbook/engineering#contact-us" + }, + { + "headingText": "Responsibilities", + "hashLink": "/handbook/engineering#responsibilities" + }, + { + "headingText": "Rituals", + "hashLink": "/handbook/engineering#rituals" + } + ] + }, + { + "url": "/handbook/engineering/tuf", + "title": "Tuf", + "lastModifiedAt": 1734534699012, + "htmlId": "handbook--tuf--868750fae1", + "sectionRelativeRepoPath": "engineering/tuf.md", + "meta": { + "maintainedBy": "lukeheath", + "description": "This page outlines our TUF creation and maintenance processes." + }, + "linksForHandbookIndex": [ + { + "headingText": "Create a new TUF repo", + "hashLink": "/handbook/engineering/tuf#create-a-new-tuf-repo" + }, + { + "headingText": "Read and write to TUF repo on Cloudflare R2", + "hashLink": "/handbook/engineering/tuf#read-and-write-to-tuf-repo-on-cloudflare-r-2" + }, + { + "headingText": "Add new TUF keys for authorized team members", + "hashLink": "/handbook/engineering/tuf#add-new-tuf-keys-for-authorized-team-members" + }, + { + "headingText": "Rotate the root keys ", + "hashLink": "/handbook/engineering/tuf#rotate-the-root-keys" + } + ] + }, + { + "url": "/handbook/finance", + "title": "💸 Finance", + "lastModifiedAt": 1734534699021, + "htmlId": "handbook--readme--64288e272c", + "sectionRelativeRepoPath": "finance/README.md", + "meta": { + "maintainedBy": "ireedy" + }, + "linksForHandbookIndex": [ + { + "headingText": "Team", + "hashLink": "/handbook/finance#team" + }, + { + "headingText": "Contact us", + "hashLink": "/handbook/finance#contact-us" + }, + { + "headingText": "Responsibilities", + "hashLink": "/handbook/finance#responsibilities" + }, + { + "headingText": "Rituals", + "hashLink": "/handbook/finance#rituals" + } + ] + }, + { + "url": "/handbook/product-design", + "title": "🦢 Product design", + "lastModifiedAt": 1734534699025, + "htmlId": "handbook--readme--fba8844849", + "sectionRelativeRepoPath": "product-design/README.md", + "meta": { + "maintainedBy": "noahtalerman" + }, + "linksForHandbookIndex": [ + { + "headingText": "Team", + "hashLink": "/handbook/product-design#team" + }, + { + "headingText": "Contact us", + "hashLink": "/handbook/product-design#contact-us" + }, + { + "headingText": "Responsibilities", + "hashLink": "/handbook/product-design#responsibilities" + }, + { + "headingText": "Rituals", + "hashLink": "/handbook/product-design#rituals" + } + ] + }, + { + "url": "/handbook/sales", + "title": "🐋 Sales", + "lastModifiedAt": 1734534699027, + "htmlId": "handbook--readme--67492c880b", + "sectionRelativeRepoPath": "sales/README.md", + "meta": { + "maintainedBy": "alexmitchelliii" + }, + "linksForHandbookIndex": [ + { + "headingText": "Team", + "hashLink": "/handbook/sales#team" + }, + { + "headingText": "Contact us", + "hashLink": "/handbook/sales#contact-us" + }, + { + "headingText": "Responsibilities", + "hashLink": "/handbook/sales#responsibilities" + }, + { + "headingText": "Rituals", + "hashLink": "/handbook/sales#rituals" + } + ] + }, + { + "url": "/engineering/tips-for-github-actions-usability", + "title": "Tips for github actions usability", + "lastModifiedAt": 1734534699031, + "htmlId": "articles--4-tips-for-github-ac--4783b271b1", + "sectionRelativeRepoPath": "4-tips-for-github-actions-usability.md", + "meta": { + "category": "engineering", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2022-01-03", + "articleTitle": "4 tips for GitHub Actions usability (+2 bonus tips for debugging)", + "articleImageUrl": "/images/articles/4-tips-for-github-actions-usability-cover-1600x900@2x.jpg" + } + }, + { + "url": "/announcements/a-new-fleet", + "title": "A new Fleet", + "lastModifiedAt": 1734534699032, + "htmlId": "articles--a-new-fleet--6bfb98461b", + "sectionRelativeRepoPath": "a-new-fleet.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2020-01-05", + "articleTitle": "A new Fleet", + "articleImageUrl": "/images/articles/a-new-fleet-cover-700x340@2x.jpeg" + } + }, + { + "url": "/guides/alternate-apple-mdm-url", + "title": "Alternate apple mdm url", + "lastModifiedAt": 1734534699034, + "htmlId": "articles--alternate-apple-mdm---b8dc76480e", + "sectionRelativeRepoPath": "alternate-apple-mdm-url.md", + "meta": { + "articleTitle": "Configuring an Alternative Apple MDM URL", + "authorFullName": "Tim Lee", + "authorGitHubUsername": "mostlikelee", + "category": "guides", + "publishedOn": "2024-11-01", + "description": "A guide on configuring an alternative Apple MDM URL in Fleet for better traffic management." + } + }, + { + "url": "/guides/apple-developer-certificates-on-linux-for-configuration-profile-signing", + "title": "Apple developer certificates on linux for configuration profile signing", + "lastModifiedAt": 1734534699035, + "htmlId": "articles--apple-developer-cert--da0ffa1bfb", + "sectionRelativeRepoPath": "apple-developer-certificates-on-linux-for-configuration-profile-signing.md", + "meta": { + "articleTitle": "Apple developer certificates on Linux for configuration profile signing", + "authorFullName": "Brock Walters", + "authorGitHubUsername": "nonpunctual", + "category": "guides", + "publishedOn": "2024-03-06", + "articleImageUrl": "/images/articles/apple-developer-certificates-on-linux-for-configuration-profile-signing-1600x900@2x.png", + "description": "This guide walks through the process of adding an Apple signing certificate to a Linux host." + } + }, + { + "url": "/securing/apply-byod-to-soothe-supply-chain-pain", + "title": "Apply byod to soothe supply chain pain", + "lastModifiedAt": 1734534699037, + "htmlId": "articles--apply-byod-to-soothe--37d8a3c6df", + "sectionRelativeRepoPath": "apply-byod-to-soothe-supply-chain-pain.md", + "meta": { + "category": "security", + "authorGitHubUsername": "GuillaumeRoss", + "authorFullName": "Guillaume Ross", + "publishedOn": "2022-02-10", + "articleTitle": "Apply BYOD to soothe supply chain pain", + "articleImageUrl": "/images/articles/apply-byod-to-soothe-supply-chain-pain-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/automatic-software-install-in-fleet", + "title": "Automatic software install in Fleet", + "lastModifiedAt": 1734534699039, + "htmlId": "articles--automatic-software-i--abcbbd3102", + "sectionRelativeRepoPath": "automatic-software-install-in-fleet.md", + "meta": { + "articleTitle": "Automatically install software", + "authorFullName": "Sharon Katz", + "authorGitHubUsername": "sharon-fdm", + "category": "guides", + "publishedOn": "2024-09-23", + "description": "A guide to workflows using automatic software installation in Fleet." + } + }, + { + "url": "/guides/automations", + "title": "Automations", + "lastModifiedAt": 1734534699040, + "htmlId": "articles--automations--64a57338e2", + "sectionRelativeRepoPath": "automations.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-07-03", + "articleTitle": "Automations", + "description": "Configure Fleet automations to trigger webhooks or create tickets in Jira and Zendesk for vulnerability, policy, and host status events." + } + }, + { + "url": "/guides/battery-health", + "title": "Battery health", + "lastModifiedAt": 1734534699041, + "htmlId": "articles--battery-health--563f09cf01", + "sectionRelativeRepoPath": "battery-health.md", + "meta": { + "articleTitle": "Battery health", + "authorFullName": "Tim Lee", + "authorGitHubUsername": "mostlikelee", + "category": "guides", + "publishedOn": "2024-10-16", + "articleImageUrl": "/images/articles/battery-health-1600x900@2x.png", + "description": "Monitor and assess battery health in macOS and Windows devices using Fleet and osquery to maintain optimal device performance." + } + }, + { + "url": "/guides/building-webhook-flows-with-fleet-and-tines", + "title": "Building webhook flows with Fleet and tines", + "lastModifiedAt": 1734534699042, + "htmlId": "articles--building-webhook-flo--5ef9e57435", + "sectionRelativeRepoPath": "building-webhook-flows-with-fleet-and-tines.md", + "meta": { + "articleTitle": "Building webhook flows with Fleet and Tines", + "authorFullName": "Victor Lyuboslavsky", + "authorGitHubUsername": "getvictor", + "category": "guides", + "publishedOn": "2024-05-30", + "articleImageUrl": "/images/articles/building-webhook-flows-with-fleet-and-tines-1600x900@2x.png", + "description": "A guide to workflows using Tines and Fleet via webhook to update outdated OS versions." + } + }, + { + "url": "/guides/catch-missed-authorization-checks-during-software-development", + "title": "Catch missed authorization checks during software development", + "lastModifiedAt": 1734534699043, + "htmlId": "articles--catch-missed-authori--74714253bf", + "sectionRelativeRepoPath": "catch-missed-authorization-checks-during-software-development.md", + "meta": { + "articleTitle": "Catch missed authorization checks during software development", + "authorFullName": "Victor Lyuboslavsky", + "authorGitHubUsername": "getvictor", + "category": "guides", + "publishedOn": "2023-12-04", + "description": "How to perform authorization checks in a golang codebase for cybersecurity" + } + }, + { + "url": "/guides/chrome-os", + "title": "Chrome os", + "lastModifiedAt": 1734534699044, + "htmlId": "articles--chrome-os--2f99363e14", + "sectionRelativeRepoPath": "chrome-os.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "zhumo", + "authorFullName": "Mo Zhu", + "publishedOn": "2023-11-21", + "articleTitle": "ChromeOS", + "description": "Learn about ChromeOS and Fleet." + } + }, + { + "url": "/guides/cis-benchmarks", + "title": "Cis benchmarks", + "lastModifiedAt": 1734534699045, + "htmlId": "articles--cis-benchmarks--bc26d23443", + "sectionRelativeRepoPath": "cis-benchmarks.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "lucasmrod", + "authorFullName": "Lucas Rodriguez", + "publishedOn": "2024-04-02", + "articleTitle": "CIS Benchmarks", + "description": "Read about how Fleet's implementation of CIS Benchmarks offers consensus-based cybersecurity guidance." + } + }, + { + "url": "/guides/certificates-in-fleetd", + "title": "Certificates in fleetd", + "lastModifiedAt": 1734534699046, + "htmlId": "articles--certificates-in-flee--fdcfa77fd4", + "sectionRelativeRepoPath": "certificates-in-fleetd.md", + "meta": { + "articleTitle": "Certificates in fleetd", + "authorFullName": "Lucas Manuel Rodriguez", + "authorGitHubUsername": "lucasmrod", + "category": "guides", + "publishedOn": "2024-07-09", + "articleImageUrl": "/images/articles/apple-developer-certificates-on-linux-for-configuration-profile-signing-1600x900@2x.png", + "description": "TLS certificates in fleetd" + } + }, + { + "url": "/guides/building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly", + "title": "Building an effective dashboard with Fleet REST API flask and plotly", + "lastModifiedAt": 1734534699047, + "htmlId": "articles--building-an-effectiv--2bdb2cc07f", + "sectionRelativeRepoPath": "building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly.md", + "meta": { + "articleTitle": "Building an effective dashboard with Fleet's REST API, Flask, and Plotly: A step-by-step guide", + "authorFullName": "Dave Herder", + "authorGitHubUsername": "dherder", + "category": "guides", + "publishedOn": "2023-05-22", + "articleImageUrl": "/images/articles/building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly@2x.jpg", + "description": "Step-by-step guide on building a dynamic dashboard with Fleet's REST API, Flask, and Plotly. Master data visualization with open-source tools!" + } + }, + { + "url": "/announcements/comparative-look-at-ws1-and-fleet", + "title": "Comparative look at ws1 and Fleet", + "lastModifiedAt": 1734534699048, + "htmlId": "articles--comparative-look-at---e0d38f9066", + "sectionRelativeRepoPath": "comparative-look-at-ws1-and-fleet.md", + "meta": { + "category": "announcements", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-02-01", + "articleTitle": "A comparative look at VMware Workspace ONE and Fleet Device Management", + "articleImageUrl": "/images/articles/comparative-look-at-ws1-and-fleet-1600x900@2x.png" + } + }, + { + "url": "/guides/config-less-fleetd-agent-deployment", + "title": "Config less fleetd agent deployment", + "lastModifiedAt": 1734534699049, + "htmlId": "articles--config-less-fleetd-a--eeaff811d8", + "sectionRelativeRepoPath": "config-less-fleetd-agent-deployment.md", + "meta": { + "articleTitle": "Config-less fleetd agent deployment", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "category": "guides", + "publishedOn": "2024-01-31", + "articleImageUrl": "/images/articles/config-less-fleetd-agent-deployment-1600x900@2x.png", + "description": "Config-less `fleetd` agent deployment" + } + }, + { + "url": "/guides/configuring-default-teams-for-devices-in-fleet", + "title": "Configuring default teams for devices in Fleet", + "lastModifiedAt": 1734534699050, + "htmlId": "articles--configuring-default---1fb09cd2b7", + "sectionRelativeRepoPath": "configuring-default-teams-for-devices-in-fleet.md", + "meta": { + "articleTitle": "Configuring default teams for macOS, iOS, and iPadOS devices in Fleet", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "category": "guides", + "publishedOn": "2024-09-12", + "description": "This guide will walk you through configuring default teams for devices using the Fleet web UI." + } + }, + { + "url": "/announcements/consolidate-multiple-tools-with-fleet", + "title": "Consolidate multiple tools with Fleet", + "lastModifiedAt": 1734534699051, + "htmlId": "articles--consolidate-multiple--e8aa62a487", + "sectionRelativeRepoPath": "consolidate-multiple-tools-with-fleet.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "Drew-P-drawers", + "authorFullName": "Andrew Baker", + "publishedOn": "2024-12-06", + "articleTitle": "Leading financial company consolidates multiple tools with Fleet", + "description": "Leading financial company consolidates multiple tools with Fleet" + } + }, + { + "url": "/guides/converting-unix-timestamps-with-osquery", + "title": "Converting unix timestamps with osquery", + "lastModifiedAt": 1734534699052, + "htmlId": "articles--converting-unix-time--f364580e65", + "sectionRelativeRepoPath": "converting-unix-timestamps-with-osquery.md", + "meta": { + "category": "guides", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2021-06-15", + "articleTitle": "Converting unix timestamps with osquery", + "articleImageUrl": "/images/articles/converting-unix-timestamps-with-osquery-cover-800x450@2x.jpeg" + } + }, + { + "url": "/guides/correlate-network-connections-with-community-id-in-osquery", + "title": "Correlate network connections with community id in osquery", + "lastModifiedAt": 1734534699053, + "htmlId": "articles--correlate-network-co--9e9f4b2365", + "sectionRelativeRepoPath": "correlate-network-connections-with-community-id-in-osquery.md", + "meta": { + "category": "guides", + "authorFullName": "Zach Wasserman", + "authorGitHubUsername": "zwass", + "publishedOn": "2021-06-02", + "articleTitle": "Correlate network connections with community ID in osquery.", + "articleImageUrl": "/images/articles/correlate-network-connections-with-community-id-in-osquery-cover-800x502@2x.jpeg" + } + }, + { + "url": "/guides/creating-windows-csps", + "title": "Creating windows csps", + "lastModifiedAt": 1734534699054, + "htmlId": "articles--creating-windows-csp--443b09b338", + "sectionRelativeRepoPath": "creating-windows-csps.md", + "meta": { + "articleTitle": "Creating Windows CSPs", + "authorFullName": "Harrison Ravazzolo", + "authorGitHubUsername": "harrisonravazzolo", + "category": "guides", + "publishedOn": "2024-12-12", + "description": "Learn how to create and deploy Windows CSPs with Fleet, leveraging ADMX-backed policies for streamlined and secure device management." + } + }, + { + "url": "/guides/custom-os-settings", + "title": "Custom os settings", + "lastModifiedAt": 1734534699055, + "htmlId": "articles--custom-os-settings--fbce8fa70e", + "sectionRelativeRepoPath": "custom-os-settings.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-07-27", + "articleTitle": "Custom OS settings", + "description": "Learn how to enforce custom settings on macOS and Window hosts using Fleet's configuration profiles." + } + }, + { + "url": "/announcements/debunk-the-cross-platform-myth", + "title": "Debunk the cross platform myth", + "lastModifiedAt": 1734534699056, + "htmlId": "articles--debunk-the-cross-pla--fe27986d52", + "sectionRelativeRepoPath": "debunk-the-cross-platform-myth.md", + "meta": { + "category": "announcements", + "authorFullName": "Mike McNeil", + "authorGitHubUsername": "mikermcneil", + "publishedOn": "2024-08-27", + "articleTitle": "Debunk the cross-platform myth", + "description": "Debunk the cross-platform myth with MDM" + } + }, + { + "url": "/guides/delivering-data-to-snowflake-from-fleet-and-osquery", + "title": "Delivering data to snowflake from Fleet and osquery", + "lastModifiedAt": 1734534699058, + "htmlId": "articles--delivering-data-to-s--0689aa7ec4", + "sectionRelativeRepoPath": "delivering-data-to-snowflake-from-fleet-and-osquery.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "t-lark", + "authorFullName": "Tom Larkin", + "publishedOn": "2022-02-01", + "articleTitle": "Delivering data to Snowflake from Fleet and osquery.", + "articleImageUrl": "/images/articles/delivering-data-to-snowflake-from-fleet-and-osquery-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/deploy-fleet-on-aws-ecs", + "title": "Deploy Fleet on aws ecs", + "lastModifiedAt": 1734534699059, + "htmlId": "articles--deploy-fleet-on-aws---2a8f97e2e6", + "sectionRelativeRepoPath": "deploy-fleet-on-aws-ecs.md", + "meta": { + "articleTitle": "Deploy Fleet on AWS ECS", + "authorGitHubUsername": "edwardsb", + "authorFullName": "Ben Edwards", + "publishedOn": "2021-10-06", + "category": "guides", + "articleImageUrl": "/images/articles/deploy-fleet-on-aws-ecs-800x450@2x.png", + "description": "Information for deploying Fleet on AWS ECS." + } + }, + { + "url": "/guides/deploy-fleet-on-aws-with-terraform", + "title": "Deploy Fleet on aws with terraform", + "lastModifiedAt": 1734534699061, + "htmlId": "articles--deploy-fleet-on-aws---a782bb3610", + "sectionRelativeRepoPath": "deploy-fleet-on-aws-with-terraform.md", + "meta": { + "articleTitle": "Deploy Fleet on AWS with Terraform", + "authorGitHubUsername": "edwardsb", + "authorFullName": "Ben Edwards", + "publishedOn": "2021-11-30", + "category": "guides", + "articleImageUrl": "/images/articles/deploy-fleet-on-aws-with-terraform-800x450@2x.png", + "description": "Learn how to deploy Fleet on AWS." + } + }, + { + "url": "/guides/deploy-fleet-on-centos", + "title": "Deploy Fleet on centos", + "lastModifiedAt": 1734534699062, + "htmlId": "articles--deploy-fleet-on-cent--e7882f4580", + "sectionRelativeRepoPath": "deploy-fleet-on-centos.md", + "meta": { + "articleTitle": "Deploy Fleet on CentOS", + "authorGitHubUsername": "marpaia", + "authorFullName": "Mike Arpaia", + "publishedOn": "2017-09-22", + "category": "guides", + "articleImageUrl": "/images/articles/deploy-fleet-on-centos-800x450@2x.png", + "description": "A guide to deploy Fleet on CentOS." + } + }, + { + "url": "/guides/deploy-fleet-on-cloudgov", + "title": "Deploy Fleet on cloudgov", + "lastModifiedAt": 1734534699063, + "htmlId": "articles--deploy-fleet-on-clou--7a95cf92fe", + "sectionRelativeRepoPath": "deploy-fleet-on-cloudgov.md", + "meta": { + "articleTitle": "Deploy Fleet on Cloud.gov", + "authorGitHubUsername": "JJediny", + "authorFullName": "John Jediny", + "publishedOn": "2022-09-08", + "category": "guides", + "articleImageUrl": "/images/articles/deploy-fleet-on-cloudgov-800x450@2x.png", + "description": "Information for deploying Fleet on Cloud.gov." + } + }, + { + "url": "/guides/deploy-fleet-on-hetzner-cloud", + "title": "Deploy Fleet on hetzner cloud", + "lastModifiedAt": 1734534699065, + "htmlId": "articles--deploy-fleet-on-hetz--671406f870", + "sectionRelativeRepoPath": "deploy-fleet-on-hetzner-cloud.md", + "meta": { + "articleTitle": "Deploy Fleet on Hetzner Cloud", + "authorGitHubUsername": "ksatter", + "authorFullName": "Kathy Satterlee", + "publishedOn": "2022-06-27", + "category": "guides", + "articleImageUrl": "/images/articles/deploy-fleet-on-hetzner-cloud-800x450@2x.png", + "description": "Learn how to deploy Fleet on Hetzner Cloud using cloud-init and Docker." + } + }, + { + "url": "/guides/deploy-fleet-on-kubernetes", + "title": "Deploy Fleet on kubernetes", + "lastModifiedAt": 1734534699066, + "htmlId": "articles--deploy-fleet-on-kube--54be3fbc8f", + "sectionRelativeRepoPath": "deploy-fleet-on-kubernetes.md", + "meta": { + "articleTitle": "Deploy Fleet on Kubernetes", + "authorGitHubUsername": "marpaia", + "authorFullName": "Mike Arpaia", + "publishedOn": "2017-11-18", + "category": "guides", + "articleImageUrl": "/images/articles/deploy-fleet-on-kubernetes-800x450@2x.png", + "description": "Learn how to deploy Fleet on Kubernetes." + } + }, + { + "url": "/guides/deploy-fleet-on-render", + "title": "Deploy Fleet on render", + "lastModifiedAt": 1734534699068, + "htmlId": "articles--deploy-fleet-on-rend--eed014db97", + "sectionRelativeRepoPath": "deploy-fleet-on-render.md", + "meta": { + "articleTitle": "Deploy Fleet on Render", + "authorGitHubUsername": "edwardsb", + "authorFullName": "Ben Edwards", + "publishedOn": "2021-11-21", + "category": "guides", + "articleImageUrl": "/images/articles/deploy-fleet-on-render-800x450@2x.png", + "description": "Learn how to deploy Fleet on Render." + } + }, + { + "url": "/guides/deploy-fleet-on-ubuntu-with-elastic", + "title": "Deploy Fleet on ubuntu with elastic", + "lastModifiedAt": 1734534699070, + "htmlId": "articles--deploy-fleet-on-ubun--12cb3308e3", + "sectionRelativeRepoPath": "deploy-fleet-on-ubuntu-with-elastic.md", + "meta": { + "articleTitle": "Deploy Fleet on Ubuntu", + "authorGitHubUsername": "defensivedepth", + "authorFullName": "Josh Brower", + "publishedOn": "2024-06-12", + "category": "guides", + "description": "A guide to deploy Fleet and Elastic on Ubuntu.", + "articleImageUrl": "/images/articles/deploy-fleet-on-ubuntu-with-elastic-1600x900@2x.png" + } + }, + { + "url": "/guides/deploy-software-packages", + "title": "Deploy software packages", + "lastModifiedAt": 1734534699072, + "htmlId": "articles--deploy-software-pack--4dbf86a87e", + "sectionRelativeRepoPath": "deploy-software-packages.md", + "meta": { + "articleTitle": "Deploy software", + "authorFullName": "Roberto Dip", + "authorGitHubUsername": "roperzh", + "category": "guides", + "publishedOn": "2024-09-23", + "articleImageUrl": "/images/articles/deploy-security-agents-1600x900@2x.png", + "description": "This guide will walk you through adding and editing software packages in Fleet." + } + }, + { + "url": "/securing/detect-log4j-with-osquery-and-fleet", + "title": "Detect log4j with osquery and Fleet", + "lastModifiedAt": 1734534699073, + "htmlId": "articles--detect-log4j-with-os--a3985203cb", + "sectionRelativeRepoPath": "detect-log4j-with-osquery-and-fleet.md", + "meta": { + "category": "security", + "authorFullName": "Zach Wasserman", + "authorGitHubUsername": "zwass", + "publishedOn": "2021-12-15", + "articleTitle": "Detect Log4j with osquery (and Fleet)", + "articleImageUrl": "/images/articles/detect-log4j-with-osquery-and-fleet-1600x900@2x.jpg" + } + }, + { + "url": "/guides/discovering-chrome-ai-using-fleet", + "title": "Discovering chrome ai using Fleet", + "lastModifiedAt": 1734534699074, + "htmlId": "articles--discovering-chrome-a--a0abdbb21d", + "sectionRelativeRepoPath": "discovering-chrome-ai-using-fleet.md", + "meta": { + "articleTitle": "Discovering Chrome AI using Fleet", + "authorFullName": "Brock Walters", + "authorGitHubUsername": "nonpunctual", + "category": "guides", + "publishedOn": "2024-09-06", + "articleImageUrl": "/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg", + "description": "Use Fleet to detect and monitor settings enabled in Google Chrome by querying Chrome's preferences JSON file." + } + }, + { + "url": "/guides/discovering-geacon-using-fleet", + "title": "Discovering geacon using Fleet", + "lastModifiedAt": 1734534699076, + "htmlId": "articles--discovering-geacon-u--7b4b0cfbc2", + "sectionRelativeRepoPath": "discovering-geacon-using-fleet.md", + "meta": { + "articleTitle": "Discovering Geacon using Fleet", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "category": "guides", + "publishedOn": "2023-05-18", + "articleImageUrl": "/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg", + "description": "Enterprise security teams can use Fleet to identify and locate Geacon payloads and protect their macOS devices from this threat." + } + }, + { + "url": "/guides/discovering-xz-vulnerability-with-fleet", + "title": "Discovering xz vulnerability with Fleet", + "lastModifiedAt": 1734534699077, + "htmlId": "articles--discovering-xz-vulne--995fcf9f38", + "sectionRelativeRepoPath": "discovering-xz-vulnerability-with-fleet.md", + "meta": { + "articleTitle": "Discovering xz vulnerability with Fleet", + "authorFullName": "Brock Walters", + "authorGitHubUsername": "nonpunctual", + "category": "guides", + "publishedOn": "2024-06-03", + "articleImageUrl": "/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg", + "description": "Discover and create a comprehensive end-to-end remediation workflow for the xz vulnerability (CVE-2024-3094) with Fleet." + } + }, + { + "url": "/securing/does-osquery-violate-the-new-york-employee-monitoring-law", + "title": "Does osquery violate the new york employee monitoring law", + "lastModifiedAt": 1734534699078, + "htmlId": "articles--does-osquery-violate--c2fb841f14", + "sectionRelativeRepoPath": "does-osquery-violate-the-new-york-employee-monitoring-law.md", + "meta": { + "category": "security", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-04-18", + "articleTitle": "Does osquery violate the New York employee monitoring law?" + } + }, + { + "url": "/guides/downgrade-fleet", + "title": "Downgrade Fleet", + "lastModifiedAt": 1734534699079, + "htmlId": "articles--downgrade-fleet--9eada3bc15", + "sectionRelativeRepoPath": "downgrade-fleet.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "eashaw", + "authorFullName": "Eric Shaw", + "publishedOn": "2024-01-09", + "articleTitle": "Downgrade from Fleet Premium", + "description": "Learn how to downgrade from Fleet Premium." + } + }, + { + "url": "/guides/driving-company-culture-through-ai-haiku-poetry", + "title": "Driving company culture through ai haiku poetry", + "lastModifiedAt": 1734534699081, + "htmlId": "articles--driving-company-cult--053188a40b", + "sectionRelativeRepoPath": "driving-company-culture-through-ai-haiku-poetry.md", + "meta": { + "articleTitle": "Driving company culture through AI haiku poetry", + "authorFullName": "Luke Heath", + "authorGitHubUsername": "lukeheath", + "category": "guides", + "publishedOn": "2024-04-17", + "articleImageUrl": "/images/articles/driving-company-culture-through-ai-haiku-poetry-1600x900@2x.png", + "description": "Code and verse entwine, Silicon sparks, haikus shine, Art meets design line." + } + }, + { + "url": "/securing/ebpf-the-future-of-osquery-on-linux", + "title": "Ebpf the future of osquery on linux", + "lastModifiedAt": 1734534699081, + "htmlId": "articles--ebpf-the-future-of-o--2a8257e4a5", + "sectionRelativeRepoPath": "ebpf-the-future-of-osquery-on-linux.md", + "meta": { + "category": "security", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2021-01-25", + "articleTitle": "eBPF & the future of osquery on Linux", + "articleImageUrl": "/images/articles/ebpf-the-future-of-osquery-on-linux-cover-700x394@2x.png" + } + }, + { + "url": "/announcements/embracing-the-future-declarative-device-management", + "title": "Embracing the future declarative device management", + "lastModifiedAt": 1734534699082, + "htmlId": "articles--embracing-the-future--cc544292b9", + "sectionRelativeRepoPath": "embracing-the-future-declarative-device-management.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "spokanemac", + "authorFullName": "JD Strong", + "publishedOn": "2023-07-06", + "articleTitle": "Embracing the future: Declarative Device Management", + "articleImageUrl": "/images/articles/embracing-the-future-declarative-device-management@2x.png", + "description": "Explore the transformative impact of Declarative Device Management (DDM), Fleet, and osquery for MacAdmins." + } + }, + { + "url": "/guides/empower-linux-device-management", + "title": "Empower linux device management", + "lastModifiedAt": 1734534699084, + "htmlId": "articles--empower-linux-device--80d85cd174", + "sectionRelativeRepoPath": "empower-linux-device-management.md", + "meta": { + "articleTitle": "How Fleet empowers Linux device management", + "authorFullName": "Allen Houchins", + "authorGitHubUsername": "allenhouchins", + "category": "guides", + "publishedOn": "2024-12-03", + "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", + "description": "This guide explores how Fleet empowers Linux device management." + } + }, + { + "url": "/guides/enable-okta-verify-on-macos-with-configuration-profile", + "title": "Enable okta verify on macos with configuration profile", + "lastModifiedAt": 1734534699085, + "htmlId": "articles--enable-okta-verify-o--c60fc1abdf", + "sectionRelativeRepoPath": "enable-okta-verify-on-macOS-with-configuration-profile.md", + "meta": { + "articleTitle": "Enable Okta Verify on macOS using configuration profile", + "authorFullName": "Roberto Dip", + "authorGitHubUsername": "roperzh", + "category": "guides", + "publishedOn": "2024-09-23", + "articleImageUrl": "/images/articles/deploy-security-agents-1600x900@2x.png", + "description": "This guide will walk you through enabling Okta verify on macOS hosts using a configuration profile." + } + }, + { + "url": "/securing/end-user-self-remediation", + "title": "End user self remediation", + "lastModifiedAt": 1734534699086, + "htmlId": "articles--end-user-self-remedi--9ae34ae695", + "sectionRelativeRepoPath": "end-user-self-remediation.md", + "meta": { + "category": "security", + "authorFullName": "Chris McGillicuddy", + "authorGitHubUsername": "chris-mcgillicuddy", + "publishedOn": "2022-12-15", + "articleTitle": "End-user self remediation: empower your employees to fix security issues with Fleet" + } + }, + { + "url": "/announcements/endpoint-managements-crucial-role-in-healthcare", + "title": "Endpoint managements crucial role in healthcare", + "lastModifiedAt": 1734534699087, + "htmlId": "articles--endpoint-managements--3c2947839c", + "sectionRelativeRepoPath": "endpoint-managements-crucial-role-in-healthcare.md", + "meta": { + "category": "announcements", + "authorFullName": "Alex Mitchell", + "authorGitHubUsername": "alexmitchelliii", + "publishedOn": "2024-05-24", + "articleTitle": "Endpoint management's crucial role in healthcare", + "articleImageUrl": "/images/articles/endpoint-managements-crucial-role-in-healthcare-1600x900@2x.png", + "description": "Discover how robust endpoint management is essential for securing healthcare data, ensuring compliance, and building patient trust." + } + }, + { + "url": "/guides/enforce-disk-encryption", + "title": "Enforce disk encryption", + "lastModifiedAt": 1734534699088, + "htmlId": "articles--enforce-disk-encrypt--9a0b48c9e8", + "sectionRelativeRepoPath": "enforce-disk-encryption.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-08-14", + "articleTitle": "Enforce disk encryption", + "description": "Learn how to enforce disk encryption on macOS, Windows, and Linux hosts and manage encryption keys with Fleet Premium." + } + }, + { + "url": "/guides/enforce-os-updates", + "title": "Enforce os updates", + "lastModifiedAt": 1734534699090, + "htmlId": "articles--enforce-os-updates--c129a99813", + "sectionRelativeRepoPath": "enforce-os-updates.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-08-10", + "articleTitle": "Enforce OS updates", + "description": "Learn how to manage OS updates on macOS, Windows, iOS, and iPadOS devices." + } + }, + { + "url": "/announcements/enhancing-fleets-vulnerability-management-with-vulncheck-integration", + "title": "Enhancing fleets vulnerability management with vulncheck integration", + "lastModifiedAt": 1734534699091, + "htmlId": "articles--enhancing-fleets-vul--820b42326f", + "sectionRelativeRepoPath": "enhancing-fleets-vulnerability-management-with-vulncheck-integration.md", + "meta": { + "category": "announcements", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-04-23", + "articleTitle": "Enhancing Fleet's vulnerability management with VulnCheck integration", + "articleImageUrl": "/images/articles/enhancing-fleets-vulnerability-management-with-vulncheck-integration-1600x900@2x.png" + } + }, + { + "url": "/announcements/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet", + "title": "Enhancing k 12 cybersecurity with fcc funds and Fleet", + "lastModifiedAt": 1734534699092, + "htmlId": "articles--enhancing-k-12-cyber--e51245117d", + "sectionRelativeRepoPath": "enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet.md", + "meta": { + "category": "announcements", + "authorFullName": "Alex Mitchell", + "authorGitHubUsername": "alexmitchelliii", + "publishedOn": "2024-07-25", + "articleTitle": "Enhancing K-12 cybersecurity with FCC funds and Fleet", + "articleImageUrl": "/images/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet-1600x900@2x.png" + } + }, + { + "url": "/guides/enroll-byod-ios-ipados-hosts", + "title": "Enroll byod ios ipados hosts", + "lastModifiedAt": 1734534699093, + "htmlId": "articles--enroll-byod-ios-ipad--96ea10014e", + "sectionRelativeRepoPath": "enroll-byod-ios-ipados-hosts.md", + "meta": { + "articleTitle": "Enrolling BYOD iPad/iOS devices in Fleet", + "authorFullName": "Roberto Dip", + "authorGitHubUsername": "roperzh", + "category": "guides", + "publishedOn": "2024-09-20", + "description": "This guide will walk you through the process of inviting BYOD iPhones and iPads to enroll in Fleet." + } + }, + { + "url": "/guides/enroll-hosts", + "title": "Enroll hosts", + "lastModifiedAt": 1734534699095, + "htmlId": "articles--enroll-hosts--1805e813ad", + "sectionRelativeRepoPath": "enroll-hosts.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-08-08", + "articleTitle": "Enroll hosts", + "description": "Learn how to enroll hosts to Fleet." + } + }, + { + "url": "/guides/enrolling-a-digital-ocean-droplet-on-a-fleet-instance", + "title": "Enrolling a digital ocean droplet on a Fleet instance", + "lastModifiedAt": 1734534699096, + "htmlId": "articles--enrolling-a-digital---557ea47bcf", + "sectionRelativeRepoPath": "enrolling-a-digital-ocean-droplet-on-a-fleet-instance.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "DominusKelvin", + "authorFullName": "Kelvin Omereshone", + "publishedOn": "2022-05-26", + "articleTitle": "Enrolling a DigitalOcean Droplet on a Fleet instance", + "articleImageUrl": "/images/articles/enrolling-a-digitalocean-droplet-server-on-a-fleet-instance-cover-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/expeditioners-bradley-chambers", + "title": "Expeditioners bradley chambers", + "lastModifiedAt": 1734534699097, + "htmlId": "articles--expeditioners-bradle--2aacdea2f2", + "sectionRelativeRepoPath": "expeditioners-bradley-chambers.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2023-07-20", + "articleTitle": "ExpedITioners podcast with Bradley Chambers", + "articleImageUrl": "/images/articles/expeditioners-podcast-ep1-1600x900@2x.png" + } + }, + { + "url": "/guides/exe-install-scripts", + "title": "Exe install scripts", + "lastModifiedAt": 1734534699098, + "htmlId": "articles--exe-install-scripts--ecfb1adfd0", + "sectionRelativeRepoPath": "exe-install-scripts.md", + "meta": { + "category": "guides", + "authorFullName": "Victor Lyuboslavsky", + "authorGitHubUsername": "getvictor", + "publishedOn": "2024-09-20", + "articleTitle": "Windows EXE install scripts", + "description": "This guide will walk you through adding software to Fleet using EXE installers." + } + }, + { + "url": "/podcasts/expeditioners-charles-edge", + "title": "Expeditioners charles edge", + "lastModifiedAt": 1734534699099, + "htmlId": "articles--expeditioners-charle--107c6b4184", + "sectionRelativeRepoPath": "expeditioners-charles-edge.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2023-10-23", + "articleTitle": "ExpedITioners podcast with Charles Edge", + "articleImageUrl": "/images/articles/expeditioners-podcast-ep5-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/expeditioners-huxley-barbee", + "title": "Expeditioners huxley barbee", + "lastModifiedAt": 1734534699100, + "htmlId": "articles--expeditioners-huxley--c87966e966", + "sectionRelativeRepoPath": "expeditioners-huxley-barbee.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2024-01-30", + "articleTitle": "ExpedITioners podcast with Huxley Barbee", + "articleImageUrl": "/images/articles/expeditioners-podcast-ep8-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/expeditioners-jeff-chao", + "title": "Expeditioners jeff chao", + "lastModifiedAt": 1734534699102, + "htmlId": "articles--expeditioners-jeff-c--7036c1b267", + "sectionRelativeRepoPath": "expeditioners-jeff-chao.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2023-11-15", + "articleTitle": "ExpedITioners podcast with Jeff Chao", + "articleImageUrl": "/images/articles/expeditioners-podcast-ep6-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/expeditioners-john-reynolds", + "title": "Expeditioners john reynolds", + "lastModifiedAt": 1734534699103, + "htmlId": "articles--expeditioners-john-r--099a8c112c", + "sectionRelativeRepoPath": "expeditioners-john-reynolds.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2023-09-21", + "articleTitle": "ExpedITioners podcast with John Reynolds", + "articleImageUrl": "/images/articles/expeditioners-podcast-ep4-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/expeditioners-niels-hofmans", + "title": "Expeditioners niels hofmans", + "lastModifiedAt": 1734534699104, + "htmlId": "articles--expeditioners-niels---39ef4172b5", + "sectionRelativeRepoPath": "expeditioners-niels-hofmans.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2023-08-22", + "articleTitle": "ExpedITioners podcast with Niels Hofmans", + "articleImageUrl": "/images/articles/expeditioners-podcast-ep2-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/expeditioners-podcast-with-marcus-ransom", + "title": "Expeditioners podcast with marcus ransom", + "lastModifiedAt": 1734534699105, + "htmlId": "articles--expeditioners-podcas--8d117a3df7", + "sectionRelativeRepoPath": "expeditioners-podcast-with-marcus-ransom.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2023-12-11", + "articleTitle": "ExpedITioners podcast with Marcus Ransom", + "articleImageUrl": "/images/articles/expeditioners-podcast-ep7-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/expeditioners-rich-trouton", + "title": "Expeditioners rich trouton", + "lastModifiedAt": 1734534699106, + "htmlId": "articles--expeditioners-rich-t--2e92683eec", + "sectionRelativeRepoPath": "expeditioners-rich-trouton.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2023-08-31", + "articleTitle": "ExpedITioners podcast with Rich Trouton", + "articleImageUrl": "/images/articles/expeditioners-podcast-ep3-1600x900@2x.jpg" + } + }, + { + "url": "/guides/filtering-software-by-vulnerability", + "title": "Filtering software by vulnerability", + "lastModifiedAt": 1734534699106, + "htmlId": "articles--filtering-software-b--52ab086601", + "sectionRelativeRepoPath": "filtering-software-by-vulnerability.md", + "meta": { + "articleTitle": "Filtering software by vulnerability in Fleet", + "authorFullName": "Tim Lee", + "authorGitHubUsername": "mostlikelee", + "category": "guides", + "publishedOn": "2024-08-30", + "articleImageUrl": "/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg", + "description": "Filter software by vulnerability in Fleet to prioritize critical patches and enhance your organization's security posture." + } + }, + { + "url": "/releases/fleet-3.10.0", + "title": "Fleet 3.10.0", + "lastModifiedAt": 1734534699107, + "htmlId": "articles--fleet-3100--b0e3e54494", + "sectionRelativeRepoPath": "fleet-3.10.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-04-01", + "articleTitle": "Fleet 3.10.0 released with agent auto-updates beta", + "articleImageUrl": "/images/articles/fleet-3.10.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-3.11.0", + "title": "Fleet 3.11.0", + "lastModifiedAt": 1734534699108, + "htmlId": "articles--fleet-3110--790c741a50", + "sectionRelativeRepoPath": "fleet-3.11.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-04-29", + "articleTitle": "Fleet 3.11.0 released with software inventory", + "articleImageUrl": "/images/articles/fleet-3.11.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-3.12.0", + "title": "Fleet 3.12.0", + "lastModifiedAt": 1734534699109, + "htmlId": "articles--fleet-3120--2fe5f72c1b", + "sectionRelativeRepoPath": "fleet-3.12.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-05-20", + "articleTitle": "Fleet 3.12.0", + "articleImageUrl": "/images/articles/fleet-3.12.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-3.13.0", + "title": "Fleet 3.13.0", + "lastModifiedAt": 1734534699110, + "htmlId": "articles--fleet-3130--1e9c74e9fe", + "sectionRelativeRepoPath": "fleet-3.13.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-06-04", + "articleTitle": "Fleet 3.13.0", + "articleImageUrl": "/images/articles/fleet-3.13.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-3.5.0", + "title": "Fleet 3.5.0", + "lastModifiedAt": 1734534699111, + "htmlId": "articles--fleet-350--cbc4d45a82", + "sectionRelativeRepoPath": "fleet-3.5.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2020-12-12", + "articleTitle": "Fleet 3.5.0", + "articleImageUrl": "/images/articles/fleet-3.5.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-3.6.0", + "title": "Fleet 3.6.0", + "lastModifiedAt": 1734534699111, + "htmlId": "articles--fleet-360--b25074f833", + "sectionRelativeRepoPath": "fleet-3.6.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-01-09", + "articleTitle": "Fleet 3.6.0", + "articleImageUrl": "/images/articles/fleet-3.6.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-3.7.1", + "title": "Fleet 3.7.1", + "lastModifiedAt": 1734534699112, + "htmlId": "articles--fleet-371--e316e84c63", + "sectionRelativeRepoPath": "fleet-3.7.1.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-02-04", + "articleTitle": "Fleet 3.7.1", + "articleImageUrl": "/images/articles/fleet-3.7.1-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-3.8.0", + "title": "Fleet 3.8.0", + "lastModifiedAt": 1734534699113, + "htmlId": "articles--fleet-380--c8849a5e15", + "sectionRelativeRepoPath": "fleet-3.8.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-02-26", + "articleTitle": "Fleet 3.8.0", + "articleImageUrl": "/images/articles/fleet-3.8.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-3.9.0", + "title": "Fleet 3.9.0", + "lastModifiedAt": 1734534699114, + "htmlId": "articles--fleet-390--275552e651", + "sectionRelativeRepoPath": "fleet-3.9.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-03-10", + "articleTitle": "Fleet 3.9.0", + "articleImageUrl": "/images/articles/fleet-3.9.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.0.0", + "title": "Fleet 4.0.0", + "lastModifiedAt": 1734534699114, + "htmlId": "articles--fleet-400--10db6c0618", + "sectionRelativeRepoPath": "fleet-4.0.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-06-30", + "articleTitle": "Fleet 4.0.0 released with Role-based access control and Teams features", + "articleImageUrl": "/images/articles/fleet-4.0.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.1.0", + "title": "Fleet 4.1.0", + "lastModifiedAt": 1734534699115, + "htmlId": "articles--fleet-410--f2c5bee323", + "sectionRelativeRepoPath": "fleet-4.1.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-07-27", + "articleTitle": "Fleet 4.1.0 released with Schedule and Activity feed features", + "articleImageUrl": "/images/articles/fleet-4.1.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.10.0", + "title": "Fleet 4.10.0", + "lastModifiedAt": 1734534699116, + "htmlId": "articles--fleet-4100--18ddf38cc7", + "sectionRelativeRepoPath": "fleet-4.10.0.md", + "meta": { + "category": "releases", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2022-02-14", + "articleTitle": "Fleet 4.10.0 brings new features and improvements for vulnerability analysts.", + "articleImageUrl": "/images/articles/fleet-4.10.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.11.0", + "title": "Fleet 4.11.0", + "lastModifiedAt": 1734534699117, + "htmlId": "articles--fleet-4110--c9e9d0d603", + "sectionRelativeRepoPath": "fleet-4.11.0.md", + "meta": { + "category": "releases", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2022-03-07", + "articleTitle": "Fleet 4.11.0 brings impact clarity, improvements to vulnerability processing, and performance updates.", + "articleImageUrl": "/images/articles/fleet-4.11.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.12.0", + "title": "Fleet 4.12.0", + "lastModifiedAt": 1734534699118, + "htmlId": "articles--fleet-4120--4bc9e064ba", + "sectionRelativeRepoPath": "fleet-4.12.0.md", + "meta": { + "category": "releases", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2022-03-25", + "articleTitle": "Fleet 4.12.0 | Platform-specific policies, and improved query results", + "articleImageUrl": "/images/articles/fleet-4.12.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.13.0", + "title": "Fleet 4.13.0", + "lastModifiedAt": 1734534699119, + "htmlId": "articles--fleet-4130--cb9b277673", + "sectionRelativeRepoPath": "fleet-4.13.0.md", + "meta": { + "category": "releases", + "authorFullName": "Fleet", + "authorGitHubUsername": "fleetdm", + "publishedOn": "2022-04-19", + "articleTitle": "Fleet 4.13.0 | Security fixes, policy automations for teams, and aggregated macOS versions for MacAdmins.", + "articleImageUrl": "/images/articles/fleet-4.13.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.14.0", + "title": "Fleet 4.14.0", + "lastModifiedAt": 1734534699120, + "htmlId": "articles--fleet-4140--119ab6bde6", + "sectionRelativeRepoPath": "fleet-4.14.0.md", + "meta": { + "category": "releases", + "authorFullName": "Kathy Satterlee", + "authorGitHubUsername": "ksatter", + "publishedOn": "2022-05-06", + "articleTitle": "Fleet 4.14.0 adds beta support for automatic ticket creation and improves the live query experience.", + "articleImageUrl": "/images/articles/fleet-4.14.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.15.0", + "title": "Fleet 4.15.0", + "lastModifiedAt": 1734534699121, + "htmlId": "articles--fleet-4150--5ca468cde4", + "sectionRelativeRepoPath": "fleet-4.15.0.md", + "meta": { + "category": "releases", + "authorFullName": "Kathy Satterlee", + "authorGitHubUsername": "ksatter", + "publishedOn": "2022-05-30", + "articleTitle": "Fleet 4.15.0 adds beta support for Self-service, Scope transparency, and brings Zendesk to the party.", + "articleImageUrl": "/images/articles/fleet-4.15.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.16.0", + "title": "Fleet 4.16.0", + "lastModifiedAt": 1734534699122, + "htmlId": "articles--fleet-4160--b989e3c168", + "sectionRelativeRepoPath": "fleet-4.16.0.md", + "meta": { + "category": "releases", + "authorFullName": "Kathy Satterlee", + "authorGitHubUsername": "ksatter", + "publishedOn": "2022-06-16", + "articleTitle": "Fleet 4.16.0 | more customization, beefed up vuln management, Jira added to integrations.", + "articleImageUrl": "/images/articles/fleet-4.16.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.17.0", + "title": "Fleet 4.17.0", + "lastModifiedAt": 1734534699123, + "htmlId": "articles--fleet-4170--8923c0d5ab", + "sectionRelativeRepoPath": "fleet-4.17.0.md", + "meta": { + "category": "releases", + "authorFullName": "Kathy Satterlee", + "authorGitHubUsername": "ksatter", + "publishedOn": "2022-07-11", + "articleTitle": "Fleet 4.17.0 | Better osquery management, user engagement, improved host vitals.", + "articleImageUrl": "/images/articles/fleet-4.17.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.18.0", + "title": "Fleet 4.18.0", + "lastModifiedAt": 1734534699124, + "htmlId": "articles--fleet-4180--56ef86a9d5", + "sectionRelativeRepoPath": "fleet-4.18.0.md", + "meta": { + "category": "releases", + "authorFullName": "Kathy Satterlee", + "authorGitHubUsername": "ksatter", + "publishedOn": "2022-08-03", + "articleTitle": "Fleet 4.18.0 | Better security and user messaging in Fleet Desktop", + "articleImageUrl": "/images/articles/fleet-4.18.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.19.0", + "title": "Fleet 4.19.0", + "lastModifiedAt": 1734534699125, + "htmlId": "articles--fleet-4190--5c143179c9", + "sectionRelativeRepoPath": "fleet-4.19.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2022-08-22", + "articleTitle": "Fleet 4.19.0 | Just-in-time (JIT) user provisioning, remaining disk space, aggregate Windows and mobile device management (MDM) data", + "articleImageUrl": "/images/articles/fleet-4.19.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.2.0", + "title": "Fleet 4.2.0", + "lastModifiedAt": 1734534699126, + "htmlId": "articles--fleet-420--9537c701a9", + "sectionRelativeRepoPath": "fleet-4.2.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2021-08-12", + "articleTitle": "Fleet 4.2.0", + "articleImageUrl": "/images/articles/fleet-4.2.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.20.0", + "title": "Fleet 4.20.0", + "lastModifiedAt": 1734534699127, + "htmlId": "articles--fleet-4200--d5427af58e", + "sectionRelativeRepoPath": "fleet-4.20.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2022-09-09", + "articleTitle": "Fleet 4.20.0 | Aggregate Munki issues, test features on canary teams, improved macOS vulnerability detection", + "articleImageUrl": "/images/articles/fleet-4.20.0-1600x900.jpg" + } + }, + { + "url": "/releases/fleet-4.21.0", + "title": "Fleet 4.21.0", + "lastModifiedAt": 1734534699128, + "htmlId": "articles--fleet-4210--250af294a1", + "sectionRelativeRepoPath": "fleet-4.21.0.md", + "meta": { + "category": "releases", + "authorFullName": "Chris McGillicuddy", + "authorGitHubUsername": "chris-mcgillicuddy", + "publishedOn": "2022-10-05", + "articleTitle": "Fleet 4.21.0 | Validate config and teams YAML documents, manage osquery flags remotely with Orbit, view team and global policy compliance", + "articleImageUrl": "/images/articles/fleet-4.21.0-1600x900@2x.jpeg" + } + }, + { + "url": "/releases/fleet-4.22.0", + "title": "Fleet 4.22.0", + "lastModifiedAt": 1734534699129, + "htmlId": "articles--fleet-4220--95aabc5883", + "sectionRelativeRepoPath": "fleet-4.22.0.md", + "meta": { + "category": "releases", + "authorFullName": "Chris McGillicuddy", + "authorGitHubUsername": "chris-mcgillicuddy", + "publishedOn": "2022-10-21", + "articleTitle": "Fleet 4.22.0 | Easier access to host information, better query console UX, and clearer display names", + "articleImageUrl": "/images/articles/fleet-4.22.0-cover-800x450@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.23.0", + "title": "Fleet 4.23.0", + "lastModifiedAt": 1734534699131, + "htmlId": "articles--fleet-4230--76f329be16", + "sectionRelativeRepoPath": "fleet-4.23.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2022-11-14", + "articleTitle": "Fleet 4.23.0 | Better insight into inherited policies, improved host vitals, and more configuration visibility", + "articleImageUrl": "/images/articles/fleet-4.23.0-800x450@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.24.0", + "title": "Fleet 4.24.0", + "lastModifiedAt": 1734534699131, + "htmlId": "articles--fleet-4240--7b89434612", + "sectionRelativeRepoPath": "fleet-4.24.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2022-12-06", + "articleTitle": "Fleet 4.24.0 | Live query notifications and navigation improvements", + "articleImageUrl": "/images/articles/fleet-4.24.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.25.0", + "title": "Fleet 4.25.0", + "lastModifiedAt": 1734534699132, + "htmlId": "articles--fleet-4250--9084d84103", + "sectionRelativeRepoPath": "fleet-4.25.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2023-01-03", + "articleTitle": "Fleet 4.25.0 | Extra security and MDM visibility", + "articleImageUrl": "/images/articles/fleet-4.25.0-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.26.0", + "title": "Fleet 4.26.0", + "lastModifiedAt": 1734534699134, + "htmlId": "articles--fleet-4260--643bc79002", + "sectionRelativeRepoPath": "fleet-4.26.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2023-01-16", + "articleTitle": "Fleet 4.26.0 | Easier osquery extensions, external audit log destinations, and cleaner data lakes", + "articleImageUrl": "/images/articles/fleet-4.26.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.27.0", + "title": "Fleet 4.27.0", + "lastModifiedAt": 1734534699135, + "htmlId": "articles--fleet-4270--5955f2d968", + "sectionRelativeRepoPath": "fleet-4.27.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2023-02-14", + "articleTitle": "Fleet 4.27.0 | Improved access management and improved search filters", + "articleImageUrl": "/images/articles/fleet-4.27.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.28.0", + "title": "Fleet 4.28.0", + "lastModifiedAt": 1734534699136, + "htmlId": "articles--fleet-4280--dd7df2918a", + "sectionRelativeRepoPath": "fleet-4.28.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-02-28", + "articleTitle": "Fleet 4.28.0 | CIS benchmarks for Ventura", + "articleImageUrl": "/images/articles/fleet-4.28.0-800x450@2x.png" + } + }, + { + "url": "/releases/fleet-4.29.0", + "title": "Fleet 4.29.0", + "lastModifiedAt": 1734534699139, + "htmlId": "articles--fleet-4290--f49e0cb8d6", + "sectionRelativeRepoPath": "fleet-4.29.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-03-22", + "articleTitle": "Fleet 4.29.0 | SSO provides JIT Fleet user roles", + "articleImageUrl": "/images/articles/fleet-4.29.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.3.0", + "title": "Fleet 4.3.0", + "lastModifiedAt": 1734534699140, + "htmlId": "articles--fleet-430--9a60f316f1", + "sectionRelativeRepoPath": "fleet-4.3.0.md", + "meta": { + "category": "releases", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2021-09-07", + "articleTitle": "Fleet 4.3.0", + "articleImageUrl": "/images/articles/fleet-4.3.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.30.0", + "title": "Fleet 4.30.0", + "lastModifiedAt": 1734534699141, + "htmlId": "articles--fleet-4300--6a3be55987", + "sectionRelativeRepoPath": "fleet-4.30.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-04-11", + "articleTitle": "Fleet 4.30.0 | MDM public beta, Observer+ role, Vulnerability publication dates", + "articleImageUrl": "/images/articles/fleet-4.30.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.31.0", + "title": "Fleet 4.31.0", + "lastModifiedAt": 1734534699142, + "htmlId": "articles--fleet-4310--ba7de02e11", + "sectionRelativeRepoPath": "fleet-4.31.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-05-01", + "articleTitle": "Fleet 4.31.0 | MDM enrollment workflow, API user role.", + "articleImageUrl": "/images/articles/fleet-4.31.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.32.0", + "title": "Fleet 4.32.0", + "lastModifiedAt": 1734534699143, + "htmlId": "articles--fleet-4320--747f0854b4", + "sectionRelativeRepoPath": "fleet-4.32.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-05-24", + "articleTitle": "Fleet 4.32.0 | User migration, customizing macOS Setup Assistant.", + "articleImageUrl": "/images/articles/fleet-4.32.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.33.0", + "title": "Fleet 4.33.0", + "lastModifiedAt": 1734534699145, + "htmlId": "articles--fleet-4330--1fee221322", + "sectionRelativeRepoPath": "fleet-4.33.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-06-13", + "articleTitle": "Fleet 4.33.0 | ChromeOS support, new verified status", + "articleImageUrl": "/images/articles/fleet-4.33.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.34.0", + "title": "Fleet 4.34.0", + "lastModifiedAt": 1734534699146, + "htmlId": "articles--fleet-4340--e5a31e5868", + "sectionRelativeRepoPath": "fleet-4.34.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-07-12", + "articleTitle": "Fleet 4.34.0 | ChromeOS tables, CIS Benchmark load testing", + "articleImageUrl": "/images/articles/fleet-4.34.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.35.0", + "title": "Fleet 4.35.0", + "lastModifiedAt": 1734534699147, + "htmlId": "articles--fleet-4350--249a0f8772", + "sectionRelativeRepoPath": "fleet-4.35.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-08-01", + "articleTitle": "Fleet 4.35.0 | Improvements and bug fixes.", + "articleImageUrl": "/images/articles/fleet-4.35.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.36.0", + "title": "Fleet 4.36.0", + "lastModifiedAt": 1734534699148, + "htmlId": "articles--fleet-4360--ebb48de30e", + "sectionRelativeRepoPath": "fleet-4.36.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-08-18", + "articleTitle": "Fleet 4.36.0 | Saved and scheduled queries merge.", + "articleImageUrl": "/images/articles/fleet-4.36.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.37.0", + "title": "Fleet 4.37.0", + "lastModifiedAt": 1734534699149, + "htmlId": "articles--fleet-4370--688288f4e8", + "sectionRelativeRepoPath": "fleet-4.37.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-09-07", + "articleTitle": "Fleet 4.37.0 | Remote script execution & Puppet support.", + "articleImageUrl": "/images/articles/fleet-4.37.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.38.0", + "title": "Fleet 4.38.0", + "lastModifiedAt": 1734534699151, + "htmlId": "articles--fleet-4380--d9dff8c995", + "sectionRelativeRepoPath": "fleet-4.38.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-09-25", + "articleTitle": "Fleet 4.38.0 | Profile redelivery, NVD details, and custom extension label support.", + "articleImageUrl": "/images/articles/fleet-4.38.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.39.0", + "title": "Fleet 4.39.0", + "lastModifiedAt": 1734534699152, + "htmlId": "articles--fleet-4390--c36caafa80", + "sectionRelativeRepoPath": "fleet-4.39.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-10-26", + "articleTitle": "Fleet 4.39.0 | Sonoma support, script library, query reports.", + "articleImageUrl": "/images/articles/fleet-4.39.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.4.0", + "title": "Fleet 4.4.0", + "lastModifiedAt": 1734534699153, + "htmlId": "articles--fleet-440--8b0a4ce185", + "sectionRelativeRepoPath": "fleet-4.4.0.md", + "meta": { + "category": "releases", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2021-10-07", + "articleTitle": "Fleet 4.4.0 releases aggregated software inventory, team policies, and improved team scheduling", + "articleImageUrl": "/images/articles/fleet-4.4.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.40.0", + "title": "Fleet 4.40.0", + "lastModifiedAt": 1734534699154, + "htmlId": "articles--fleet-4400--0b9e981d27", + "sectionRelativeRepoPath": "fleet-4.40.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-11-06", + "articleTitle": "Fleet 4.40.0 | More Data, Rapid Security Response, CIS Benchmark updates.", + "articleImageUrl": "/images/articles/fleet-4.40.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.41.0", + "title": "Fleet 4.41.0", + "lastModifiedAt": 1734534699155, + "htmlId": "articles--fleet-4410--769634013d", + "sectionRelativeRepoPath": "fleet-4.41.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-11-28", + "articleTitle": "Fleet 4.41.0 | NVD API 2.0, Windows script library.", + "articleImageUrl": "/images/articles/fleet-4.41.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.42.0", + "title": "Fleet 4.42.0", + "lastModifiedAt": 1734534699156, + "htmlId": "articles--fleet-4420--310101f058", + "sectionRelativeRepoPath": "fleet-4.42.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-12-21", + "articleTitle": "Fleet 4.42.0 | Query performance reporting, host targeting improvements.", + "articleImageUrl": "/images/articles/fleet-4.42.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.43.0", + "title": "Fleet 4.43.0", + "lastModifiedAt": 1734534699157, + "htmlId": "articles--fleet-4430--8ac4a50fbb", + "sectionRelativeRepoPath": "fleet-4.43.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-01-09", + "articleTitle": "Fleet 4.43.0 | Query performance reporting, host targeting improvements.", + "articleImageUrl": "/images/articles/fleet-4.43.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.44.0", + "title": "Fleet 4.44.0", + "lastModifiedAt": 1734534699159, + "htmlId": "articles--fleet-4440--26af837653", + "sectionRelativeRepoPath": "fleet-4.44.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-02-05", + "articleTitle": "Fleet 4.44.0 | Script execution, host expiry, and host targeting improvements.", + "articleImageUrl": "/images/articles/fleet-4.44.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.45.0", + "title": "Fleet 4.45.0", + "lastModifiedAt": 1734534699160, + "htmlId": "articles--fleet-4450--c8ae399334", + "sectionRelativeRepoPath": "fleet-4.45.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-02-21", + "articleTitle": "Fleet 4.45.0 | Remote lock, Linux script library, osquery storage location.", + "articleImageUrl": "/images/articles/fleet-4.45.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.46.0", + "title": "Fleet 4.46.0", + "lastModifiedAt": 1734534699161, + "htmlId": "articles--fleet-4460--e728f3d2b3", + "sectionRelativeRepoPath": "fleet-4.46.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-02-26", + "articleTitle": "Fleet 4.46.0 | Automatic SCEP certificate renewal.", + "articleImageUrl": "/images/articles/fleet-4.46.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.47.0", + "title": "Fleet 4.47.0", + "lastModifiedAt": 1734534699163, + "htmlId": "articles--fleet-4470--6295db06d8", + "sectionRelativeRepoPath": "fleet-4.47.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-03-12", + "articleTitle": "Fleet 4.47.0 | Cross-platform remote wipe, vulnerabilities page, and scripting improvements.", + "articleImageUrl": "/images/articles/fleet-4.47.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.48.0", + "title": "Fleet 4.48.0", + "lastModifiedAt": 1734534699164, + "htmlId": "articles--fleet-4480--0de641ecf8", + "sectionRelativeRepoPath": "fleet-4.48.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-04-03", + "articleTitle": "Fleet 4.48.0 | IdP local account creation, VS Code extensions.", + "articleImageUrl": "/images/articles/fleet-4.48.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.5.0", + "title": "Fleet 4.5.0", + "lastModifiedAt": 1734534699165, + "htmlId": "articles--fleet-450--16090a81fa", + "sectionRelativeRepoPath": "fleet-4.5.0.md", + "meta": { + "category": "releases", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2021-11-02", + "articleTitle": "Fleet 4.5.0 with new team admin role, live OS compatibility checking, query performance impact, and a new-look dashboard", + "articleImageUrl": "/images/articles/fleet-4.5.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.49.0", + "title": "Fleet 4.49.0", + "lastModifiedAt": 1734534699167, + "htmlId": "articles--fleet-4490--785565c6fe", + "sectionRelativeRepoPath": "fleet-4.49.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-04-23", + "articleTitle": "Fleet 4.49.0 | VulnCheck's NVD++, device health API, fleetd data parsing.", + "articleImageUrl": "/images/articles/fleet-4.49.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.50.0", + "title": "Fleet 4.50.0", + "lastModifiedAt": 1734534699169, + "htmlId": "articles--fleet-4500--db0ec5db63", + "sectionRelativeRepoPath": "fleet-4.50.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-05-22", + "articleTitle": "Fleet 4.50.0 | Security agent deployment, AI descriptions, and Mac Admins SOFA support.", + "articleImageUrl": "/images/articles/fleet-4.50.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.51.0", + "title": "Fleet 4.51.0", + "lastModifiedAt": 1734534699171, + "htmlId": "articles--fleet-4510--6fb26e7b9f", + "sectionRelativeRepoPath": "fleet-4.51.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-06-10", + "articleTitle": "Fleet 4.51.0 | Global activity webhook, macOS TCC table, and software self-service.", + "articleImageUrl": "/images/articles/fleet-4.51.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.53.0", + "title": "Fleet 4.53.0", + "lastModifiedAt": 1734534699173, + "htmlId": "articles--fleet-4530--e7adae62e6", + "sectionRelativeRepoPath": "fleet-4.53.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-06-25", + "articleTitle": "Fleet 4.53.0 | Better vuln matching, multi-issue hosts, & `fleetd` logs as tables", + "articleImageUrl": "/images/articles/fleet-4.53.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.54.0", + "title": "Fleet 4.54.0", + "lastModifiedAt": 1734534699174, + "htmlId": "articles--fleet-4540--92d9f0afc7", + "sectionRelativeRepoPath": "fleet-4.54.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-07-17", + "articleTitle": "Fleet 4.54.0 | Target hosts via label exclusion, script execution time.", + "articleImageUrl": "/images/articles/fleet-4.54.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.55.0", + "title": "Fleet 4.55.0", + "lastModifiedAt": 1734534699176, + "htmlId": "articles--fleet-4550--136a79fe52", + "sectionRelativeRepoPath": "fleet-4.55.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-08-09", + "articleTitle": "Fleet 4.55.0 | MySQL 8, arm64 support, FileVault improvements, VPP support.", + "articleImageUrl": "/images/articles/fleet-4.55.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.57.0", + "title": "Fleet 4.57.0", + "lastModifiedAt": 1734534699177, + "htmlId": "articles--fleet-4570--af6b8081fd", + "sectionRelativeRepoPath": "fleet-4.57.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-09-23", + "articleTitle": "Fleet 4.57.0 | Software improvements, policy automation, GitLab support.", + "articleImageUrl": "/images/articles/fleet-4.57.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.56.0", + "title": "Fleet 4.56.0", + "lastModifiedAt": 1734534699179, + "htmlId": "articles--fleet-4560--27b9f794d8", + "sectionRelativeRepoPath": "fleet-4.56.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-09-07", + "articleTitle": "Fleet 4.56.0 | Enhanced MDM migration, Exact CVE Search, and Self-Service VPP Apps.", + "articleImageUrl": "/images/articles/fleet-4.56.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.58.0", + "title": "Fleet 4.58.0", + "lastModifiedAt": 1734534699180, + "htmlId": "articles--fleet-4580--7c0f184c1f", + "sectionRelativeRepoPath": "fleet-4.58.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-10-16", + "articleTitle": "Fleet 4.58.0 | Run script on policy failure, Fleet-maintained apps, Sequoia firewall status.", + "articleImageUrl": "/images/articles/fleet-4.58.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.59.0", + "title": "Fleet 4.59.0", + "lastModifiedAt": 1734534699181, + "htmlId": "articles--fleet-4590--cd9cf3359d", + "sectionRelativeRepoPath": "fleet-4.59.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2024-11-12", + "articleTitle": "Fleet 4.59.0 | Install apps during new Mac boot, connect end users to Wi-Fi", + "articleImageUrl": "/images/articles/fleet-4.59.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.6.0", + "title": "Fleet 4.6.0", + "lastModifiedAt": 1734534699183, + "htmlId": "articles--fleet-460--f6d14e9b59", + "sectionRelativeRepoPath": "fleet-4.6.0.md", + "meta": { + "category": "releases", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2021-11-19", + "articleTitle": "Fleet 4.6.0 with osquery installer, enroll secret management, and improved host vitals", + "articleImageUrl": "/images/articles/fleet-4.6.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.60.0", + "title": "Fleet 4.60.0", + "lastModifiedAt": 1734534699184, + "htmlId": "articles--fleet-4600--e1b5593d81", + "sectionRelativeRepoPath": "fleet-4.60.0.md", + "meta": { + "category": "releases", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "publishedOn": "2024-11-27", + "articleTitle": "Fleet 4.60.0 | Escrow Linux disk encryption keys, custom targets for OS settings, scripts preview", + "articleImageUrl": "/images/articles/fleet-4.60.0-1600x900@2x.png" + } + }, + { + "url": "/releases/fleet-4.7.0", + "title": "Fleet 4.7.0", + "lastModifiedAt": 1734534699185, + "htmlId": "articles--fleet-470--a62ddf9cc9", + "sectionRelativeRepoPath": "fleet-4.7.0.md", + "meta": { + "category": "releases", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2021-12-14", + "articleTitle": "Does Fleet 4.7.0 bring more power to your osquery compliance policies? Yes.", + "articleImageUrl": "/images/articles/fleet-4.7.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.8.0", + "title": "Fleet 4.8.0", + "lastModifiedAt": 1734534699186, + "htmlId": "articles--fleet-480--d05a01c735", + "sectionRelativeRepoPath": "fleet-4.8.0.md", + "meta": { + "category": "releases", + "authorFullName": "Drew Baker", + "authorGitHubUsername": "Drew-P-drawers", + "publishedOn": "2021-12-31", + "articleTitle": "Looking for policy automations, Google Chrome profile search, and Munki details from your hosts? Upgrade to Fleet 4.8.0", + "articleImageUrl": "/images/articles/fleet-4.8.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/releases/fleet-4.9.0", + "title": "Fleet 4.9.0", + "lastModifiedAt": 1734534699187, + "htmlId": "articles--fleet-490--ec1e278406", + "sectionRelativeRepoPath": "fleet-4.9.0.md", + "meta": { + "category": "releases", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2022-01-24", + "articleTitle": "Fleet 4.9.0 brings performance updates, paginated live query results, and policy YAML doc support.", + "articleImageUrl": "/images/articles/fleet-4.9.0-cover-1600x900@2x.jpg" + } + }, + { + "url": "/announcements/fleet-adds-support-for-chrome-os", + "title": "Fleet adds support for chrome os", + "lastModifiedAt": 1734534699188, + "htmlId": "articles--fleet-adds-support-f--d81844f01b", + "sectionRelativeRepoPath": "fleet-adds-support-for-chrome-os.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "spokanemac", + "authorFullName": "JD Strong", + "publishedOn": "2023-06-13", + "articleTitle": "Fleet enhances device management with ChromeOS support", + "articleImageUrl": "/images/articles/fleet-adds-support-for-chrome-os-1600x900@2x.png", + "description": "We're thrilled to announce that Fleet has expanded support to include ChromeOS and ChromeOS Flex!" + } + }, + { + "url": "/guides/fleet-ai-assisted-policy-descriptions-and-resolutions", + "title": "Fleet ai assisted policy descriptions and resolutions", + "lastModifiedAt": 1734534699189, + "htmlId": "articles--fleet-ai-assisted-po--a7882a108b", + "sectionRelativeRepoPath": "fleet-ai-assisted-policy-descriptions-and-resolutions.md", + "meta": { + "articleTitle": "Fleet’s AI-assisted policy descriptions and resolutions", + "authorFullName": "Rachel Perkins", + "authorGitHubUsername": "rachelelysia", + "category": "guides", + "publishedOn": "2024-05-20", + "articleImageUrl": "/images/articles/fleet-ai-assisted-policy-descriptions-and-resolutions-1600x900@2x.png", + "description": "AI guides our way, Policies clear, secure paths, Compliance shines bright." + } + }, + { + "url": "/announcements/fleet-desktop-says-hello-world", + "title": "Fleet desktop says hello world", + "lastModifiedAt": 1734534699191, + "htmlId": "articles--fleet-desktop-says-h--2f36103425", + "sectionRelativeRepoPath": "fleet-desktop-says-hello-world.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "zhumo", + "authorFullName": "Mo Zhu", + "publishedOn": "2022-08-02", + "articleTitle": "Fleet Desktop says “Hello, world!”", + "articleImageUrl": "/images/articles/fleet-desktop-says-hello-world-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/fleet-desktop", + "title": "Fleet desktop", + "lastModifiedAt": 1734534699192, + "htmlId": "articles--fleet-desktop--d36161e24b", + "sectionRelativeRepoPath": "fleet-desktop.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "zhumo", + "authorFullName": "Mo Zhu", + "publishedOn": "2024-04-19", + "articleTitle": "Fleet Desktop", + "description": "Learn about Fleet Desktop's features for self-remediation and transparency." + } + }, + { + "url": "/announcements/fleet-in-your-calendar-introducing-maintenance-windows", + "title": "Fleet in your calendar introducing maintenance windows", + "lastModifiedAt": 1734534699193, + "htmlId": "articles--fleet-in-your-calend--03ef1241cd", + "sectionRelativeRepoPath": "fleet-in-your-calendar-introducing-maintenance-windows.md", + "meta": { + "category": "announcements", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-04-30", + "articleTitle": "Fleet in your calendar: introducing maintenance windows", + "articleImageUrl": "/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-cover-900x450@2x.png", + "description": "Like any good colleague, when Fleet needs some of your time, it puts it on your calendar." + } + }, + { + "url": "/releases/fleet-introduces-mdm", + "title": "Fleet introduces mdm", + "lastModifiedAt": 1734534699194, + "htmlId": "articles--fleet-introduces-mdm--e126b508aa", + "sectionRelativeRepoPath": "fleet-introduces-mdm.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-04-11", + "articleTitle": "Fleet introduces MDM", + "articleImageUrl": "/images/articles/fleet-mdm-launch-cover-800x450@2x.jpg" + } + }, + { + "url": "/announcements/fleet-in-vegas-2023", + "title": "Fleet in vegas 2023", + "lastModifiedAt": 1734534699195, + "htmlId": "articles--fleet-in-vegas-2023--5e6e6c4702", + "sectionRelativeRepoPath": "fleet-in-vegas-2023.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "spokanemac", + "authorFullName": "JD Strong", + "publishedOn": "2023-08-02", + "articleTitle": "Fleet takes on Vegas: Exploring cybersecurity's future at Black Hat, B-Sides, and DEF CON 31", + "articleImageUrl": "/images/articles/fleet-in-vegas-2023@2x.jpg", + "description": "Explore cybersecurity's cutting edge with Fleet at three top-tier conferences - Black Hat, Security B-Sides, and DEF CON." + } + }, + { + "url": "/announcements/fleet-introduces-windows-mdm", + "title": "Fleet introduces windows mdm", + "lastModifiedAt": 1734534699197, + "htmlId": "articles--fleet-introduces-win--cd488bb223", + "sectionRelativeRepoPath": "fleet-introduces-windows-mdm.md", + "meta": { + "category": "announcements", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-01-24", + "articleTitle": "Fleet introduces Windows MDM", + "articleImageUrl": "/images/articles/fleet-win-mdm-launch-cover-800x450@2x.png" + } + }, + { + "url": "/announcements/fleet-is-abuzz-for-macdevops-yvr-2023", + "title": "Fleet is abuzz for macdevops yvr 2023", + "lastModifiedAt": 1734534699198, + "htmlId": "articles--fleet-is-abuzz-for-m--fc35974d97", + "sectionRelativeRepoPath": "fleet-is-abuzz-for-macdevops-yvr-2023.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "spokanemac", + "authorFullName": "JD Strong", + "publishedOn": "2023-06-07", + "articleTitle": "Fleet is abuzz 🐝 for MacDevOps:YVR", + "articleImageUrl": "/images/articles/fleet-is-abuzz-for-macdevops-yvr-2023@2x.png", + "description": "Fleet is a proud sponsor of MacDevOps:YVR which is back in person in Vancouver, B.C. June 21-22, 2023" + } + }, + { + "url": "/announcements/fleet-now-supports-ios-and-ipados-software-deployment-and-automated-patch-management", + "title": "Fleet now supports ios and ipados software deployment and automated patch management", + "lastModifiedAt": 1734534699199, + "htmlId": "articles--fleet-now-supports-i--8e6c12ef82", + "sectionRelativeRepoPath": "fleet-now-supports-ios-and-ipados-software-deployment-and-automated-patch-management.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "Drew-P-drawers", + "authorFullName": "Andrew Baker", + "publishedOn": "2024-09-26", + "articleTitle": "Fleet now supports iOS and iPadOS, software deployment, and automated patch management.", + "description": "Fleet announces support for iOS and iPadOS, software deployment, and automated patch management" + } + }, + { + "url": "/securing/fleet-osquery-unlocking-the-value-of-axonius-with-open-source-telemetry", + "title": "Fleet osquery unlocking the value of axonius with open source telemetry", + "lastModifiedAt": 1734534699200, + "htmlId": "articles--fleet-osquery-unlock--5e320c2813", + "sectionRelativeRepoPath": "fleet-osquery-unlocking-the-value-of-axonius-with-open-source-telemetry.md", + "meta": { + "category": "security", + "authorFullName": "Brad Macdowall", + "authorGitHubUsername": "BradMacd", + "publishedOn": "2023-12-28", + "articleTitle": "Fleet & osquery: Unlocking the value of Axonius with open-source telemetry", + "articleImageUrl": "/images/articles/fleet-osquery-unlocking-the-value-of-axonius-with-open-source-telemetry-1600x900@2x.png" + } + }, + { + "url": "/guides/fleet-quick-tips-querying-procdump-eula-has-been-accepted", + "title": "Fleet quick tips querying procdump eula has been accepted", + "lastModifiedAt": 1734534699200, + "htmlId": "articles--fleet-quick-tips-que--cc69d0c9b3", + "sectionRelativeRepoPath": "fleet-quick-tips-querying-procdump-eula-has-been-accepted.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "mike-j-thomas", + "authorFullName": "Mike Thomas", + "publishedOn": "2021-05-11", + "articleTitle": "Fleet quick tips — identify systems where the ProcDump EULA has been accepted", + "articleImageUrl": "/images/articles/fleet-quick-tips-querying-procdump-eula-has-been-accepted-cover-700x440@2x.png" + } + }, + { + "url": "/announcements/fleet-supports-macos-15-sequoia-ios-18-and-ipados-18", + "title": "Fleet supports macos 15 sequoia ios 18 and ipados 18", + "lastModifiedAt": 1734534699201, + "htmlId": "articles--fleet-supports-macos--8b3b33de24", + "sectionRelativeRepoPath": "fleet-supports-macos-15-sequoia-ios-18-and-ipados-18.md", + "meta": { + "category": "announcements", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-09-27", + "articleTitle": "Fleet supports Apple’s latest operating systems: macOS 15 Sequoia, iOS 18, and iPadOS 18", + "articleImageUrl": "/images/articles/fleet-supports-macos-15-sequoia-ios-18-and-ipados-18-1600x900@2x.jpg", + "description": "Fleet is pleased to announce full support for macOS 15 Sequoia, iOS 18, and iPadOS 18." + } + }, + { + "url": "/guides/fleet-terraform-byo-vpc-module", + "title": "Fleet terraform byo vpc module", + "lastModifiedAt": 1734534699202, + "htmlId": "articles--fleet-terraform-byo---67fad5f83d", + "sectionRelativeRepoPath": "fleet-terraform-byo-vpc-module.md", + "meta": { + "category": "guides", + "authorFullName": "Robert Fairburn", + "authorGitHubUsername": "rfairburn", + "publishedOn": "2023-09-01", + "articleTitle": "Using the Fleet Terraform module with an existing VPC" + } + }, + { + "url": "/announcements/fleet-terraform-module", + "title": "Fleet terraform module", + "lastModifiedAt": 1734534699203, + "htmlId": "articles--fleet-terraform-modu--ee02810266", + "sectionRelativeRepoPath": "fleet-terraform-module.md", + "meta": { + "category": "announcements", + "authorFullName": "Zachary Winnerman", + "authorGitHubUsername": "zwinnerman-fleetdm", + "publishedOn": "2023-01-09", + "articleTitle": "Keep Fleet running smoothly on AWS with the new Terraform module" + } + }, + { + "url": "/announcements/fleet-reimagines-observability-with-devops-teams", + "title": "Fleet reimagines observability with devops teams", + "lastModifiedAt": 1734534699204, + "htmlId": "articles--fleet-reimagines-obs--e61405d9fc", + "sectionRelativeRepoPath": "fleet-reimagines-observability-with-devops-teams.md", + "meta": { + "category": "announcements", + "authorFullName": "Mike McNeil", + "authorGitHubUsername": "mikermcneil", + "publishedOn": "2024-11-14", + "articleTitle": "Fleet reimagines observability with DevOps teams at Roblox, Atlassian, Dropbox", + "description": "Fleet speeds up compliance audits and enables next-gen intrusion detection in large production infrastructures" + } + }, + { + "url": "/guides/fleet-usage-statistics", + "title": "Fleet usage statistics", + "lastModifiedAt": 1734534699205, + "htmlId": "articles--fleet-usage-statisti--14a3f66822", + "sectionRelativeRepoPath": "fleet-usage-statistics.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-08-13", + "articleTitle": "Fleet usage statistics", + "description": "Learn about Fleet's usage statistics and what information is collected." + } + }, + { + "url": "/success-stories/fleet-user-stories-f100", + "title": "Fleet user stories f100", + "lastModifiedAt": 1734534699207, + "htmlId": "articles--fleet-user-stories-f--037a54a633", + "sectionRelativeRepoPath": "fleet-user-stories-f100.md", + "meta": { + "category": "success stories", + "authorGitHubUsername": "mike-j-thomas", + "authorFullName": "Mike Thomas", + "publishedOn": "2021-09-29", + "articleTitle": "Fleet user stories — F100", + "articleImageUrl": "/images/articles/fleet-user-stories-f100-cover-800x450@2x.png" + } + }, + { + "url": "/success-stories/fleet-user-stories-schrodinger", + "title": "Fleet user stories schrodinger", + "lastModifiedAt": 1734534699208, + "htmlId": "articles--fleet-user-stories-s--18d6e5a27f", + "sectionRelativeRepoPath": "fleet-user-stories-schrodinger.md", + "meta": { + "category": "success stories", + "authorGitHubUsername": "mike-j-thomas", + "authorFullName": "Mike Thomas", + "publishedOn": "2021-09-10", + "articleTitle": "Fleet user stories — Schrödinger", + "articleImageUrl": "/images/articles/fleet-user-stories-schrodinger-cover-800x450@2x.png" + } + }, + { + "url": "/success-stories/fleet-user-stories-wayfair", + "title": "Fleet user stories wayfair", + "lastModifiedAt": 1734534699209, + "htmlId": "articles--fleet-user-stories-w--bf80b85383", + "sectionRelativeRepoPath": "fleet-user-stories-wayfair.md", + "meta": { + "category": "success stories", + "authorGitHubUsername": "mike-j-thomas", + "authorFullName": "Mike Thomas", + "publishedOn": "2021-08-20", + "articleTitle": "Fleet user stories — Wayfair", + "articleImageUrl": "/images/articles/fleet-user-stories-wayfair-cover-800x450@2x.png" + } + }, + { + "url": "/guides/fleetctl", + "title": "Fleetctl", + "lastModifiedAt": 1734534699210, + "htmlId": "articles--fleetctl--6d77afeae9", + "sectionRelativeRepoPath": "fleetctl.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-07-04", + "articleTitle": "fleetctl", + "description": "Read about fleetctl, a CLI tool for managing Fleet and osquery configurations, running queries, generating Fleet's agent (fleetd), and more." + } + }, + { + "url": "/guides/fleetd-authentication", + "title": "Fleetd authentication", + "lastModifiedAt": 1734534699211, + "htmlId": "articles--fleetd-authenticatio--8506cf0233", + "sectionRelativeRepoPath": "fleetd-authentication.md", + "meta": { + "authorGitHubUsername": "lucasmrod", + "authorFullName": "Lucas Rodriguez", + "publishedOn": "2024-11-14", + "articleTitle": "Fleetd authentication", + "category": "guides" + } + }, + { + "url": "/guides/fleetd-mtls", + "title": "Fleetd mtls", + "lastModifiedAt": 1734534699213, + "htmlId": "articles--fleetd-mtls--8e886750d3", + "sectionRelativeRepoPath": "fleetd-mtls.md", + "meta": { + "authorGitHubUsername": "lucasmrod", + "authorFullName": "Lucas Rodriguez", + "publishedOn": "2024-12-06", + "articleTitle": "mTLS support in fleetd", + "category": "guides" + } + }, + { + "url": "/guides/fleetd-updates", + "title": "Fleetd updates", + "lastModifiedAt": 1734534699214, + "htmlId": "articles--fleetd-updates--c5705e22b1", + "sectionRelativeRepoPath": "fleetd-updates.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-04-30", + "articleTitle": "Fleetd updates", + "description": "Information on how to manage and secure Fleet agent updates." + } + }, + { + "url": "/announcements/foursquare-quickly-migrates-to-fleet", + "title": "Foursquare quickly migrates to Fleet", + "lastModifiedAt": 1734534699215, + "htmlId": "articles--foursquare-quickly-m--44a6d79b32", + "sectionRelativeRepoPath": "foursquare-quickly-migrates-to-fleet.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "Drew-P-drawers", + "authorFullName": "Andrew Baker", + "publishedOn": "2024-12-13", + "articleTitle": "Foursquare quickly migrates to Fleet for Device Management", + "description": "Foursquare quickly migrates to Fleet for Device Management" + } + }, + { + "url": "/announcements/from-osquery-to-fleet-planting-the-seed", + "title": "From osquery to Fleet planting the seed", + "lastModifiedAt": 1734534699216, + "htmlId": "articles--from-osquery-to-flee--4079a239ba", + "sectionRelativeRepoPath": "from-osquery-to-fleet-planting-the-seed.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2022-01-20", + "articleTitle": "The next step for Fleet: our $5M seed round 🌱", + "articleImageUrl": "/images/articles/from-osquery-to-fleet-planting-the-seed-cover-800x450@2x.png" + } + }, + { + "url": "/guides/generate-process-trees-with-osquery", + "title": "Generate process trees with osquery", + "lastModifiedAt": 1734534699217, + "htmlId": "articles--generate-process-tre--d66f117257", + "sectionRelativeRepoPath": "generate-process-trees-with-osquery.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2020-03-17", + "articleTitle": "Generate process trees with osquery", + "articleImageUrl": "/images/articles/generate-process-trees-with-osquery-cover-700x393@2x.jpeg" + } + }, + { + "url": "/securing/get-and-stay-compliant-across-your-devices-with-fleet", + "title": "Get and stay compliant across your devices with Fleet", + "lastModifiedAt": 1734534699219, + "htmlId": "articles--get-and-stay-complia--962ba5c6b2", + "sectionRelativeRepoPath": "get-and-stay-compliant-across-your-devices-with-fleet.md", + "meta": { + "category": "security", + "authorFullName": "Drew Baker", + "authorGitHubUsername": "Drew-P-drawers", + "publishedOn": "2022-03-09", + "articleTitle": "Get and stay compliant across your devices with Fleet.", + "articleImageUrl": "/images/articles/get-and-stay-compliant-across-your-devices-with-fleet-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/get-current-telemetry-from-your-devices-with-live-queries", + "title": "Get current telemetry from your devices with live queries", + "lastModifiedAt": 1734534699220, + "htmlId": "articles--get-current-telemetr--3c3b77f4f1", + "sectionRelativeRepoPath": "get-current-telemetry-from-your-devices-with-live-queries.md", + "meta": { + "articleTitle": "Get current telemetry from your devices with live queries", + "authorFullName": "Victor Lyuboslavsky", + "authorGitHubUsername": "getvictor", + "category": "guides", + "publishedOn": "2023-12-27", + "description": "Learn how live queries work under the hood." + } + }, + { + "url": "/announcements/global-cloud-platform-simplifies-device-management-with-fleet", + "title": "Global cloud platform simplifies device management with Fleet", + "lastModifiedAt": 1734534699221, + "htmlId": "articles--global-cloud-platfor--900400eb11", + "sectionRelativeRepoPath": "global-cloud-platform-simplifies-device-management-with-fleet.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "Drew-P-drawers", + "authorFullName": "Andrew Baker", + "publishedOn": "2024-12-09", + "articleTitle": "Global edge cloud platform simplifies device management with Fleet", + "description": "Global edge cloud platform simplifies device management" + } + }, + { + "url": "/announcements/global-social-media-platform-switches-to-fleet", + "title": "Global social media platform switches to Fleet", + "lastModifiedAt": 1734534699221, + "htmlId": "articles--global-social-media---20a1284024", + "sectionRelativeRepoPath": "global-social-media-platform-switches-to-fleet.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "Drew-P-drawers", + "authorFullName": "Andrew Baker", + "publishedOn": "2024-12-16", + "articleTitle": "Global social media platform migrates to Fleet", + "description": "Global social media platform migrates to Fleet" + } + }, + { + "url": "/announcements/government-agencies-need-to-dith-the-mdm-thicket", + "title": "Government agencies need to dith the mdm thicket", + "lastModifiedAt": 1734534699222, + "htmlId": "articles--government-agencies---854c091be3", + "sectionRelativeRepoPath": "government-agencies-need-to-dith-the-mdm-thicket.md", + "meta": { + "category": "announcements", + "authorFullName": "Keith Barnes", + "authorGitHubUsername": "KAB703", + "publishedOn": "2024-02-09", + "articleTitle": "Government agencies need to ditch the MDM thicket: multiple solutions cost you more than you think", + "articleImageUrl": "/images/articles/government-agencies-need-to-dith-the-mdm-thicket-1600x900@2x.png" + } + }, + { + "url": "/announcements/happy-1st-anniversary-fleet", + "title": "Happy 1st anniversary Fleet", + "lastModifiedAt": 1734534699223, + "htmlId": "articles--happy-1st-anniversar--f5bfe1b189", + "sectionRelativeRepoPath": "happy-1st-anniversary-fleet.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "mike-j-thomas", + "authorFullName": "Mike Thomas", + "publishedOn": "2021-10-08", + "articleTitle": "Happy 1st anniversary, Fleet.", + "articleImageUrl": "/images/articles/happy-1st-anniversary-fleet-cover-800x450@2x.png" + } + }, + { + "url": "/securing/how-fleet-helps-federal-agencies-meet-cisa-bod-23-01", + "title": "How Fleet helps federal agencies meet cisa bod 23 01", + "lastModifiedAt": 1734534699224, + "htmlId": "articles--how-fleet-helps-fede--a65d1be4f6", + "sectionRelativeRepoPath": "how-fleet-helps-federal-agencies-meet-cisa-bod-23-01.md", + "meta": { + "category": "security", + "authorFullName": "Chris McGillicuddy", + "authorGitHubUsername": "chris-mcgillicuddy", + "publishedOn": "2022-10-28", + "articleTitle": "How Fleet helps federal agencies meet CISA BOD 23-01", + "articleImageUrl": "/images/articles/BOD-23-01-800x450@2x.jpg" + } + }, + { + "url": "/securing/how-osquery-can-help-cyber-responders", + "title": "How osquery can help cyber responders", + "lastModifiedAt": 1734534699225, + "htmlId": "articles--how-osquery-can-help--64d8236168", + "sectionRelativeRepoPath": "how-osquery-can-help-cyber-responders.md", + "meta": { + "category": "security", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-11-02", + "articleTitle": "How osquery can help cyber responders.", + "articleImageUrl": "/images/articles/osquery-for-cyber-responders-1600x900@2x.png" + } + }, + { + "url": "/guides/how-to-install-osquery-and-enroll-linux-devices-into-fleet", + "title": "How to install osquery and enroll linux devices into Fleet", + "lastModifiedAt": 1734534699226, + "htmlId": "articles--how-to-install-osque--d33896be80", + "sectionRelativeRepoPath": "how-to-install-osquery-and-enroll-linux-devices-into-fleet.md", + "meta": { + "category": "guides", + "authorFullName": "Kathy Satterlee", + "authorGitHubUsername": "ksatter", + "publishedOn": "2022-03-19", + "articleTitle": "How to install osquery and enroll Linux devices into Fleet", + "articleImageUrl": "/images/articles/install-osquery-and-enroll-linux-devices-into-fleet-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/how-to-configure-logging-destinations", + "title": "How to configure logging destinations", + "lastModifiedAt": 1734534699227, + "htmlId": "articles--how-to-configure-log--18300d7923", + "sectionRelativeRepoPath": "how-to-configure-logging-destinations.md", + "meta": { + "category": "guides", + "authorFullName": "Grant Bilstad", + "authorGitHubUsername": "pacamaster", + "publishedOn": "2024-06-28", + "articleTitle": "How to configure logging destinations", + "articleImageUrl": "/images/articles/how-to-configure-logging-destinations-1600x900@2x.jpg" + } + }, + { + "url": "/guides/how-to-install-osquery-and-enroll-macos-devices-into-fleet", + "title": "How to install osquery and enroll macos devices into Fleet", + "lastModifiedAt": 1734534699228, + "htmlId": "articles--how-to-install-osque--fa9a55f7e1", + "sectionRelativeRepoPath": "how-to-install-osquery-and-enroll-macos-devices-into-fleet.md", + "meta": { + "category": "guides", + "authorFullName": "Kelvin Omereshone", + "authorGitHubUsername": "dominuskelvin", + "publishedOn": "2022-01-13", + "articleTitle": "How to install osquery and enroll macOS devices into Fleet", + "articleImageUrl": "/images/articles/install-osquery-and-enroll-macos-devices-into-fleet-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/how-to-install-osquery-and-enroll-windows-devices-into-fleet", + "title": "How to install osquery and enroll windows devices into Fleet", + "lastModifiedAt": 1734534699229, + "htmlId": "articles--how-to-install-osque--39c080aee9", + "sectionRelativeRepoPath": "how-to-install-osquery-and-enroll-windows-devices-into-fleet.md", + "meta": { + "category": "guides", + "authorFullName": "Kelvin Omereshone", + "authorGitHubUsername": "dominuskelvin", + "publishedOn": "2022-02-03", + "articleTitle": "How to install osquery and enroll Windows devices into Fleet", + "articleImageUrl": "/images/articles/install-osquery-and-enroll-windows-devices-into-fleet-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/how-to-uninstall-fleetd", + "title": "How to uninstall fleetd", + "lastModifiedAt": 1734534699230, + "htmlId": "articles--how-to-uninstall-fle--4929ab558d", + "sectionRelativeRepoPath": "how-to-uninstall-fleetd.md", + "meta": { + "category": "guides", + "authorFullName": "Eric Shaw", + "authorGitHubUsername": "eashaw", + "publishedOn": "2021-09-08", + "articleTitle": "How to uninstall fleetd", + "articleImageUrl": "/images/articles/how-to-uninstall-osquery-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/how-to-use-policies-for-patch-management-in-fleet", + "title": "How to use policies for patch management in Fleet", + "lastModifiedAt": 1734534699231, + "htmlId": "articles--how-to-use-policies---747d9b8a2e", + "sectionRelativeRepoPath": "how-to-use-policies-for-patch-management-in-fleet.md", + "meta": { + "articleTitle": "How to use policies for patch management in Fleet", + "authorFullName": "Harrison Ravazzolo", + "authorGitHubUsername": "harrisonravazzolo", + "category": "guides", + "publishedOn": "2024-11-07", + "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", + "description": "This guide explores automating patching across your environment." + } + }, + { + "url": "/guides/import-and-export-queries-in-fleet", + "title": "Import and export queries in Fleet", + "lastModifiedAt": 1734534699231, + "htmlId": "articles--import-and-export-qu--94263bf86b", + "sectionRelativeRepoPath": "import-and-export-queries-in-fleet.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2021-02-16", + "articleTitle": "Import and export queries in Fleet", + "articleImageUrl": "/images/articles/import-and-export-queries-in-Fleet-1600x900@2x.png" + } + }, + { + "url": "/guides/install-fleet-maintained-apps-on-macos-hosts", + "title": "Install Fleet maintained apps on macos hosts", + "lastModifiedAt": 1734534699232, + "htmlId": "articles--install-fleet-mainta--6f89dd04e8", + "sectionRelativeRepoPath": "install-fleet-maintained-apps-on-macos-hosts.md", + "meta": { + "category": "guides", + "authorFullName": "Gabriel Hernandez", + "authorGitHubUsername": "ghernandez345", + "publishedOn": "2024-10-16", + "articleTitle": "Fleet-maintained apps" + } + }, + { + "url": "/guides/install-vpp-apps-on-macos-using-fleet", + "title": "Install vpp apps on macos using Fleet", + "lastModifiedAt": 1734534699234, + "htmlId": "articles--install-vpp-apps-on---db2a5ca3fb", + "sectionRelativeRepoPath": "install-vpp-apps-on-macos-using-fleet.md", + "meta": { + "articleTitle": "Install App Store (VPP) apps", + "authorFullName": "Jahziel Villasana-Espinoza", + "authorGitHubUsername": "jahzielv", + "category": "guides", + "publishedOn": "2024-08-12", + "articleImageUrl": "/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png", + "description": "This guide will walk you through installing VPP apps on macOS, iOS, and iPadOS using Fleet." + } + }, + { + "url": "/announcements/introducing-cross-platform-script-execution", + "title": "Introducing cross platform script execution", + "lastModifiedAt": 1734534699235, + "htmlId": "articles--introducing-cross-pl--5d1c4a2317", + "sectionRelativeRepoPath": "introducing-cross-platform-script-execution.md", + "meta": { + "category": "announcements", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-10-17", + "articleTitle": "Introducing cross-platform script execution", + "articleImageUrl": "/images/articles/introducing-cross-platform-script-execution-800x450@2x.png" + } + }, + { + "url": "/announcements/introducing-fleet-ultimate", + "title": "Introducing Fleet ultimate", + "lastModifiedAt": 1734534699235, + "htmlId": "articles--introducing-fleet-ul--219d4821a9", + "sectionRelativeRepoPath": "introducing-fleet-ultimate.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "jarodreyes", + "authorFullName": "Jarod Reyes", + "publishedOn": "2023-02-20", + "articleTitle": "Introducing CIS benchmarks, managed-cloud hosting and custom calculator in the new Fleet Ultimate plan.", + "articleImageUrl": "/images/articles/happy-1st-anniversary-fleet-cover-800x450@2x.png" + } + }, + { + "url": "/announcements/introducing-orbit-your-fleet-agent-manager", + "title": "Introducing orbit your Fleet agent manager", + "lastModifiedAt": 1734534699236, + "htmlId": "articles--introducing-orbit-yo--93e04455a9", + "sectionRelativeRepoPath": "introducing-orbit-your-fleet-agent-manager.md", + "meta": { + "category": "announcements", + "authorFullName": "Mo Zhu", + "authorGitHubUsername": "zhumo", + "publishedOn": "2022-08-18", + "articleTitle": "Introducing Orbit, your Fleet agent manager", + "articleImageUrl": "/images/articles/fleet-4.17.0-1-1600x900@2x.jpg" + } + }, + { + "url": "/securing/introducing-workbrew", + "title": "Introducing workbrew", + "lastModifiedAt": 1734534699237, + "htmlId": "articles--introducing-workbrew--e4596aa816", + "sectionRelativeRepoPath": "introducing-workbrew.md", + "meta": { + "authorGitHubUsername": "drew-p-drawers", + "authorFullName": "Drew Baker", + "publishedOn": "2024-11-19", + "articleTitle": "Introducing Workbrew: bringing enterprise control to Homebrew deployments", + "category": "security", + "articleImageUrl": "/images/articles/fleet-and-workbrew-1600x900@2x.png" + } + }, + { + "url": "/announcements/large-gaming-company-enhances-server-observability-with-fleet", + "title": "Large gaming company enhances server observability with Fleet", + "lastModifiedAt": 1734534699238, + "htmlId": "articles--large-gaming-company--a14a1d829c", + "sectionRelativeRepoPath": "large-gaming-company-enhances-server-observability-with-fleet.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "Drew-P-drawers", + "authorFullName": "Andrew Baker", + "publishedOn": "2024-12-11", + "articleTitle": "Large gaming company enhances server observability with Fleet", + "description": "Large gaming company enhances server observability with Fleet" + } + }, + { + "url": "/guides/linux-disk-encryption-end-user", + "title": "Linux disk encryption end user", + "lastModifiedAt": 1734534699240, + "htmlId": "articles--linux-disk-encryptio--41be992ae8", + "sectionRelativeRepoPath": "linux-disk-encryption-end-user.md", + "meta": { + "articleTitle": "Encrypt your Fleet-managed Linux device", + "authorFullName": "Rachael Shaw", + "authorGitHubUsername": "rachaelshaw", + "category": "guides", + "publishedOn": "2024-11-25", + "description": "Instructions for end users to encrypt Linux devices enrolled in Fleet." + } + }, + { + "url": "/engineering/linux-vulnerability-detection-with-oval-and-fleet", + "title": "Linux vulnerability detection with oval and Fleet", + "lastModifiedAt": 1734534699241, + "htmlId": "articles--linux-vulnerability---93b6713d3f", + "sectionRelativeRepoPath": "linux-vulnerability-detection-with-oval-and-fleet.md", + "meta": { + "category": "engineering", + "authorGitHubUsername": "juan-fdz-hawa", + "authorFullName": "Juan Fernandes", + "publishedOn": "2022-07-29", + "articleTitle": "Linux vulnerability detection with OVAL and Fleet", + "articleImageUrl": "/images/articles/linux-vulnerability-detection-with-oval-and-fleet-1600x900@2x.jpg" + } + }, + { + "url": "/guides/locate-assets-with-osquery", + "title": "Locate assets with osquery", + "lastModifiedAt": 1734534699242, + "htmlId": "articles--locate-assets-with-o--e0c56a771b", + "sectionRelativeRepoPath": "locate-assets-with-osquery.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2021-05-11", + "articleTitle": "Locate device assets in the event of an emergency.", + "articleImageUrl": "/images/articles/locate-assets-with-osquery-cover-700x393@2x.jpeg" + } + }, + { + "url": "/guides/lock-wipe-hosts", + "title": "Lock wipe hosts", + "lastModifiedAt": 1734534699244, + "htmlId": "articles--lock-wipe-hosts--96ff748610", + "sectionRelativeRepoPath": "lock-wipe-hosts.md", + "meta": { + "articleTitle": "Lock and wipe hosts", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "category": "guides", + "publishedOn": "2024-07-09", + "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png" + } + }, + { + "url": "/guides/log-destinations", + "title": "Log destinations", + "lastModifiedAt": 1734534699247, + "htmlId": "articles--log-destinations--d18a750fa9", + "sectionRelativeRepoPath": "log-destinations.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "rachaelshaw", + "authorFullName": "Rachael Shaw", + "publishedOn": "2023-11-02", + "articleTitle": "Log destinations", + "description": "Learn about supported log destinations in Fleet, including Amazon Kinesis, AWS Lambda Snowflake, Splunk, and more." + } + }, + { + "url": "/securing/lossless-yubikeys-with-yubitrak-and-airtag", + "title": "Lossless yubikeys with yubitrak and airtag", + "lastModifiedAt": 1734534699248, + "htmlId": "articles--lossless-yubikeys-wi--df5b60eafb", + "sectionRelativeRepoPath": "lossless-yubiKeys-with-yubitrak-and-airtag.md", + "meta": { + "category": "security", + "authorGitHubUsername": "GuillaumeRoss", + "authorFullName": "Guillaume Ross", + "publishedOn": "2022-06-16", + "articleTitle": "Lossless YubiKeys with Yubitrak and AirTag", + "articleImageUrl": "/images/articles/lossless-yubikeys-with-yubitrak-and-airtag-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/macos-mdm-setup", + "title": "Macos mdm setup", + "lastModifiedAt": 1734534699249, + "htmlId": "articles--macos-mdm-setup--287604fb55", + "sectionRelativeRepoPath": "macos-mdm-setup.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "zhumo", + "authorFullName": "Mo Zhu", + "publishedOn": "2024-07-02", + "articleTitle": "macOS MDM setup", + "description": "Learn how to turn on MDM features in Fleet." + } + }, + { + "url": "/guides/macos-setup-experience", + "title": "Macos setup experience", + "lastModifiedAt": 1734534699251, + "htmlId": "articles--macos-setup-experien--3896ddbd41", + "sectionRelativeRepoPath": "macos-setup-experience.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-07-03", + "articleTitle": "macOS setup experience", + "description": "Customize your macOS setup experience with Fleet Premium by managing user authentication, Setup Assistant panes, and installing bootstrap packages." + } + }, + { + "url": "/guides/managing-labels-in-fleet", + "title": "Managing labels in Fleet", + "lastModifiedAt": 1734534699252, + "htmlId": "articles--managing-labels-in-f--794fb9f460", + "sectionRelativeRepoPath": "managing-labels-in-fleet.md", + "meta": { + "articleTitle": "Managing labels in Fleet", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "category": "guides", + "publishedOn": "2024-07-18", + "articleImageUrl": "/images/articles/managing-labels-in-fleet-1600x900@2x.png", + "description": "This guide will walk you through managing labels using the Fleet web UI." + } + }, + { + "url": "/securing/mapping-fleet-and-osquery-results-to-the-mitre-attck-framework-via-splunk", + "title": "Mapping Fleet and osquery results to the mitre attck framework via splunk", + "lastModifiedAt": 1734534699253, + "htmlId": "articles--mapping-fleet-and-os--68bafcbe1a", + "sectionRelativeRepoPath": "mapping-fleet-and-osquery-results-to-the-mitre-attck-framework-via-splunk.md", + "meta": { + "category": "security", + "authorFullName": "Dave Herder", + "authorGitHubUsername": "dherder", + "publishedOn": "2023-01-30", + "articleTitle": "Mapping Fleet and osquery results to the MITRE ATT&CK® framework via Splunk", + "articleImageUrl": "/images/articles/mapping-fleet-and-osquery-results-to-the-mitre-attck-framework-via-splunk-1600x900@2x.png" + } + }, + { + "url": "/guides/mdm-commands", + "title": "Mdm commands", + "lastModifiedAt": 1734534699254, + "htmlId": "articles--mdm-commands--bdf57f5f77", + "sectionRelativeRepoPath": "mdm-commands.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-06-12", + "articleTitle": "MDM commands", + "description": "Learn how to run custom MDM commands on hosts using Fleet." + } + }, + { + "url": "/guides/mdm-migration", + "title": "Mdm migration", + "lastModifiedAt": 1734534699255, + "htmlId": "articles--mdm-migration--be7bd5f783", + "sectionRelativeRepoPath": "mdm-migration.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "zhumo", + "authorFullName": "Mo Zhu", + "publishedOn": "2024-08-14", + "articleTitle": "MDM migration", + "description": "Instructions for migrating hosts away from an old MDM solution to Fleet." + } + }, + { + "url": "/guides/ndes-scep-proxy", + "title": "Ndes scep proxy", + "lastModifiedAt": 1734534699257, + "htmlId": "articles--ndes-scep-proxy--9665f50868", + "sectionRelativeRepoPath": "ndes-scep-proxy.md", + "meta": { + "articleTitle": "Connect end users to Wi-Fi with Simple Certificate Enrollment Protocol (SCEP)", + "authorFullName": "Victor Lyuboslavsky", + "authorGitHubUsername": "getvictor", + "category": "guides", + "publishedOn": "2024-10-30", + "description": "Learn how to help your end users connect to Wi-Fi by adding your SCEP server" + } + }, + { + "url": "/announcements/nvd-api-2.0", + "title": "Nvd API 2.0", + "lastModifiedAt": 1734534699258, + "htmlId": "articles--nvd-api-20--30c8a8e41e", + "sectionRelativeRepoPath": "nvd-api-2.0.md", + "meta": { + "category": "announcements", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-11-28", + "articleTitle": "NVD API 2.0: An important update for Fleet users", + "articleImageUrl": "/images/articles/nvd-api-2.0-1600x900@2x.jpg" + } + }, + { + "url": "/securing/optimizing-government-cybersecurity-strategies", + "title": "Optimizing government cybersecurity strategies", + "lastModifiedAt": 1734534699259, + "htmlId": "articles--optimizing-governmen--45c52b1839", + "sectionRelativeRepoPath": "optimizing-government-cybersecurity-strategies.md", + "meta": { + "category": "security", + "authorFullName": "Keith Barnes", + "authorGitHubUsername": "KAB703", + "publishedOn": "2023-11-14", + "articleTitle": "Optimizing government cybersecurity strategies with Fleet.", + "articleImageUrl": "/images/articles/optimizing-government-cybersecurity-strategies-1600x900@2x.png" + } + }, + { + "url": "/releases/osquery-5.11.0", + "title": "Osquery 5.11.0", + "lastModifiedAt": 1734534699260, + "htmlId": "articles--osquery-5110--2907f78617", + "sectionRelativeRepoPath": "osquery-5.11.0.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2024-02-16", + "articleTitle": "osquery 5.11.0 | VSCode, Apple silicon, and more", + "articleImageUrl": "/images/articles/osquery-5.11.0-cover-1600x900@2x.png" + } + }, + { + "url": "/releases/osquery-5.8.1", + "title": "Osquery 5.8.1", + "lastModifiedAt": 1734534699261, + "htmlId": "articles--osquery-581--835bbfa1b6", + "sectionRelativeRepoPath": "osquery-5.8.1.md", + "meta": { + "category": "releases", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "publishedOn": "2023-03-14", + "articleTitle": "osquery 5.8.1 | Process auditing, stats, and additional tables", + "articleImageUrl": "/images/articles/osquery-5.8.1-cover-1600x900@2x.png" + } + }, + { + "url": "/guides/osquery-a-tool-to-easily-ask-questions-about-operating-systems", + "title": "Osquery a tool to easily ask questions about operating systems", + "lastModifiedAt": 1734534699262, + "htmlId": "articles--osquery-a-tool-to-ea--bd641644df", + "sectionRelativeRepoPath": "osquery-a-tool-to-easily-ask-questions-about-operating-systems.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "dominuskelvin", + "authorFullName": "Kelvin Omereshone", + "publishedOn": "2022-04-04", + "articleTitle": "Osquery: a tool to easily ask questions about operating systems", + "articleImageUrl": "/images/articles/osquery-a-tool-to-easily-ask-questions-about-operating-systems-cover-1600x900@2x.jpg" + } + }, + { + "url": "/securing/osquery-as-a-threat-hunting-platform", + "title": "Osquery as a threat hunting platform", + "lastModifiedAt": 1734534699263, + "htmlId": "articles--osquery-as-a-threat---5c9ebe9358", + "sectionRelativeRepoPath": "osquery-as-a-threat-hunting-platform.md", + "meta": { + "category": "security", + "authorFullName": "Chris McGillicuddy", + "authorGitHubUsername": "chris-mcgillicuddy", + "publishedOn": "2022-09-16", + "articleTitle": "Osquery… as a threat hunting platform?", + "articleImageUrl": "/images/articles/osquery-for-threat-hunting-1600x900@2x.jpg" + } + }, + { + "url": "/guides/osquery-consider-joining-against-the-users-table", + "title": "Osquery consider joining against the users table", + "lastModifiedAt": 1734534699264, + "htmlId": "articles--osquery-consider-joi--601c6b1fc1", + "sectionRelativeRepoPath": "osquery-consider-joining-against-the-users-table.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2021-05-06", + "articleTitle": "Osquery: Consider joining against the users table", + "articleImageUrl": "/images/articles/osquery-consider-joining-against-the-users-table-cover-700x437@2x.jpeg" + } + }, + { + "url": "/guides/osquery-evented-tables-overview", + "title": "Osquery evented tables overview", + "lastModifiedAt": 1734534699266, + "htmlId": "articles--osquery-evented-tabl--84be7887a2", + "sectionRelativeRepoPath": "osquery-evented-tables-overview.md", + "meta": { + "articleTitle": "How to use osquery evented tables", + "authorFullName": "Mo Zhu", + "authorGitHubUsername": "zhumo", + "category": "guides", + "publishedOn": "2022-09-21" + } + }, + { + "url": "/securing/osquery-vulnerability-management-at-scale", + "title": "Osquery vulnerability management at scale", + "lastModifiedAt": 1734534699267, + "htmlId": "articles--osquery-vulnerabilit--d68763c174", + "sectionRelativeRepoPath": "osquery-vulnerability-management-at-scale.md", + "meta": { + "category": "security", + "authorFullName": "Chris McGillicuddy", + "authorGitHubUsername": "chris-mcgillicuddy", + "publishedOn": "2022-10-05", + "articleTitle": "Vulnerability management at scale: a presentation from osquery Co-creator Zach Wasserman", + "articleImageUrl": "/images/articles/vulnerability-management-at-scale-with-osquery_800x450@2x.jpg" + } + }, + { + "url": "/guides/osquery-watchdog", + "title": "Osquery watchdog", + "lastModifiedAt": 1734534699268, + "htmlId": "articles--osquery-watchdog--98379aab2d", + "sectionRelativeRepoPath": "osquery-watchdog.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "juan-fdz-hawa", + "authorFullName": "Juan Fernandes", + "publishedOn": "2023-07-28", + "articleTitle": "Osquery watchdog", + "description": "Learn about how osquery process manages child processes and managed extensions in Fleet." + } + }, + { + "url": "/guides/policy-automation-run-script", + "title": "Policy automation run script", + "lastModifiedAt": 1734534699268, + "htmlId": "articles--policy-automation-ru--358f3723ed", + "sectionRelativeRepoPath": "policy-automation-run-script.md", + "meta": { + "articleTitle": "Automatically run scripts", + "authorFullName": "Ian Littman", + "authorGitHubUsername": "iansltx", + "category": "guides", + "publishedOn": "2024-10-07", + "description": "A guide to workflows using automatic script execution in Fleet." + } + }, + { + "url": "/announcements/psu-macadmins-conference-2023", + "title": "Psu macadmins conference 2023", + "lastModifiedAt": 1734534699269, + "htmlId": "articles--psu-macadmins-confer--72f5252a2d", + "sectionRelativeRepoPath": "psu-macadmins-conference-2023.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "spokanemac", + "authorFullName": "JD Strong", + "publishedOn": "2023-07-13", + "articleTitle": "Mac admins summer camp ⛺ at PSU MacAdmins Conference 2023", + "articleImageUrl": "/images/articles/psu-macadmins-conference-2023@2x.png", + "description": "A look ahead to PSU MacAdmin Conference July 18-21, 2023" + } + }, + { + "url": "/guides/puppet-module", + "title": "Puppet module", + "lastModifiedAt": 1734534699270, + "htmlId": "articles--puppet-module--84eb56d4df", + "sectionRelativeRepoPath": "puppet-module.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-05-24", + "articleTitle": "Puppet module", + "description": "Learn how to use Fleet's Puppet module to automatically assign custom configuration profiles on your macOS hosts." + } + }, + { + "url": "/guides/queries", + "title": "Queries", + "lastModifiedAt": 1734534699271, + "htmlId": "articles--queries--434e34c828", + "sectionRelativeRepoPath": "queries.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-08-09", + "articleTitle": "Queries", + "description": "Learn how to create, run, and schedule queries, as well as update agent options in the Fleet user interface." + } + }, + { + "url": "/guides/querying-process-file-events-table-on-centos-7", + "title": "Querying process file events table on centos 7", + "lastModifiedAt": 1734534699272, + "htmlId": "articles--querying-process-fil--fb83decd51", + "sectionRelativeRepoPath": "querying-process-file-events-table-on-centos-7.md", + "meta": { + "articleTitle": "Querying process_file_events on CentOS 7", + "description": "Learn how to configure and query the process_file_events table on CentOS 7 with Fleet.", + "category": "guides", + "authorGitHubUsername": "lucasmrod", + "authorFullName": "Lucas Rodriguez", + "publishedOn": "2023-07-17" + } + }, + { + "url": "/guides/resolving-a-critical-firefox-vulnerability-using-fleets-new-automation-features", + "title": "Resolving a critical firefox vulnerability using fleets new automation features", + "lastModifiedAt": 1734534699274, + "htmlId": "articles--resolving-a-critical--93a8be83c4", + "sectionRelativeRepoPath": "resolving-a-critical-firefox-vulnerability-using-fleets-new-automation-features.md", + "meta": { + "articleTitle": "Resolving a critical Firefox vulnerability using Fleet's new automation features", + "authorFullName": "Luke Heath", + "authorGitHubUsername": "lukeheath", + "category": "guides", + "publishedOn": "2024-12-04", + "articleImageUrl": "/images/articles/vulnerability-management-advantages-of-fleet-to-support-government-agencies-1600x900@2x.png", + "description": "This guide outlines the process of using Fleet policies to automatically remediate software vulnerabillities." + } + }, + { + "url": "/guides/role-based-access", + "title": "Role based access", + "lastModifiedAt": 1734534699276, + "htmlId": "articles--role-based-access--214b7fa195", + "sectionRelativeRepoPath": "role-based-access.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-10-31", + "articleTitle": "Role-based access", + "description": "Learn about the different roles and permissions in Fleet." + } + }, + { + "url": "/engineering/saving-over-100x-on-egress-switching-from-aws-to-hetzner", + "title": "Saving over 100x on egress switching from aws to hetzner", + "lastModifiedAt": 1734534699277, + "htmlId": "articles--saving-over-100x-on---eaa2acc4f3", + "sectionRelativeRepoPath": "saving-over-100x-on-egress-switching-from-aws-to-hetzner.md", + "meta": { + "category": "engineering", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2022-01-25", + "articleTitle": "Saving over 100x on egress switching from AWS to Hetzner", + "articleImageUrl": "/images/articles/saving-over-100x-on-egress-switching-from-aws-to-hetzner-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/scripts", + "title": "Scripts", + "lastModifiedAt": 1734534699278, + "htmlId": "articles--scripts--5eb8fe34fa", + "sectionRelativeRepoPath": "scripts.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-10-07", + "articleTitle": "Scripts", + "description": "Learn how to execute a custom script on macOS, Windows, and Linux hosts in Fleet." + } + }, + { + "url": "/guides/seamless-mdm-migration", + "title": "Seamless mdm migration", + "lastModifiedAt": 1734534699281, + "htmlId": "articles--seamless-mdm-migrati--1c0acbb5f3", + "sectionRelativeRepoPath": "seamless-mdm-migration.md", + "meta": { + "category": "guides", + "authorFullName": "Zach Wasserman", + "authorGitHubUsername": "zwass", + "publishedOn": "2024-08-08", + "articleTitle": "Seamless MDM migrations to Fleet", + "articleImageUrl": "/images/articles/seamless-mdm-migration-1600x900@2x.png", + "description": "This guide provides a process for seamlessly migrating macOS devices from an existing MDM solution to Fleet." + } + }, + { + "url": "/announcements/seattle-bellevue-cyber-security-summit-march-8-2023", + "title": "Seattle bellevue cyber security summit march 8 2023", + "lastModifiedAt": 1734534699282, + "htmlId": "articles--seattle-bellevue-cyb--412da6d2bc", + "sectionRelativeRepoPath": "seattle-bellevue-cyber-security-summit-march-8-2023.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "spokanemac", + "authorFullName": "JD Strong", + "publishedOn": "2023-03-02", + "articleTitle": "Join Fleet at Cyber Security Summit Seattle/Bellevue", + "articleImageUrl": "/images/articles/seattle-bellevue-cyber-security-summit-social-post-1200x628@2x.png" + } + }, + { + "url": "/securing/security-testing-at-fleet-fleet-pentest", + "title": "Security testing at Fleet Fleet pentest", + "lastModifiedAt": 1734534699284, + "htmlId": "articles--security-testing-at---930f51ff1d", + "sectionRelativeRepoPath": "security-testing-at-fleet-fleet-pentest.md", + "meta": { + "category": "security", + "authorGitHubUsername": "GuillaumeRoss", + "authorFullName": "Guillaume Ross", + "publishedOn": "2022-05-10", + "articleTitle": "Penetration testing of Fleet (April 2022)", + "articleImageUrl": "/images/articles/security-testing-at-fleet-fleet-pentest-cover-1600x900@2x.jpg" + } + }, + { + "url": "/securing/security-testing-at-fleet-orbit-auto-updater-audit", + "title": "Security testing at Fleet orbit auto updater audit", + "lastModifiedAt": 1734534699285, + "htmlId": "articles--security-testing-at---3c01c231c3", + "sectionRelativeRepoPath": "security-testing-at-fleet-orbit-auto-updater-audit.md", + "meta": { + "category": "security", + "authorGitHubUsername": "GuillaumeRoss", + "authorFullName": "Guillaume Ross", + "publishedOn": "2022-03-30", + "articleTitle": "Security testing at Fleet/Orbit auto-updater audit", + "articleImageUrl": "/images/articles/security-testing-at-fleet-orbit-auto-updater-audit-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/software-self-service", + "title": "Software self service", + "lastModifiedAt": 1734534699286, + "htmlId": "articles--software-self-servic--687f8ad0ba", + "sectionRelativeRepoPath": "software-self-service.md", + "meta": { + "articleTitle": "Software self-service", + "authorFullName": "Jahziel Villasana-Espinoza", + "authorGitHubUsername": "jahzielv", + "category": "guides", + "publishedOn": "2024-08-06", + "articleImageUrl": "/images/articles/software-self-service-1600x900@2x.png", + "description": "This guide will walk you through adding apps to Fleet for user self-service." + } + }, + { + "url": "/guides/standard-query-library", + "title": "Standard query library", + "lastModifiedAt": 1734534699287, + "htmlId": "articles--standard-query-libra--5e6c1f7c33", + "sectionRelativeRepoPath": "standard-query-library.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-04-04", + "articleTitle": "Standard query library", + "description": "Learn how to use and contribute to Fleet's standard query library." + } + }, + { + "url": "/report/state-of-device-management", + "title": "State of device management", + "lastModifiedAt": 1734534699287, + "htmlId": "articles--state-of-device-mana--6cee389e23", + "sectionRelativeRepoPath": "state-of-device-management.md", + "meta": { + "category": "report", + "authorFullName": "Mike McNeil", + "authorGitHubUsername": "mikermcneil", + "publishedOn": "2022-07-07", + "articleTitle": "State of Device Management report 2022", + "articleImageUrl": "/images/articles/state-of-device-management-report-1600x900@2x.png" + } + }, + { + "url": "/securing/stay-on-course-with-your-security-compliance-goals", + "title": "Stay on course with your security compliance goals", + "lastModifiedAt": 1734534699288, + "htmlId": "articles--stay-on-course-with---af690679b4", + "sectionRelativeRepoPath": "stay-on-course-with-your-security-compliance-goals.md", + "meta": { + "category": "security", + "authorFullName": "Chris McGillicuddy", + "authorGitHubUsername": "chris-mcgillicuddy", + "publishedOn": "2022-07-18", + "articleTitle": "Stay on course with your security compliance goals", + "articleImageUrl": "/images/articles/security-compliance-goals-cover-800x450@2x.jpg" + } + }, + { + "url": "/guides/sysadmin-diaries-device-enrollment", + "title": "Sysadmin diaries device enrollment", + "lastModifiedAt": 1734534699289, + "htmlId": "articles--sysadmin-diaries-dev--5d20ddd4a7", + "sectionRelativeRepoPath": "sysadmin-diaries-device-enrollment.md", + "meta": { + "articleTitle": "Sysadmin diaries: device enrollment", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "category": "guides", + "publishedOn": "2024-05-03", + "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", + "description": "In this sysadmin diary, we explore a the differences in device enrollment." + } + }, + { + "url": "/guides/sysadmin-diaries-exporting-policies", + "title": "Sysadmin diaries exporting policies", + "lastModifiedAt": 1734534699290, + "htmlId": "articles--sysadmin-diaries-exp--f9c46f65fc", + "sectionRelativeRepoPath": "sysadmin-diaries-exporting-policies.md", + "meta": { + "articleTitle": "Sysadmin diaries: exporting policies", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "category": "guides", + "publishedOn": "2024-06-28", + "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", + "description": "In this sysadmin diary, we explore extracting existing policies to enable gitops." + } + }, + { + "url": "/guides/sysadmin-diaries-gitops-a-strategic-advantage", + "title": "Sysadmin diaries gitops a strategic advantage", + "lastModifiedAt": 1734534699291, + "htmlId": "articles--sysadmin-diaries-git--aafc1c530a", + "sectionRelativeRepoPath": "sysadmin-diaries-gitops-a-strategic-advantage.md", + "meta": { + "articleTitle": "GitOps: A strategic advantage for automation, collaboration, and cost savings", + "authorFullName": "Allen Houchins", + "authorGitHubUsername": "allenhouchins", + "category": "guides", + "publishedOn": "2024-09-27", + "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", + "description": "This diary entry explores why GitOps will save time, money and effort." + } + }, + { + "url": "/guides/sysadmin-diaries-passcode-profiles", + "title": "Sysadmin diaries passcode profiles", + "lastModifiedAt": 1734534699292, + "htmlId": "articles--sysadmin-diaries-pas--ad866cee62", + "sectionRelativeRepoPath": "sysadmin-diaries-passcode-profiles.md", + "meta": { + "articleTitle": "Sysadmin diaries: passcode profiles", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "category": "guides", + "publishedOn": "2024-04-01", + "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", + "description": "In this sysadmin diary, we explore a missapplied passcode policy." + } + }, + { + "url": "/guides/sysadmin-diaries-restoring-fleetd", + "title": "Sysadmin diaries restoring fleetd", + "lastModifiedAt": 1734534699293, + "htmlId": "articles--sysadmin-diaries-res--e1b7e5b22c", + "sectionRelativeRepoPath": "sysadmin-diaries-restoring-fleetd.md", + "meta": { + "articleTitle": "Sysadmin diaries: restoring fleetd", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "category": "guides", + "publishedOn": "2024-06-14", + "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", + "description": "In this sysadmin diary, we explore restoring fleetd deleted by a surly employee." + } + }, + { + "url": "/securing/tales-from-fleet-security-google-groups-scams", + "title": "Tales from Fleet security google groups scams", + "lastModifiedAt": 1734534699294, + "htmlId": "articles--tales-from-fleet-sec--9b8848d72f", + "sectionRelativeRepoPath": "tales-from-fleet-security-google-groups-scams.md", + "meta": { + "category": "security", + "authorFullName": "Guillaume Ross", + "authorGitHubUsername": "GuillaumeRoss", + "publishedOn": "2022-08-05", + "articleTitle": "Tales from Fleet security: scams targeting Google Groups", + "articleImageUrl": "/images/articles/tales-from-fleet-security-google-groups-scams-cover-1600x900@2x.jpg" + } + }, + { + "url": "/securing/tales-from-fleet-security-github-configuration-and-openssf-scorecards", + "title": "Tales from Fleet security github configuration and openssf scorecards", + "lastModifiedAt": 1734534699295, + "htmlId": "articles--tales-from-fleet-sec--cea5e29dc6", + "sectionRelativeRepoPath": "tales-from-fleet-security-github-configuration-and-openssf-scorecards.md", + "meta": { + "category": "security", + "authorFullName": "Guillaume Ross", + "authorGitHubUsername": "GuillaumeRoss", + "publishedOn": "2022-04-15", + "articleTitle": "Tales from Fleet security: GitHub configuration and OpenSSF Scorecards", + "articleImageUrl": "/images/articles/tales-from-fleet-security-github-configuration-and-openssf-scorecards-cover-1600x900@2x.jpg" + } + }, + { + "url": "/securing/tales-from-fleet-security-securing-1password", + "title": "Tales from Fleet security securing 1password", + "lastModifiedAt": 1734534699296, + "htmlId": "articles--tales-from-fleet-sec--7c53a1854f", + "sectionRelativeRepoPath": "tales-from-fleet-security-securing-1password.md", + "meta": { + "category": "security", + "authorFullName": "Guillaume Ross", + "authorGitHubUsername": "GuillaumeRoss", + "publishedOn": "2022-05-06", + "articleTitle": "Tales from Fleet security: securing 1Password", + "articleImageUrl": "/images/articles/tales-from-fleet-security-securing-1password-cover-1600x900@2x.jpg" + } + }, + { + "url": "/securing/tales-from-fleet-security-securing-bank-accounts-from-business-email-compromise", + "title": "Tales from Fleet security securing bank accounts from business email compromise", + "lastModifiedAt": 1734534699298, + "htmlId": "articles--tales-from-fleet-sec--3934315928", + "sectionRelativeRepoPath": "tales-from-fleet-security-securing-bank-accounts-from-business-email-compromise.md", + "meta": { + "category": "security", + "authorFullName": "Guillaume Ross", + "authorGitHubUsername": "GuillaumeRoss", + "publishedOn": "2022-07-15", + "articleTitle": "Tales from Fleet security: securing bank accounts from business email compromise", + "articleImageUrl": "/images/articles/securing-bank-accounts-from-business-email-compromise-1600x900@2x.jpg" + } + }, + { + "url": "/securing/tales-from-fleet-security-securing-google-workspace", + "title": "Tales from Fleet security securing google workspace", + "lastModifiedAt": 1734534699299, + "htmlId": "articles--tales-from-fleet-sec--248e6e273e", + "sectionRelativeRepoPath": "tales-from-fleet-security-securing-google-workspace.md", + "meta": { + "category": "security", + "authorFullName": "Guillaume Ross", + "authorGitHubUsername": "GuillaumeRoss", + "publishedOn": "2022-03-25", + "articleTitle": "Tales from Fleet security: securing Google Workspace", + "articleImageUrl": "/images/articles/tales-from-fleet-security-securing-google-workspace-cover-1600x900@2x.jpg" + } + }, + { + "url": "/securing/tales-from-fleet-security-securing-the-startup", + "title": "Tales from Fleet security securing the startup", + "lastModifiedAt": 1734534699300, + "htmlId": "articles--tales-from-fleet-sec--d1bfda077f", + "sectionRelativeRepoPath": "tales-from-fleet-security-securing-the-startup.md", + "meta": { + "category": "security", + "authorFullName": "Guillaume Ross", + "authorGitHubUsername": "GuillaumeRoss", + "publishedOn": "2022-03-17", + "articleTitle": "Tales from Fleet security: securing the startup", + "articleImageUrl": "/images/articles/tales-from-fleet-security-securing-the-startup-cover-1600x900@2x.jpg" + } + }, + { + "url": "/securing/tales-from-fleet-security-soc2", + "title": "Tales from Fleet security soc2", + "lastModifiedAt": 1734534699301, + "htmlId": "articles--tales-from-fleet-sec--9f5fe9c66a", + "sectionRelativeRepoPath": "tales-from-fleet-security-soc2.md", + "meta": { + "category": "security", + "authorGitHubUsername": "GuillaumeRoss", + "authorFullName": "Guillaume Ross", + "publishedOn": "2022-06-24", + "articleTitle": "Tales from Fleet security: how we achieved our SOC 2 type 1 rapidly", + "articleImageUrl": "/images/articles/tales-from-fleet-soc2-type1-report-cover-1600x900@2x.jpg" + } + }, + { + "url": "/securing/tales-from-fleet-security-speeding-up-macos-updates-with-nudge", + "title": "Tales from Fleet security speeding up macos updates with nudge", + "lastModifiedAt": 1734534699302, + "htmlId": "articles--tales-from-fleet-sec--940df70258", + "sectionRelativeRepoPath": "tales-from-fleet-security-speeding-up-macos-updates-with-nudge.md", + "meta": { + "category": "security", + "authorFullName": "Guillaume Ross", + "authorGitHubUsername": "GuillaumeRoss", + "publishedOn": "2022-07-05", + "articleTitle": "Tales from Fleet security: speeding up macOS updates with Nudge", + "articleImageUrl": "/images/articles/tales-from-fleet-nudge-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/teams", + "title": "Teams", + "lastModifiedAt": 1734534699303, + "htmlId": "articles--teams--e2733c8673", + "sectionRelativeRepoPath": "teams.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-07-11", + "articleTitle": "Teams", + "description": "Learn how to group hosts in Fleet to apply specific queries, policies, and agent options using teams." + } + }, + { + "url": "/announcements/the-device-security-tightrope-balancing-cost-and-protection-in-k-12-schools", + "title": "The device security tightrope balancing cost and protection in k 12 schools", + "lastModifiedAt": 1734534699304, + "htmlId": "articles--the-device-security---582e5b6447", + "sectionRelativeRepoPath": "the-device-security-tightrope-balancing-cost-and-protection-in-K-12-schools.md", + "meta": { + "category": "announcements", + "authorFullName": "Keith Barnes", + "authorGitHubUsername": "KAB703", + "publishedOn": "2024-03-01", + "articleTitle": "The device security tightrope: balancing cost and protection in K-12 schools", + "articleImageUrl": "/images/articles/the-device-security-tightrope-balancing-cost-and-protection-in-K-12-schools-1600x900@2x.png" + } + }, + { + "url": "/podcasts/the-future-of-device-management-ep1", + "title": "The future of device management ep1", + "lastModifiedAt": 1734534699305, + "htmlId": "articles--the-future-of-device--01a0d40000", + "sectionRelativeRepoPath": "the-future-of-device-management-ep1.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2022-06-06", + "articleTitle": "Future of device management episode 1", + "articleImageUrl": "/images/articles/future-of-device-management-ep1-cover-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/the-future-of-device-management-ep2", + "title": "The future of device management ep2", + "lastModifiedAt": 1734534699306, + "htmlId": "articles--the-future-of-device--1e93b8170c", + "sectionRelativeRepoPath": "the-future-of-device-management-ep2.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2022-06-30", + "articleTitle": "Future of device management episode 2", + "articleImageUrl": "/images/articles/future-of-device-management-ep2-cover-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/the-future-of-device-management-ep3", + "title": "The future of device management ep3", + "lastModifiedAt": 1734534699306, + "htmlId": "articles--the-future-of-device--19ed07e849", + "sectionRelativeRepoPath": "the-future-of-device-management-ep3.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2022-07-21", + "articleTitle": "Future of device management episode 3", + "articleImageUrl": "/images/articles/future-of-device-management-ep3-cover-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/the-future-of-device-management-ep4", + "title": "The future of device management ep4", + "lastModifiedAt": 1734534699307, + "htmlId": "articles--the-future-of-device--ff8f5f6da2", + "sectionRelativeRepoPath": "the-future-of-device-management-ep4.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2022-08-12", + "articleTitle": "Future of device management episode 4", + "articleImageUrl": "/images/articles/future-of-device-management-ep4-cover-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/the-future-of-device-management-ep5", + "title": "The future of device management ep5", + "lastModifiedAt": 1734534699308, + "htmlId": "articles--the-future-of-device--cc68742b47", + "sectionRelativeRepoPath": "the-future-of-device-management-ep5.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2022-09-01", + "articleTitle": "Future of device management episode 5", + "articleImageUrl": "/images/articles/future-of-device-management-ep5-cover-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/the-future-of-device-management-ep6", + "title": "The future of device management ep6", + "lastModifiedAt": 1734534699309, + "htmlId": "articles--the-future-of-device--ed513fe175", + "sectionRelativeRepoPath": "the-future-of-device-management-ep6.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2022-09-23", + "articleTitle": "Future of device management episode 6", + "articleImageUrl": "/images/articles/future-of-device-management-ep6-cover-1600x900@2x.jpg" + } + }, + { + "url": "/podcasts/the-future-of-device-management-ep7", + "title": "The future of device management ep7", + "lastModifiedAt": 1734534699309, + "htmlId": "articles--the-future-of-device--bad91f26f5", + "sectionRelativeRepoPath": "the-future-of-device-management-ep7.md", + "meta": { + "category": "podcasts", + "authorGitHubUsername": "zwass", + "authorFullName": "Zach Wasserman", + "publishedOn": "2022-11-03", + "articleTitle": "Future of device management episode 7", + "articleImageUrl": "/images/articles/future-of-device-management-ep7-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/understanding-the-intricacies-of-fleet-policies", + "title": "Understanding the intricacies of Fleet policies", + "lastModifiedAt": 1734534699310, + "htmlId": "articles--understanding-the-in--1a9195f886", + "sectionRelativeRepoPath": "understanding-the-intricacies-of-fleet-policies.md", + "meta": { + "articleTitle": "Understanding the intricacies of Fleet policies", + "authorFullName": "Victor Lyuboslavsky", + "authorGitHubUsername": "getvictor", + "category": "guides", + "publishedOn": "2023-12-29", + "description": "Learn how Fleet policies work behind the scenes." + } + }, + { + "url": "/guides/using-elasticsearch-and-kibana-to-visualize-osquery-performance", + "title": "Using elasticsearch and kibana to visualize osquery performance", + "lastModifiedAt": 1734534699312, + "htmlId": "articles--using-elasticsearch---bd56725806", + "sectionRelativeRepoPath": "using-elasticsearch-and-kibana-to-visualize-osquery-performance.md", + "meta": { + "category": "guides", + "authorFullName": "Zach Wasserman", + "authorGitHubUsername": "zwass", + "publishedOn": "2021-05-26", + "articleTitle": "Using Elasticsearch and Kibana to visualize osquery performance", + "articleImageUrl": "/images/articles/using-elasticsearch-and-kibana-to-visualize-osquery-performance-cover-700x393@2x.jpeg" + } + }, + { + "url": "/guides/using-fleet-and-okta-workflows-to-generate-a-daily-os-report", + "title": "Using Fleet and okta workflows to generate a daily os report", + "lastModifiedAt": 1734534699314, + "htmlId": "articles--using-fleet-and-okta--8c58926ea7", + "sectionRelativeRepoPath": "using-fleet-and-okta-workflows-to-generate-a-daily-os-report.md", + "meta": { + "articleTitle": "Using Fleet and Okta Workflows to generate a daily OS report", + "authorFullName": "Harrison Ravazzolo", + "authorGitHubUsername": "harrisonravazzolo", + "category": "guides", + "publishedOn": "2023-05-09", + "articleImageUrl": "/images/articles/using-fleet-and-okta-workflows-to-generate-a-daily-os-report@2x.jpg", + "description": "Learn how to use Fleet to query device OS information through the Fleet REST API and automate daily Slack notifications using Okta Workflows." + } + }, + { + "url": "/guides/using-fleet-and-tines-together", + "title": "Using Fleet and tines together", + "lastModifiedAt": 1734534699315, + "htmlId": "articles--using-fleet-and-tine--b9eb6330ab", + "sectionRelativeRepoPath": "using-fleet-and-tines-together.md", + "meta": { + "category": "guides", + "authorFullName": "Dave Herder", + "authorGitHubUsername": "dherder", + "publishedOn": "2023-03-08", + "articleTitle": "Using Fleet and Tines together", + "articleImageUrl": "/images/articles/using-fleet-and-tines-together-1600x900@2x.png" + } + }, + { + "url": "/guides/using-github-actions-to-apply-configuration-profiles-with-fleet", + "title": "Using github actions to apply configuration profiles with Fleet", + "lastModifiedAt": 1734534699316, + "htmlId": "articles--using-github-actions--d7eb24949f", + "sectionRelativeRepoPath": "using-github-actions-to-apply-configuration-profiles-with-fleet.md", + "meta": { + "articleTitle": "Using GitHub Actions to apply configuration profiles with Fleet", + "authorFullName": "JD Strong", + "authorGitHubUsername": "spokanemac", + "category": "guides", + "publishedOn": "2023-05-31", + "articleImageUrl": "/images/articles/using-github-actions-to-apply-configuration-profiles-with-fleet@2x.jpg", + "description": "A guide on using GitHub Actions with Fleet for efficient and automated application of the latest configuration profiles for a GitOps workflow." + } + }, + { + "url": "/announcements/vehicle-manufacturer-transitions-to-fleet-for-endpoint-security", + "title": "Vehicle manufacturer transitions to Fleet for endpoint security", + "lastModifiedAt": 1734534699318, + "htmlId": "articles--vehicle-manufacturer--1ee8fe6b7e", + "sectionRelativeRepoPath": "vehicle-manufacturer-transitions-to-fleet-for-endpoint-security.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "Drew-P-drawers", + "authorFullName": "Andrew Baker", + "publishedOn": "2024-12-12", + "articleTitle": "Vehicle manufacturer transitions to Fleet for endpoint security", + "description": "Vehicle manufacturer transitions to Fleet for endpoint security" + } + }, + { + "url": "/securing/vulnerability-management-the-advantages-of-fleet-to-support-government-agencies", + "title": "Vulnerability management the advantages of Fleet to support government agencies", + "lastModifiedAt": 1734534699319, + "htmlId": "articles--vulnerability-manage--089ffd6fe2", + "sectionRelativeRepoPath": "vulnerability-management-the-advantages-of-fleet-to-support-government-agencies.md", + "meta": { + "category": "security", + "authorFullName": "Keith Barnes", + "authorGitHubUsername": "KAB703", + "publishedOn": "2023-12-26", + "articleTitle": "Vulnerability management: advantages of Fleet to support government agencies", + "articleImageUrl": "/images/articles/vulnerability-management-advantages-of-fleet-to-support-government-agencies-1600x900@2x.png" + } + }, + { + "url": "/guides/vulnerability-processing", + "title": "Vulnerability processing", + "lastModifiedAt": 1734534699320, + "htmlId": "articles--vulnerability-proces--6ad60d991f", + "sectionRelativeRepoPath": "vulnerability-processing.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "noahtalerman", + "authorFullName": "Noah Talerman", + "publishedOn": "2024-07-12", + "articleTitle": "Vulnerability processing", + "description": "Find out how Fleet detects vulnerabilities and what software it covers." + } + }, + { + "url": "/guides/what-api-endpoints-to-expose-to-the-public-internet", + "title": "What API endpoints to expose to the public internet", + "lastModifiedAt": 1734534699321, + "htmlId": "articles--what-api-endpoints-t--d331baccba", + "sectionRelativeRepoPath": "what-api-endpoints-to-expose-to-the-public-internet.md", + "meta": { + "category": "guides", + "authorGitHubUsername": "mike-j-thomas", + "authorFullName": "Mike Thomas", + "publishedOn": "2023-11-13", + "articleTitle": "Which API endpoints to expose to the public internet?" + } + }, + { + "url": "/securing/what-are-fleet-policies", + "title": "What are Fleet policies", + "lastModifiedAt": 1734534699322, + "htmlId": "articles--what-are-fleet-polic--5be3fb9039", + "sectionRelativeRepoPath": "what-are-fleet-policies.md", + "meta": { + "category": "security", + "authorGitHubUsername": "Drew-P-drawers", + "authorFullName": "Andrew Baker", + "publishedOn": "2022-05-20", + "articleTitle": "What are Fleet policies?", + "articleImageUrl": "/images/articles/what-are-fleet-policies-cover-1600x900@2x.jpg" + } + }, + { + "url": "/guides/windows-mdm-setup", + "title": "Windows mdm setup", + "lastModifiedAt": 1734534699324, + "htmlId": "articles--windows-mdm-setup--c79ef4765d", + "sectionRelativeRepoPath": "windows-mdm-setup.md", + "meta": { + "articleTitle": "Windows MDM setup", + "authorFullName": "Noah Talerman", + "authorGitHubUsername": "noahtalerman", + "category": "guides", + "publishedOn": "2023-10-23", + "articleImageUrl": "/images/articles/windows-mdm-fleet-1600x900@2x.png", + "description": "Configuring Windows MDM in Fleet." + } + }, + { + "url": "/securing/work-may-be-watching-but-it-might-not-be-as-bad-as-you-think", + "title": "Work may be watching but it might not be as bad as you think", + "lastModifiedAt": 1734534699325, + "htmlId": "articles--work-may-be-watching--6c555b7789", + "sectionRelativeRepoPath": "work-may-be-watching-but-it-might-not-be-as-bad-as-you-think.md", + "meta": { + "category": "security", + "authorFullName": "Mike Thomas", + "authorGitHubUsername": "mike-j-thomas", + "publishedOn": "2021-10-22", + "articleTitle": "Work may be watching, but it might not be as bad as you think.", + "articleImageUrl": "/images/articles/work-may-be-watching-but-it-might-not-be-as-bad-as-you-think-cover-1600x900@2x.jpg" + } + }, + { + "url": "/announcements/worldwide-security-and-authentication-platform-chooses-fleet-for-linux", + "title": "Worldwide security and authentication platform chooses Fleet for linux", + "lastModifiedAt": 1734534699326, + "htmlId": "articles--worldwide-security-a--a82ed8b41a", + "sectionRelativeRepoPath": "worldwide-security-and-authentication-platform-chooses-fleet-for-linux.md", + "meta": { + "category": "announcements", + "authorGitHubUsername": "Drew-P-drawers", + "authorFullName": "Andrew Baker", + "publishedOn": "2024-12-10", + "articleTitle": "Worldwide security and authentication platform chooses Fleet for Linux management", + "description": "Worldwide security and authentication platform switches to Fleet for Linux device management" + } + }, + { + "url": "/guides/zero-trust-attestation-with-fleet", + "title": "Zero trust attestation with Fleet", + "lastModifiedAt": 1734534699327, + "htmlId": "articles--zero-trust-attestati--bfff868640", + "sectionRelativeRepoPath": "zero-trust-attestation-with-fleet.md", + "meta": { + "articleTitle": "How to use Fleet for zero trust attestation", + "authorFullName": "Mo Zhu", + "authorGitHubUsername": "zhumo", + "category": "guides", + "publishedOn": "2022-10-14", + "articleImageUrl": "/images/articles/fleet-for-zero-trust-attestation-800x450@2x.jpg" + } + }, + { + "url": "/handbook/company/open-positions/software-engineer", + "title": "🚀 Software Engineer", + "lastModifiedAt": 1734534699327, + "htmlId": "handbook--software-engineer--acca3f0c38", + "sectionRelativeRepoPath": "company/open-positions.yml", + "meta": { + "maintainedBy": "LukeHeath" + } + }, + { + "url": "/tables/account_policy_data", + "title": "account_policy_data", + "htmlId": "table--accountpolicydata--a6cb3ebfbd", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "account_policy_data", + "creation_time", + "failed_login_count", + "failed_login_timestamp", + "password_last_set_time", + "uid" + ], + "sectionRelativeRepoPath": "account_policy_data", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/account_policy_data.yml" + }, + { + "url": "/tables/ad_config", + "title": "ad_config", + "htmlId": "table--adconfig--476c3b5c1d", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "ad_config", + "domain", + "name", + "option", + "value" + ], + "sectionRelativeRepoPath": "ad_config", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ad_config.yml" + }, + { + "url": "/tables/alf", + "title": "alf", + "htmlId": "table--alf--1bf234c5b7", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "alf", + "allow_signed_enabled", + "firewall_unload", + "global_state", + "logging_enabled", + "logging_option", + "stealth_enabled", + "version" + ], + "sectionRelativeRepoPath": "alf", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf.yml" + }, + { + "url": "/tables/alf_exceptions", + "title": "alf_exceptions", + "htmlId": "table--alfexceptions--6aabd269bf", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "alf_exceptions", + "path", + "state" + ], + "sectionRelativeRepoPath": "alf_exceptions", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf_exceptions.yml" + }, + { + "url": "/tables/alf_explicit_auths", + "title": "alf_explicit_auths", + "htmlId": "table--alfexplicitauths--74cc921abc", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "alf_explicit_auths", + "process" + ], + "sectionRelativeRepoPath": "alf_explicit_auths", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf_explicit_auths.yml" + }, + { + "url": "/tables/apfs_physical_stores", + "title": "apfs_physical_stores", + "htmlId": "table--apfsphysicalstores--de1144e8a4", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "apfs_physical_stores", + "container_capacity_ceiling", + "container_capacity_free", + "container_designated_physical_store", + "container_fusion", + "container_reference", + "container_uuid", + "identifier", + "size", + "uuid" + ], + "sectionRelativeRepoPath": "apfs_physical_stores", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_physical_stores.yml" + }, + { + "url": "/tables/apfs_volumes", + "title": "apfs_volumes", + "htmlId": "table--apfsvolumes--113c163a66", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "apfs_volumes", + "capacity_in_use", + "capacity_quota", + "capacity_reserve", + "container_capacity_ceiling", + "container_capacity_free", + "container_designated_physical_store", + "container_fusion", + "container_reference", + "container_uuid", + "crypto_migration_on", + "device_identifier", + "encryption", + "filevault", + "locked", + "name", + "role", + "uuid" + ], + "sectionRelativeRepoPath": "apfs_volumes", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_volumes.yml" + }, + { + "url": "/tables/app_icons", + "title": "app_icons", + "htmlId": "table--appicons--1f2e0f14e8", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "app_icons", + "hash", + "icon", + "path" + ], + "sectionRelativeRepoPath": "app_icons", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/app_icons.yml" + }, + { + "url": "/tables/app_schemes", + "title": "app_schemes", + "htmlId": "table--appschemes--5c76313b4c", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "app_schemes", + "enabled", + "external", + "handler", + "protected", + "scheme" + ], + "sectionRelativeRepoPath": "app_schemes", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/app_schemes.yml" + }, + { + "url": "/tables/apparmor_events", + "title": "apparmor_events", + "htmlId": "table--apparmorevents--92ccac98cc", + "evented": true, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "apparmor_events", + "apparmor", + "capability", + "capname", + "comm", + "denied_mask", + "eid", + "error", + "fsuid", + "info", + "label", + "message", + "name", + "namespace", + "operation", + "ouid", + "parent", + "pid", + "profile", + "requested_mask", + "time", + "type", + "uptime" + ], + "sectionRelativeRepoPath": "apparmor_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fapparmor_events.yml&value=name%3A%20apparmor_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/apparmor_profiles", + "title": "apparmor_profiles", + "htmlId": "table--apparmorprofiles--b2f6964e9a", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "apparmor_profiles", + "attach", + "mode", + "name", + "path", + "sha1" + ], + "sectionRelativeRepoPath": "apparmor_profiles", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fapparmor_profiles.yml&value=name%3A%20apparmor_profiles%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/appcompat_shims", + "title": "appcompat_shims", + "htmlId": "table--appcompatshims--81c1fcea9f", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "appcompat_shims", + "description", + "executable", + "install_time", + "path", + "sdb_id", + "type" + ], + "sectionRelativeRepoPath": "appcompat_shims", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fappcompat_shims.yml&value=name%3A%20appcompat_shims%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/apps", + "title": "apps", + "htmlId": "table--apps--8dce5de4cb", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "apps", + "applescript_enabled", + "bundle_executable", + "bundle_identifier", + "bundle_name", + "bundle_package_type", + "bundle_short_version", + "bundle_version", + "category", + "compiler", + "copyright", + "development_region", + "display_name", + "element", + "environment", + "info_string", + "last_opened_time", + "minimum_system_version", + "name", + "path" + ], + "sectionRelativeRepoPath": "apps", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apps.yml" + }, + { + "url": "/tables/apt_sources", + "title": "apt_sources", + "htmlId": "table--aptsources--fb80ea21a7", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "apt_sources", + "architectures", + "base_uri", + "components", + "maintainer", + "name", + "pid_with_namespace", + "release", + "source", + "version" + ], + "sectionRelativeRepoPath": "apt_sources", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apt_sources.yml" + }, + { + "url": "/tables/arp_cache", + "title": "arp_cache", + "htmlId": "table--arpcache--89b3b20025", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "arp_cache", + "address", + "interface", + "mac", + "permanent" + ], + "sectionRelativeRepoPath": "arp_cache", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/arp_cache.yml" + }, + { + "url": "/tables/asl", + "title": "asl", + "htmlId": "table--asl--99886b336f", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "asl", + "extra", + "facility", + "gid", + "host", + "level", + "message", + "pid", + "ref_pid", + "ref_proc", + "sender", + "time", + "time_nano_sec", + "uid" + ], + "sectionRelativeRepoPath": "asl", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/asl.yml" + }, + { + "url": "/tables/augeas", + "title": "augeas", + "htmlId": "table--augeas--e79531b6fd", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "augeas", + "label", + "node", + "path", + "value" + ], + "sectionRelativeRepoPath": "augeas", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/augeas.yml" + }, + { + "url": "/tables/authdb", + "title": "authdb", + "htmlId": "table--authdb--7e3d3e49b9", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "authdb", + "json_result", + "right_name" + ], + "sectionRelativeRepoPath": "authdb", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authdb.yml" + }, + { + "url": "/tables/authenticode", + "title": "authenticode", + "htmlId": "table--authenticode--1265714bb6", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "authenticode", + "issuer_name", + "original_program_name", + "path", + "result", + "serial_number", + "subject_name" + ], + "sectionRelativeRepoPath": "authenticode", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fauthenticode.yml&value=name%3A%20authenticode%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/authorization_mechanisms", + "title": "authorization_mechanisms", + "htmlId": "table--authorizationmechanisms--0fb5864d8d", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "authorization_mechanisms", + "entry", + "label", + "mechanism", + "plugin", + "privileged" + ], + "sectionRelativeRepoPath": "authorization_mechanisms", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorization_mechanisms.yml" + }, + { + "url": "/tables/authorizations", + "title": "authorizations", + "htmlId": "table--authorizations--bad53d08da", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "authorizations", + "allow_root", + "authenticate_user", + "class", + "comment", + "created", + "label", + "modified", + "session_owner", + "shared", + "timeout", + "tries", + "version" + ], + "sectionRelativeRepoPath": "authorizations", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorizations.yml" + }, + { + "url": "/tables/authorized_keys", + "title": "authorized_keys", + "htmlId": "table--authorizedkeys--74557c32ec", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "authorized_keys", + "algorithm", + "comment", + "key", + "key_file", + "options", + "pid_with_namespace", + "uid" + ], + "sectionRelativeRepoPath": "authorized_keys", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorized_keys.yml" + }, + { + "url": "/tables/autoexec", + "title": "autoexec", + "htmlId": "table--autoexec--a26aad7a1a", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "autoexec", + "name", + "path", + "source" + ], + "sectionRelativeRepoPath": "autoexec", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fautoexec.yml&value=name%3A%20autoexec%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/azure_instance_metadata", + "title": "azure_instance_metadata", + "htmlId": "table--azureinstancemetadata--b5b904136c", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "azure_instance_metadata", + "location", + "name", + "offer", + "os_type", + "placement_group_id", + "platform_fault_domain", + "platform_update_domain", + "publisher", + "resource_group_name", + "sku", + "subscription_id", + "version", + "vm_id", + "vm_scale_set_name", + "vm_size", + "zone" + ], + "sectionRelativeRepoPath": "azure_instance_metadata", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/azure_instance_metadata.yml" + }, + { + "url": "/tables/azure_instance_tags", + "title": "azure_instance_tags", + "htmlId": "table--azureinstancetags--bd992a5351", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "azure_instance_tags", + "key", + "value", + "vm_id" + ], + "sectionRelativeRepoPath": "azure_instance_tags", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/azure_instance_tags.yml" + }, + { + "url": "/tables/background_activities_moderator", + "title": "background_activities_moderator", + "htmlId": "table--backgroundactivitiesmoderator--173703ea94", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "background_activities_moderator", + "last_execution_time", + "path", + "sid" + ], + "sectionRelativeRepoPath": "background_activities_moderator", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fbackground_activities_moderator.yml&value=name%3A%20background_activities_moderator%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/battery", + "title": "battery", + "htmlId": "table--battery--013882e970", + "evented": false, + "platforms": [ + "darwin", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "battery", + "amperage", + "charged", + "charging", + "chemistry", + "condition", + "current_capacity", + "cycle_count", + "designed_capacity", + "health", + "manufacture_date", + "manufacturer", + "max_capacity", + "minutes_to_full_charge", + "minutes_until_empty", + "model", + "percent_remaining", + "serial_number", + "state", + "voltage" + ], + "sectionRelativeRepoPath": "battery", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/battery.yml" + }, + { + "url": "/tables/bitlocker_info", + "title": "bitlocker_info", + "htmlId": "table--bitlockerinfo--ec4cf83c63", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "bitlocker_info", + "conversion_status", + "device_id", + "drive_letter", + "encryption_method", + "lock_status", + "percentage_encrypted", + "persistent_volume_id", + "protection_status", + "version" + ], + "sectionRelativeRepoPath": "bitlocker_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/bitlocker_info.yml" + }, + { + "url": "/tables/block_devices", + "title": "block_devices", + "htmlId": "table--blockdevices--02b86eaa11", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "block_devices", + "block_size", + "label", + "model", + "name", + "parent", + "size", + "type", + "uuid", + "vendor" + ], + "sectionRelativeRepoPath": "block_devices", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/block_devices.yml" + }, + { + "url": "/tables/bpf_process_events", + "title": "bpf_process_events", + "htmlId": "table--bpfprocessevents--e4d218dd16", + "evented": true, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "bpf_process_events", + "cid", + "cmdline", + "cwd", + "duration", + "eid", + "exit_code", + "gid", + "json_cmdline", + "ntime", + "parent", + "path", + "pid", + "probe_error", + "syscall", + "tid", + "time", + "uid" + ], + "sectionRelativeRepoPath": "bpf_process_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fbpf_process_events.yml&value=name%3A%20bpf_process_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/bpf_socket_events", + "title": "bpf_socket_events", + "htmlId": "table--bpfsocketevents--d159f6e0ec", + "evented": true, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "bpf_socket_events", + "cid", + "duration", + "eid", + "exit_code", + "family", + "fd", + "gid", + "local_address", + "local_port", + "ntime", + "parent", + "path", + "pid", + "probe_error", + "protocol", + "remote_address", + "remote_port", + "syscall", + "tid", + "time", + "type", + "uid" + ], + "sectionRelativeRepoPath": "bpf_socket_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fbpf_socket_events.yml&value=name%3A%20bpf_socket_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/carbon_black_info", + "title": "carbon_black_info", + "htmlId": "table--carbonblackinfo--6f86f36018", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "carbon_black_info", + "binary_queue", + "collect_cross_processes", + "collect_data_file_writes", + "collect_emet_events", + "collect_file_mods", + "collect_module_info", + "collect_module_loads", + "collect_net_conns", + "collect_process_user_context", + "collect_processes", + "collect_reg_mods", + "collect_sensor_operations", + "collect_store_files", + "config_name", + "event_queue", + "log_file_disk_quota_mb", + "log_file_disk_quota_percentage", + "protection_disabled", + "sensor_backend_server", + "sensor_id", + "sensor_ip_addr" + ], + "sectionRelativeRepoPath": "carbon_black_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/carbon_black_info.yml" + }, + { + "url": "/tables/carves", + "title": "carves", + "htmlId": "table--carves--21d0d7abcc", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "carves", + "carve", + "carve_guid", + "path", + "request_id", + "sha256", + "size", + "status", + "time" + ], + "sectionRelativeRepoPath": "carves", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fcarves.yml&value=name%3A%20carves%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/certificates", + "title": "certificates", + "htmlId": "table--certificates--c5deae5c8a", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "certificates", + "authority_key_id", + "ca", + "common_name", + "issuer", + "issuer2", + "key_algorithm", + "key_strength", + "key_usage", + "not_valid_after", + "not_valid_before", + "path", + "self_signed", + "serial", + "sha1", + "sid", + "signing_algorithm", + "store", + "store_id", + "store_location", + "subject", + "subject2", + "subject_key_id", + "username" + ], + "sectionRelativeRepoPath": "certificates", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/certificates.yml" + }, + { + "url": "/tables/chassis_info", + "title": "chassis_info", + "htmlId": "table--chassisinfo--83a136fff8", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "chassis_info", + "audible_alarm", + "breach_description", + "chassis_types", + "description", + "lock", + "manufacturer", + "model", + "security_breach", + "serial", + "sku", + "smbios_tag", + "status", + "visible_alarm" + ], + "sectionRelativeRepoPath": "chassis_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fchassis_info.yml&value=name%3A%20chassis_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/chocolatey_packages", + "title": "chocolatey_packages", + "htmlId": "table--chocolateypackages--288501d5b6", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "chocolatey_packages", + "author", + "license", + "name", + "path", + "summary", + "version" + ], + "sectionRelativeRepoPath": "chocolatey_packages", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fchocolatey_packages.yml&value=name%3A%20chocolatey_packages%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/chrome_extension_content_scripts", + "title": "chrome_extension_content_scripts", + "htmlId": "table--chromeextensioncontentscripts--abacba6da5", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "chrome_extension_content_scripts", + "browser_type", + "identifier", + "match", + "path", + "profile_path", + "referenced", + "script", + "uid", + "version" + ], + "sectionRelativeRepoPath": "chrome_extension_content_scripts", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/chrome_extension_content_scripts.yml" + }, + { + "url": "/tables/chrome_extensions", + "title": "chrome_extensions", + "htmlId": "table--chromeextensions--d60f6f5172", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux", + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "chrome_extensions", + "author", + "browser_type", + "current_locale", + "default_locale", + "description", + "from_webstore", + "identifier", + "install_time", + "install_timestamp", + "key", + "manifest_hash", + "manifest_json", + "name", + "optional_permissions", + "optional_permissions_json", + "path", + "permissions", + "permissions_json", + "persistent", + "profile", + "profile_path", + "referenced", + "referenced_identifier", + "state", + "uid", + "update_url", + "version" + ], + "sectionRelativeRepoPath": "chrome_extensions", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/chrome_extensions.yml" + }, + { + "url": "/tables/cis_audit", + "title": "cis_audit", + "htmlId": "table--cisaudit--874111a684", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "cis_audit", + "item", + "value" + ], + "sectionRelativeRepoPath": "cis_audit", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cis_audit.yml" + }, + { + "url": "/tables/codesign", + "title": "codesign", + "htmlId": "table--codesign--fa0a38aee8", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "codesign", + "path", + "team_identifier" + ], + "sectionRelativeRepoPath": "codesign", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/codesign.yml" + }, + { + "url": "/tables/connected_displays", + "title": "connected_displays", + "htmlId": "table--connecteddisplays--63b891fe5b", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "connected_displays", + "ambient_brightness_enabled", + "connection_type", + "display_id", + "display_type", + "main", + "manufactured_week", + "manufactured_year", + "mirror", + "name", + "online", + "pixels", + "product_id", + "resolution", + "rotation", + "serial_number", + "vendor_id" + ], + "sectionRelativeRepoPath": "connected_displays", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fconnected_displays.yml&value=name%3A%20connected_displays%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/connectivity", + "title": "connectivity", + "htmlId": "table--connectivity--0ed058b2bd", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "connectivity", + "disconnected", + "ipv4_internet", + "ipv4_local_network", + "ipv4_no_traffic", + "ipv4_subnet", + "ipv6_internet", + "ipv6_local_network", + "ipv6_no_traffic", + "ipv6_subnet" + ], + "sectionRelativeRepoPath": "connectivity", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fconnectivity.yml&value=name%3A%20connectivity%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/corestorage_logical_volume_families", + "title": "corestorage_logical_volume_families", + "htmlId": "table--corestoragelogicalvolumefamilies--75a2be8167", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "corestorage_logical_volume_families", + "EncryptionStatus", + "EncryptionType", + "HasVisibleUsers", + "HasVolumeKey", + "IsAcceptingNewUsers", + "IsFullySecure", + "MayHaveEncryptedEvents", + "RequiresPasswordUnlock", + "UUID", + "vg_FreeSpace", + "vg_FusionDrive", + "vg_Name", + "vg_Sequence", + "vg_Size", + "vg_Sparse", + "vg_Status", + "vg_UUID", + "vg_Version" + ], + "sectionRelativeRepoPath": "corestorage_logical_volume_families", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/corestorage_logical_volume_families.yml" + }, + { + "url": "/tables/corestorage_logical_volumes", + "title": "corestorage_logical_volumes", + "htmlId": "table--corestoragelogicalvolumes--2e5c4b4eda", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "corestorage_logical_volumes", + "ContentHint", + "ConversionState", + "ConverstionProgressPercent", + "DesignatedPhysicalVolume", + "DesignatedPhysicalVolumeIdentifier", + "Identifier", + "Name", + "Sequence", + "Size", + "Status", + "UUID", + "Version", + "VolumeName", + "lvf_EncryptionStatus", + "lvf_EncryptionType", + "lvf_HasVisibleUsers", + "lvf_HasVolumeKey", + "lvf_IsAcceptingNewUsers", + "lvf_IsFullySecure", + "lvf_MayHaveEncryptedEvents", + "lvf_RequiresPasswordUnlock", + "lvf_UUID", + "vg_FreeSpace", + "vg_FusionDrive", + "vg_Name", + "vg_Sequence", + "vg_Size", + "vg_Sparse", + "vg_Status", + "vg_UUID", + "vg_Version" + ], + "sectionRelativeRepoPath": "corestorage_logical_volumes", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/corestorage_logical_volumes.yml" + }, + { + "url": "/tables/cpu_info", + "title": "cpu_info", + "htmlId": "table--cpuinfo--dc58632cc4", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "cpu_info", + "address_width", + "availability", + "cpu_status", + "current_clock_speed", + "device_id", + "load_percentage", + "logical_processors", + "manufacturer", + "max_clock_speed", + "model", + "number_of_cores", + "number_of_efficiency_cores", + "number_of_performance_cores", + "processor_type", + "socket_designation" + ], + "sectionRelativeRepoPath": "cpu_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpu_info.yml" + }, + { + "url": "/tables/cpu_time", + "title": "cpu_time", + "htmlId": "table--cputime--8255dad033", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "cpu_time", + "core", + "guest", + "guest_nice", + "idle", + "iowait", + "irq", + "nice", + "softirq", + "steal", + "system", + "user" + ], + "sectionRelativeRepoPath": "cpu_time", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpu_time.yml" + }, + { + "url": "/tables/cpuid", + "title": "cpuid", + "htmlId": "table--cpuid--e436e18fab", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "cpuid", + "feature", + "input_eax", + "output_bit", + "output_register", + "value" + ], + "sectionRelativeRepoPath": "cpuid", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpuid.yml" + }, + { + "url": "/tables/crashes", + "title": "crashes", + "htmlId": "table--crashes--3bbfa2aecf", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "crashes", + "crash_path", + "crashed_thread", + "datetime", + "exception_codes", + "exception_notes", + "exception_type", + "identifier", + "parent", + "path", + "pid", + "registers", + "responsible", + "stack_trace", + "type", + "uid", + "version" + ], + "sectionRelativeRepoPath": "crashes", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/crashes.yml" + }, + { + "url": "/tables/crontab", + "title": "crontab", + "htmlId": "table--crontab--b9ef1cb44f", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "crontab", + "command", + "day_of_month", + "day_of_week", + "event", + "hour", + "minute", + "month", + "path", + "pid_with_namespace" + ], + "sectionRelativeRepoPath": "crontab", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/crontab.yml" + }, + { + "url": "/tables/cryptoinfo", + "title": "cryptoinfo", + "htmlId": "table--cryptoinfo--4e6f3402e4", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "cryptoinfo", + "fullkey", + "key", + "parent", + "passphrase", + "path", + "query", + "value" + ], + "sectionRelativeRepoPath": "cryptoinfo", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cryptoinfo.yml" + }, + { + "url": "/tables/cryptsetup_status", + "title": "cryptsetup_status", + "htmlId": "table--cryptsetupstatus--92e356d70a", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "cryptsetup_status", + "fullkey", + "key", + "name", + "parent", + "query", + "value" + ], + "sectionRelativeRepoPath": "cryptsetup_status", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cryptsetup_status.yml" + }, + { + "url": "/tables/csrutil_info", + "title": "csrutil_info", + "htmlId": "table--csrutilinfo--b59be8aa56", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "csrutil_info", + "ssv_enabled" + ], + "sectionRelativeRepoPath": "csrutil_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/csrutil_info.yml" + }, + { + "url": "/tables/cups_destinations", + "title": "cups_destinations", + "htmlId": "table--cupsdestinations--2afbcf27b5", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "cups_destinations", + "name", + "option_name", + "option_value" + ], + "sectionRelativeRepoPath": "cups_destinations", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cups_destinations.yml" + }, + { + "url": "/tables/cups_jobs", + "title": "cups_jobs", + "htmlId": "table--cupsjobs--bb7b9d647d", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "cups_jobs", + "completed_time", + "creation_time", + "destination", + "format", + "processing_time", + "size", + "title", + "user" + ], + "sectionRelativeRepoPath": "cups_jobs", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cups_jobs.yml" + }, + { + "url": "/tables/curl", + "title": "curl", + "htmlId": "table--curl--be66eddb51", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "curl", + "bytes", + "method", + "response_code", + "result", + "round_trip_time", + "url", + "user_agent" + ], + "sectionRelativeRepoPath": "curl", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/curl.yml" + }, + { + "url": "/tables/curl_certificate", + "title": "curl_certificate", + "htmlId": "table--curlcertificate--b068ff9340", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "curl_certificate", + "authority_key_identifier", + "basic_constraint", + "common_name", + "dump_certificate", + "extended_key_usage", + "has_expired", + "hostname", + "info_access", + "issuer_alternative_names", + "issuer_common_name", + "issuer_organization", + "issuer_organization_unit", + "key_usage", + "name_constraints", + "organization", + "organization_unit", + "pem", + "policies", + "policy_constraints", + "policy_mappings", + "serial_number", + "sha1_fingerprint", + "sha256_fingerprint", + "signature", + "signature_algorithm", + "subject_alternative_names", + "subject_info_access", + "subject_key_identifier", + "timeout", + "valid_from", + "valid_to", + "version" + ], + "sectionRelativeRepoPath": "curl_certificate", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/curl_certificate.yml" + }, + { + "url": "/tables/deb_packages", + "title": "deb_packages", + "htmlId": "table--debpackages--51b09c301a", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "deb_packages", + "admindir", + "arch", + "maintainer", + "mount_namespace_id", + "name", + "pid_with_namespace", + "priority", + "revision", + "section", + "size", + "source", + "status", + "version" + ], + "sectionRelativeRepoPath": "deb_packages", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/deb_packages.yml" + }, + { + "url": "/tables/default_environment", + "title": "default_environment", + "htmlId": "table--defaultenvironment--2ae05ad964", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "default_environment", + "expand", + "value", + "variable" + ], + "sectionRelativeRepoPath": "default_environment", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdefault_environment.yml&value=name%3A%20default_environment%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/device_file", + "title": "device_file", + "htmlId": "table--devicefile--21a9dfaeec", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "device_file", + "atime", + "block_size", + "ctime", + "device", + "filename", + "gid", + "hard_links", + "inode", + "mode", + "mtime", + "partition", + "path", + "size", + "type", + "uid" + ], + "sectionRelativeRepoPath": "device_file", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdevice_file.yml&value=name%3A%20device_file%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/device_firmware", + "title": "device_firmware", + "htmlId": "table--devicefirmware--51430913ce", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "device_firmware", + "device", + "type", + "version" + ], + "sectionRelativeRepoPath": "device_firmware", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/device_firmware.yml" + }, + { + "url": "/tables/device_hash", + "title": "device_hash", + "htmlId": "table--devicehash--3df4b40471", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "device_hash", + "device", + "inode", + "md5", + "partition", + "sha1", + "sha256" + ], + "sectionRelativeRepoPath": "device_hash", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdevice_hash.yml&value=name%3A%20device_hash%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/device_partitions", + "title": "device_partitions", + "htmlId": "table--devicepartitions--76f282a65c", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "device_partitions", + "blocks", + "blocks_size", + "device", + "flags", + "inodes", + "label", + "offset", + "partition", + "type" + ], + "sectionRelativeRepoPath": "device_partitions", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdevice_partitions.yml&value=name%3A%20device_partitions%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/disk_encryption", + "title": "disk_encryption", + "htmlId": "table--diskencryption--491e7cd22b", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "disk_encryption", + "encrypted", + "encryption_status", + "filevault_status", + "name", + "type", + "uid", + "user_uuid", + "uuid" + ], + "sectionRelativeRepoPath": "disk_encryption", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_encryption.yml" + }, + { + "url": "/tables/disk_events", + "title": "disk_events", + "htmlId": "table--diskevents--d600925ce7", + "evented": true, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "disk_events", + "action", + "checksum", + "content", + "device", + "eid", + "ejectable", + "filesystem", + "media_name", + "mountable", + "name", + "path", + "size", + "time", + "uuid", + "vendor", + "writable" + ], + "sectionRelativeRepoPath": "disk_events", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_events.yml" + }, + { + "url": "/tables/disk_info", + "title": "disk_info", + "htmlId": "table--diskinfo--50152e88f0", + "evented": false, + "platforms": [ + "windows", + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "disk_info", + "description", + "disk_index", + "disk_size", + "hardware_model", + "id", + "manufacturer", + "name", + "partitions", + "pnp_device_id", + "serial", + "type" + ], + "sectionRelativeRepoPath": "disk_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_info.yml" + }, + { + "url": "/tables/dns_cache", + "title": "dns_cache", + "htmlId": "table--dnscache--0f9ca87f83", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "dns_cache", + "flags", + "name", + "type" + ], + "sectionRelativeRepoPath": "dns_cache", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dns_cache.yml" + }, + { + "url": "/tables/dns_resolvers", + "title": "dns_resolvers", + "htmlId": "table--dnsresolvers--640b39c11c", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "dns_resolvers", + "address", + "id", + "netmask", + "options", + "pid_with_namespace", + "type" + ], + "sectionRelativeRepoPath": "dns_resolvers", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dns_resolvers.yml" + }, + { + "url": "/tables/docker_container_envs", + "title": "docker_container_envs", + "htmlId": "table--dockercontainerenvs--81a610f9b8", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_container_envs", + "id", + "key", + "value" + ], + "sectionRelativeRepoPath": "docker_container_envs", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_envs.yml" + }, + { + "url": "/tables/docker_container_fs_changes", + "title": "docker_container_fs_changes", + "htmlId": "table--dockercontainerfschanges--146475674b", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_container_fs_changes", + "change_type", + "id", + "path" + ], + "sectionRelativeRepoPath": "docker_container_fs_changes", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_container_fs_changes.yml&value=name%3A%20docker_container_fs_changes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_container_labels", + "title": "docker_container_labels", + "htmlId": "table--dockercontainerlabels--729a84f2c8", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_container_labels", + "id", + "key", + "value" + ], + "sectionRelativeRepoPath": "docker_container_labels", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_labels.yml" + }, + { + "url": "/tables/docker_container_mounts", + "title": "docker_container_mounts", + "htmlId": "table--dockercontainermounts--a4cdda336d", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_container_mounts", + "destination", + "driver", + "id", + "mode", + "name", + "propagation", + "rw", + "source", + "type" + ], + "sectionRelativeRepoPath": "docker_container_mounts", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_mounts.yml" + }, + { + "url": "/tables/docker_container_networks", + "title": "docker_container_networks", + "htmlId": "table--dockercontainernetworks--f1ba390a95", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_container_networks", + "endpoint_id", + "gateway", + "id", + "ip_address", + "ip_prefix_len", + "ipv6_address", + "ipv6_gateway", + "ipv6_prefix_len", + "mac_address", + "name", + "network_id" + ], + "sectionRelativeRepoPath": "docker_container_networks", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_networks.yml" + }, + { + "url": "/tables/docker_container_ports", + "title": "docker_container_ports", + "htmlId": "table--dockercontainerports--98e5d50e58", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_container_ports", + "host_ip", + "host_port", + "id", + "port", + "type" + ], + "sectionRelativeRepoPath": "docker_container_ports", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_ports.yml" + }, + { + "url": "/tables/docker_container_processes", + "title": "docker_container_processes", + "htmlId": "table--dockercontainerprocesses--0d43e2476d", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_container_processes", + "cmdline", + "cpu", + "egid", + "euid", + "gid", + "id", + "mem", + "name", + "nice", + "parent", + "pgroup", + "pid", + "resident_size", + "sgid", + "start_time", + "state", + "suid", + "threads", + "time", + "total_size", + "uid", + "user", + "wired_size" + ], + "sectionRelativeRepoPath": "docker_container_processes", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_container_processes.yml&value=name%3A%20docker_container_processes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_container_stats", + "title": "docker_container_stats", + "htmlId": "table--dockercontainerstats--cbc44cbb1e", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_container_stats", + "cpu_kernelmode_usage", + "cpu_total_usage", + "cpu_usermode_usage", + "disk_read", + "disk_write", + "id", + "interval", + "memory_cached", + "memory_limit", + "memory_max_usage", + "memory_usage", + "name", + "network_rx_bytes", + "network_tx_bytes", + "num_procs", + "online_cpus", + "pids", + "pre_cpu_kernelmode_usage", + "pre_cpu_total_usage", + "pre_cpu_usermode_usage", + "pre_online_cpus", + "pre_system_cpu_usage", + "preread", + "read", + "system_cpu_usage" + ], + "sectionRelativeRepoPath": "docker_container_stats", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_container_stats.yml&value=name%3A%20docker_container_stats%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_containers", + "title": "docker_containers", + "htmlId": "table--dockercontainers--7e3bf8c583", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_containers", + "cgroup_namespace", + "command", + "config_entrypoint", + "created", + "env_variables", + "finished_at", + "id", + "image", + "image_id", + "ipc_namespace", + "mnt_namespace", + "name", + "net_namespace", + "path", + "pid", + "pid_namespace", + "privileged", + "readonly_rootfs", + "security_options", + "started_at", + "state", + "status", + "user_namespace", + "uts_namespace" + ], + "sectionRelativeRepoPath": "docker_containers", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_containers.yml" + }, + { + "url": "/tables/docker_image_history", + "title": "docker_image_history", + "htmlId": "table--dockerimagehistory--4ae09de63b", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_image_history", + "comment", + "created", + "created_by", + "id", + "size", + "tags" + ], + "sectionRelativeRepoPath": "docker_image_history", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_image_history.yml&value=name%3A%20docker_image_history%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_image_labels", + "title": "docker_image_labels", + "htmlId": "table--dockerimagelabels--3f0926bda2", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_image_labels", + "id", + "key", + "value" + ], + "sectionRelativeRepoPath": "docker_image_labels", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_image_labels.yml&value=name%3A%20docker_image_labels%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_image_layers", + "title": "docker_image_layers", + "htmlId": "table--dockerimagelayers--3ecfc0546e", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_image_layers", + "id", + "layer_id", + "layer_order" + ], + "sectionRelativeRepoPath": "docker_image_layers", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_image_layers.yml&value=name%3A%20docker_image_layers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_images", + "title": "docker_images", + "htmlId": "table--dockerimages--cf3cfdc1ef", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_images", + "created", + "id", + "size_bytes", + "tags" + ], + "sectionRelativeRepoPath": "docker_images", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_images.yml" + }, + { + "url": "/tables/docker_info", + "title": "docker_info", + "htmlId": "table--dockerinfo--714b1bde6d", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_info", + "architecture", + "bridge_nf_ip6tables", + "bridge_nf_iptables", + "cgroup_driver", + "containers", + "containers_paused", + "containers_running", + "containers_stopped", + "cpu_cfs_period", + "cpu_cfs_quota", + "cpu_set", + "cpu_shares", + "cpus", + "http_proxy", + "https_proxy", + "id", + "images", + "ipv4_forwarding", + "kernel_memory", + "kernel_version", + "logging_driver", + "memory", + "memory_limit", + "name", + "no_proxy", + "oom_kill_disable", + "os", + "os_type", + "root_dir", + "server_version", + "storage_driver", + "swap_limit" + ], + "sectionRelativeRepoPath": "docker_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_info.yml&value=name%3A%20docker_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_network_labels", + "title": "docker_network_labels", + "htmlId": "table--dockernetworklabels--4f542d1ff2", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_network_labels", + "id", + "key", + "value" + ], + "sectionRelativeRepoPath": "docker_network_labels", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_network_labels.yml&value=name%3A%20docker_network_labels%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_networks", + "title": "docker_networks", + "htmlId": "table--dockernetworks--fa4acfa370", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_networks", + "created", + "driver", + "enable_ipv6", + "gateway", + "id", + "name", + "subnet" + ], + "sectionRelativeRepoPath": "docker_networks", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_networks.yml&value=name%3A%20docker_networks%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_version", + "title": "docker_version", + "htmlId": "table--dockerversion--e97ecaec5b", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_version", + "api_version", + "arch", + "build_time", + "git_commit", + "go_version", + "kernel_version", + "min_api_version", + "os", + "version" + ], + "sectionRelativeRepoPath": "docker_version", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_version.yml&value=name%3A%20docker_version%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_volume_labels", + "title": "docker_volume_labels", + "htmlId": "table--dockervolumelabels--66e9aa67f9", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_volume_labels", + "key", + "name", + "value" + ], + "sectionRelativeRepoPath": "docker_volume_labels", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_volume_labels.yml&value=name%3A%20docker_volume_labels%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/docker_volumes", + "title": "docker_volumes", + "htmlId": "table--dockervolumes--3f29ba576c", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "docker_volumes", + "driver", + "mount_point", + "name", + "type" + ], + "sectionRelativeRepoPath": "docker_volumes", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_volumes.yml" + }, + { + "url": "/tables/drivers", + "title": "drivers", + "htmlId": "table--drivers--ebf2da6641", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "drivers", + "class", + "date", + "description", + "device_id", + "device_name", + "driver_key", + "image", + "inf", + "manufacturer", + "provider", + "service", + "service_key", + "signed", + "version" + ], + "sectionRelativeRepoPath": "drivers", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdrivers.yml&value=name%3A%20drivers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/dscl", + "title": "dscl", + "htmlId": "table--dscl--6a32fb5697", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "dscl", + "command", + "key", + "path", + "value" + ], + "sectionRelativeRepoPath": "dscl", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dscl.yml" + }, + { + "url": "/tables/ec2_instance_metadata", + "title": "ec2_instance_metadata", + "htmlId": "table--ec2instancemetadata--1fe001f1fc", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "ec2_instance_metadata", + "account_id", + "ami_id", + "architecture", + "availability_zone", + "iam_arn", + "instance_id", + "instance_type", + "local_hostname", + "local_ipv4", + "mac", + "region", + "reservation_id", + "security_groups", + "ssh_public_key" + ], + "sectionRelativeRepoPath": "ec2_instance_metadata", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fec2_instance_metadata.yml&value=name%3A%20ec2_instance_metadata%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/ec2_instance_tags", + "title": "ec2_instance_tags", + "htmlId": "table--ec2instancetags--a1ae69e37b", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "ec2_instance_tags", + "instance_id", + "key", + "value" + ], + "sectionRelativeRepoPath": "ec2_instance_tags", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fec2_instance_tags.yml&value=name%3A%20ec2_instance_tags%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/es_process_events", + "title": "es_process_events", + "htmlId": "table--esprocessevents--46fde3e1bf", + "evented": true, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "es_process_events", + "cdhash", + "child_pid", + "cmdline", + "cmdline_count", + "codesigning_flags", + "cwd", + "egid", + "eid", + "env", + "env_count", + "euid", + "event_type", + "exit_code", + "gid", + "global_seq_num", + "original_parent", + "parent", + "path", + "pid", + "platform_binary", + "seq_num", + "signing_id", + "team_id", + "time", + "uid", + "username", + "version" + ], + "sectionRelativeRepoPath": "es_process_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fes_process_events.yml&value=name%3A%20es_process_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/es_process_file_events", + "title": "es_process_file_events", + "htmlId": "table--esprocessfileevents--ae9663cc9c", + "evented": true, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "es_process_file_events", + "dest_filename", + "eid", + "event_type", + "filename", + "global_seq_num", + "parent", + "path", + "pid", + "seq_num", + "time", + "version" + ], + "sectionRelativeRepoPath": "es_process_file_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fes_process_file_events.yml&value=name%3A%20es_process_file_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/etc_hosts", + "title": "etc_hosts", + "htmlId": "table--etchosts--aef5ac1189", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "etc_hosts", + "address", + "hostnames", + "pid_with_namespace" + ], + "sectionRelativeRepoPath": "etc_hosts", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/etc_hosts.yml" + }, + { + "url": "/tables/etc_protocols", + "title": "etc_protocols", + "htmlId": "table--etcprotocols--3294d792c1", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "etc_protocols", + "alias", + "comment", + "name", + "number" + ], + "sectionRelativeRepoPath": "etc_protocols", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fetc_protocols.yml&value=name%3A%20etc_protocols%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/etc_services", + "title": "etc_services", + "htmlId": "table--etcservices--5eadf265ad", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "etc_services", + "aliases", + "comment", + "name", + "port", + "protocol" + ], + "sectionRelativeRepoPath": "etc_services", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/etc_services.yml" + }, + { + "url": "/tables/event_taps", + "title": "event_taps", + "htmlId": "table--eventtaps--346fb130c6", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "event_taps", + "enabled", + "event_tap_id", + "event_tapped", + "process_being_tapped", + "tapping_process" + ], + "sectionRelativeRepoPath": "event_taps", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/event_taps.yml" + }, + { + "url": "/tables/extended_attributes", + "title": "extended_attributes", + "htmlId": "table--extendedattributes--4a537de12f", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "extended_attributes", + "base64", + "directory", + "key", + "path", + "value" + ], + "sectionRelativeRepoPath": "extended_attributes", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fextended_attributes.yml&value=name%3A%20extended_attributes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/falcon_kernel_check", + "title": "falcon_kernel_check", + "htmlId": "table--falconkernelcheck--3fb5ac699a", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "falcon_kernel_check", + "kernel", + "sensor_version", + "supported" + ], + "sectionRelativeRepoPath": "falcon_kernel_check", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/falcon_kernel_check.yml" + }, + { + "url": "/tables/falconctl_options", + "title": "falconctl_options", + "htmlId": "table--falconctloptions--3f358ca8e2", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "falconctl_options", + "options" + ], + "sectionRelativeRepoPath": "falconctl_options", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/falconctl_options.yml" + }, + { + "url": "/tables/fan_speed_sensors", + "title": "fan_speed_sensors", + "htmlId": "table--fanspeedsensors--2978a01b93", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "fan_speed_sensors", + "actual", + "fan", + "max", + "min", + "name", + "target" + ], + "sectionRelativeRepoPath": "fan_speed_sensors", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Ffan_speed_sensors.yml&value=name%3A%20fan_speed_sensors%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/file", + "title": "file", + "htmlId": "table--file--0998d79258", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "file", + "atime", + "attributes", + "block_size", + "bsd_flags", + "btime", + "ctime", + "device", + "directory", + "file_id", + "file_version", + "filename", + "gid", + "hard_links", + "inode", + "mode", + "mount_namespace_id", + "mtime", + "original_filename", + "path", + "pid_with_namespace", + "product_version", + "shortcut_comment", + "shortcut_run", + "shortcut_start_in", + "shortcut_target_location", + "shortcut_target_path", + "shortcut_target_type", + "size", + "symlink", + "type", + "uid", + "volume_serial" + ], + "sectionRelativeRepoPath": "file", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/file.yml" + }, + { + "url": "/tables/file_events", + "title": "file_events", + "htmlId": "table--fileevents--89f8fc187d", + "evented": true, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "file_events", + "action", + "atime", + "category", + "ctime", + "eid", + "gid", + "hashed", + "inode", + "md5", + "mode", + "mtime", + "sha1", + "sha256", + "size", + "target_path", + "time", + "transaction_id", + "uid" + ], + "sectionRelativeRepoPath": "file_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Ffile_events.yml&value=name%3A%20file_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/file_lines", + "title": "file_lines", + "htmlId": "table--filelines--b1cf006b9f", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "file_lines", + "line", + "path" + ], + "sectionRelativeRepoPath": "file_lines", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/file_lines.yml" + }, + { + "url": "/tables/filevault_prk", + "title": "filevault_prk", + "htmlId": "table--filevaultprk--c80ae4bc73", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "filevault_prk", + "base64_encrypted" + ], + "sectionRelativeRepoPath": "filevault_prk", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_prk.yml" + }, + { + "url": "/tables/filevault_status", + "title": "filevault_status", + "htmlId": "table--filevaultstatus--f596dfe332", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "filevault_status", + "status" + ], + "sectionRelativeRepoPath": "filevault_status", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_status.yml" + }, + { + "url": "/tables/filevault_users", + "title": "filevault_users", + "htmlId": "table--filevaultusers--4fef59eeaf", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "filevault_users", + "username", + "uuid" + ], + "sectionRelativeRepoPath": "filevault_users", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml" + }, + { + "url": "/tables/find_cmd", + "title": "find_cmd", + "htmlId": "table--findcmd--deb6daee06", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "find_cmd", + "directory", + "path", + "perm", + "type" + ], + "sectionRelativeRepoPath": "find_cmd", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/find_cmd.yml" + }, + { + "url": "/tables/firefox_addons", + "title": "firefox_addons", + "htmlId": "table--firefoxaddons--17b4919e2c", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "firefox_addons", + "active", + "autoupdate", + "creator", + "description", + "disabled", + "identifier", + "location", + "name", + "path", + "source_url", + "type", + "uid", + "version", + "visible" + ], + "sectionRelativeRepoPath": "firefox_addons", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firefox_addons.yml" + }, + { + "url": "/tables/firefox_preferences", + "title": "firefox_preferences", + "htmlId": "table--firefoxpreferences--c1cc16e572", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "firefox_preferences", + "fullkey", + "key", + "parent", + "path", + "query", + "value" + ], + "sectionRelativeRepoPath": "firefox_preferences", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firefox_preferences.yml" + }, + { + "url": "/tables/firmware_eficheck_integrity_check", + "title": "firmware_eficheck_integrity_check", + "htmlId": "table--firmwareeficheckintegritycheck--d824ba10bd", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "firmware_eficheck_integrity_check", + "chip", + "output" + ], + "sectionRelativeRepoPath": "firmware_eficheck_integrity_check", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml" + }, + { + "url": "/tables/firmwarepasswd", + "title": "firmwarepasswd", + "htmlId": "table--firmwarepasswd--1d4038effe", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "firmwarepasswd", + "mode", + "option_roms_allowed", + "password_enabled" + ], + "sectionRelativeRepoPath": "firmwarepasswd", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmwarepasswd.yml" + }, + { + "url": "/tables/fleetd_logs", + "title": "fleetd_logs", + "htmlId": "table--fleetdlogs--6779899341", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "fleetd_logs", + "error", + "level", + "message", + "payload", + "time" + ], + "sectionRelativeRepoPath": "fleetd_logs", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/fleetd_logs.yml" + }, + { + "url": "/tables/gatekeeper", + "title": "gatekeeper", + "htmlId": "table--gatekeeper--eeec63c313", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "gatekeeper", + "assessments_enabled", + "dev_id_enabled", + "opaque_version", + "version" + ], + "sectionRelativeRepoPath": "gatekeeper", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/gatekeeper.yml" + }, + { + "url": "/tables/gatekeeper_approved_apps", + "title": "gatekeeper_approved_apps", + "htmlId": "table--gatekeeperapprovedapps--5262f09ccf", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "gatekeeper_approved_apps", + "ctime", + "mtime", + "path", + "requirement" + ], + "sectionRelativeRepoPath": "gatekeeper_approved_apps", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fgatekeeper_approved_apps.yml&value=name%3A%20gatekeeper_approved_apps%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/geolocation", + "title": "geolocation", + "htmlId": "table--geolocation--7b8fdd3df6", + "evented": false, + "platforms": [ + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "geolocation", + "city", + "country", + "ip", + "region" + ], + "sectionRelativeRepoPath": "geolocation", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/geolocation.yml" + }, + { + "url": "/tables/google_chrome_profiles", + "title": "google_chrome_profiles", + "htmlId": "table--googlechromeprofiles--ba450e3fda", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "google_chrome_profiles", + "email", + "ephemeral", + "name", + "username" + ], + "sectionRelativeRepoPath": "google_chrome_profiles", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/google_chrome_profiles.yml" + }, + { + "url": "/tables/groups", + "title": "groups", + "htmlId": "table--groups--67e19bd020", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "groups", + "comment", + "gid", + "gid_signed", + "group_sid", + "groupname", + "is_hidden", + "pid_with_namespace" + ], + "sectionRelativeRepoPath": "groups", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/groups.yml" + }, + { + "url": "/tables/hardware_events", + "title": "hardware_events", + "htmlId": "table--hardwareevents--0ec1e5a067", + "evented": true, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "hardware_events", + "action", + "driver", + "eid", + "model", + "model_id", + "path", + "revision", + "serial", + "time", + "type", + "vendor", + "vendor_id" + ], + "sectionRelativeRepoPath": "hardware_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fhardware_events.yml&value=name%3A%20hardware_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/hash", + "title": "hash", + "htmlId": "table--hash--7b1d73cbdf", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "hash", + "directory", + "md5", + "mount_namespace_id", + "path", + "pid_with_namespace", + "sha1", + "sha256" + ], + "sectionRelativeRepoPath": "hash", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/hash.yml" + }, + { + "url": "/tables/homebrew_packages", + "title": "homebrew_packages", + "htmlId": "table--homebrewpackages--4c728a5d09", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "homebrew_packages", + "name", + "path", + "prefix", + "type", + "version" + ], + "sectionRelativeRepoPath": "homebrew_packages", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/homebrew_packages.yml" + }, + { + "url": "/tables/hvci_status", + "title": "hvci_status", + "htmlId": "table--hvcistatus--f86e9e772f", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "hvci_status", + "code_integrity_policy_enforcement_status", + "instance_identifier", + "umci_policy_status", + "vbs_status", + "version" + ], + "sectionRelativeRepoPath": "hvci_status", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fhvci_status.yml&value=name%3A%20hvci_status%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/ibridge_info", + "title": "ibridge_info", + "htmlId": "table--ibridgeinfo--7a52b9c110", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "ibridge_info", + "boot_uuid", + "coprocessor_version", + "firmware_version", + "unique_chip_id" + ], + "sectionRelativeRepoPath": "ibridge_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fibridge_info.yml&value=name%3A%20ibridge_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/icloud_private_relay", + "title": "icloud_private_relay", + "htmlId": "table--icloudprivaterelay--e09aa5fd60", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "icloud_private_relay", + "status" + ], + "sectionRelativeRepoPath": "icloud_private_relay", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/icloud_private_relay.yml" + }, + { + "url": "/tables/ie_extensions", + "title": "ie_extensions", + "htmlId": "table--ieextensions--eec76438e2", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "ie_extensions", + "name", + "path", + "registry_path", + "version" + ], + "sectionRelativeRepoPath": "ie_extensions", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ie_extensions.yml" + }, + { + "url": "/tables/intel_me_info", + "title": "intel_me_info", + "htmlId": "table--intelmeinfo--a3cd5396b2", + "evented": false, + "platforms": [ + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "intel_me_info", + "version" + ], + "sectionRelativeRepoPath": "intel_me_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fintel_me_info.yml&value=name%3A%20intel_me_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/interface_addresses", + "title": "interface_addresses", + "htmlId": "table--interfaceaddresses--6fff20210a", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "interface_addresses", + "address", + "broadcast", + "friendly_name", + "interface", + "mask", + "point_to_point", + "type" + ], + "sectionRelativeRepoPath": "interface_addresses", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_addresses.yml" + }, + { + "url": "/tables/interface_details", + "title": "interface_details", + "htmlId": "table--interfacedetails--6b2b348092", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "interface_details", + "collisions", + "connection_id", + "connection_status", + "description", + "dhcp_enabled", + "dhcp_lease_expires", + "dhcp_lease_obtained", + "dhcp_server", + "dns_domain", + "dns_domain_suffix_search_order", + "dns_host_name", + "dns_server_search_order", + "enabled", + "flags", + "friendly_name", + "ibytes", + "idrops", + "ierrors", + "interface", + "ipackets", + "last_change", + "link_speed", + "mac", + "manufacturer", + "metric", + "mtu", + "obytes", + "odrops", + "oerrors", + "opackets", + "pci_slot", + "physical_adapter", + "service", + "speed", + "type" + ], + "sectionRelativeRepoPath": "interface_details", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_details.yml" + }, + { + "url": "/tables/interface_ipv6", + "title": "interface_ipv6", + "htmlId": "table--interfaceipv6--f04ed02559", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "interface_ipv6", + "forwarding_enabled", + "hop_limit", + "interface", + "redirect_accept", + "rtadv_accept" + ], + "sectionRelativeRepoPath": "interface_ipv6", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_ipv6.yml" + }, + { + "url": "/tables/iokit_devicetree", + "title": "iokit_devicetree", + "htmlId": "table--iokitdevicetree--b4caa7690f", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "iokit_devicetree", + "busy_state", + "class", + "depth", + "device_path", + "id", + "name", + "parent", + "retain_count", + "service" + ], + "sectionRelativeRepoPath": "iokit_devicetree", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iokit_devicetree.yml" + }, + { + "url": "/tables/iokit_registry", + "title": "iokit_registry", + "htmlId": "table--iokitregistry--ee42001e08", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "iokit_registry", + "busy_state", + "class", + "depth", + "id", + "name", + "parent", + "retain_count" + ], + "sectionRelativeRepoPath": "iokit_registry", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iokit_registry.yml" + }, + { + "url": "/tables/ioreg", + "title": "ioreg", + "htmlId": "table--ioreg--921f1dc312", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "ioreg", + "c", + "d", + "fullkey", + "k", + "key", + "n", + "p", + "parent", + "query", + "r", + "value" + ], + "sectionRelativeRepoPath": "ioreg", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ioreg.yml" + }, + { + "url": "/tables/iptables", + "title": "iptables", + "htmlId": "table--iptables--a5056bcc8b", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "iptables", + "bytes", + "chain", + "dst_ip", + "dst_mask", + "dst_port", + "filter_name", + "iniface", + "iniface_mask", + "match", + "outiface", + "outiface_mask", + "packets", + "policy", + "protocol", + "src_ip", + "src_mask", + "src_port", + "target" + ], + "sectionRelativeRepoPath": "iptables", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iptables.yml" + }, + { + "url": "/tables/kernel_extensions", + "title": "kernel_extensions", + "htmlId": "table--kernelextensions--6d92f2c6f0", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "kernel_extensions", + "idx", + "linked_against", + "name", + "path", + "refs", + "size", + "version" + ], + "sectionRelativeRepoPath": "kernel_extensions", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_extensions.yml" + }, + { + "url": "/tables/kernel_info", + "title": "kernel_info", + "htmlId": "table--kernelinfo--c618a2f178", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "kernel_info", + "arguments", + "device", + "path", + "version" + ], + "sectionRelativeRepoPath": "kernel_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_info.yml" + }, + { + "url": "/tables/kernel_keys", + "title": "kernel_keys", + "htmlId": "table--kernelkeys--984dcf5650", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "kernel_keys", + "description", + "flags", + "gid", + "permissions", + "serial_number", + "timeout", + "type", + "uid", + "usage" + ], + "sectionRelativeRepoPath": "kernel_keys", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fkernel_keys.yml&value=name%3A%20kernel_keys%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/kernel_modules", + "title": "kernel_modules", + "htmlId": "table--kernelmodules--febe27dfbc", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "kernel_modules", + "address", + "name", + "size", + "status", + "used_by" + ], + "sectionRelativeRepoPath": "kernel_modules", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fkernel_modules.yml&value=name%3A%20kernel_modules%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/kernel_panics", + "title": "kernel_panics", + "htmlId": "table--kernelpanics--f98f88d76f", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "kernel_panics", + "dependencies", + "frame_backtrace", + "kernel_version", + "last_loaded", + "last_unloaded", + "module_backtrace", + "name", + "os_version", + "path", + "registers", + "system_model", + "time", + "uptime" + ], + "sectionRelativeRepoPath": "kernel_panics", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_panics.yml" + }, + { + "url": "/tables/keychain_acls", + "title": "keychain_acls", + "htmlId": "table--keychainacls--5882c68df9", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "keychain_acls", + "authorizations", + "description", + "keychain_path", + "label", + "path" + ], + "sectionRelativeRepoPath": "keychain_acls", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/keychain_acls.yml" + }, + { + "url": "/tables/keychain_items", + "title": "keychain_items", + "htmlId": "table--keychainitems--88ecbe05e7", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "keychain_items", + "account", + "comment", + "created", + "description", + "label", + "modified", + "path", + "pk_hash", + "type" + ], + "sectionRelativeRepoPath": "keychain_items", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/keychain_items.yml" + }, + { + "url": "/tables/known_hosts", + "title": "known_hosts", + "htmlId": "table--knownhosts--4a58922977", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "known_hosts", + "key", + "key_file", + "uid" + ], + "sectionRelativeRepoPath": "known_hosts", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/known_hosts.yml" + }, + { + "url": "/tables/kva_speculative_info", + "title": "kva_speculative_info", + "htmlId": "table--kvaspeculativeinfo--adfe134604", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "kva_speculative_info", + "bp_microcode_disabled", + "bp_mitigations", + "bp_system_pol_disabled", + "cpu_pred_cmd_supported", + "cpu_spec_ctrl_supported", + "ibrs_support_enabled", + "kva_shadow_enabled", + "kva_shadow_inv_pcid", + "kva_shadow_pcid", + "kva_shadow_user_global", + "stibp_support_enabled" + ], + "sectionRelativeRepoPath": "kva_speculative_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fkva_speculative_info.yml&value=name%3A%20kva_speculative_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/last", + "title": "last", + "htmlId": "table--last--28534934e6", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "last", + "host", + "pid", + "time", + "tty", + "type", + "type_name", + "username" + ], + "sectionRelativeRepoPath": "last", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/last.yml" + }, + { + "url": "/tables/launchd", + "title": "launchd", + "htmlId": "table--launchd--f247d85600", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "launchd", + "disabled", + "groupname", + "inetd_compatibility", + "keep_alive", + "label", + "name", + "on_demand", + "path", + "process_type", + "program", + "program_arguments", + "queue_directories", + "root_directory", + "run_at_load", + "start_interval", + "start_on_mount", + "stderr_path", + "stdout_path", + "username", + "watch_paths", + "working_directory" + ], + "sectionRelativeRepoPath": "launchd", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/launchd.yml" + }, + { + "url": "/tables/launchd_overrides", + "title": "launchd_overrides", + "htmlId": "table--launchdoverrides--dd07e94fee", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "launchd_overrides", + "key", + "label", + "path", + "uid", + "value" + ], + "sectionRelativeRepoPath": "launchd_overrides", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flaunchd_overrides.yml&value=name%3A%20launchd_overrides%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/listening_ports", + "title": "listening_ports", + "htmlId": "table--listeningports--d51c4032c8", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "listening_ports", + "address", + "family", + "fd", + "net_namespace", + "path", + "pid", + "port", + "protocol", + "socket" + ], + "sectionRelativeRepoPath": "listening_ports", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/listening_ports.yml" + }, + { + "url": "/tables/load_average", + "title": "load_average", + "htmlId": "table--loadaverage--90a074b9c2", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "load_average", + "average", + "period" + ], + "sectionRelativeRepoPath": "load_average", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/load_average.yml" + }, + { + "url": "/tables/location_services", + "title": "location_services", + "htmlId": "table--locationservices--75df8e45c4", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "location_services", + "enabled" + ], + "sectionRelativeRepoPath": "location_services", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/location_services.yml" + }, + { + "url": "/tables/logged_in_users", + "title": "logged_in_users", + "htmlId": "table--loggedinusers--7382490bc1", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "logged_in_users", + "host", + "pid", + "registry_hive", + "sid", + "time", + "tty", + "type", + "user" + ], + "sectionRelativeRepoPath": "logged_in_users", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/logged_in_users.yml" + }, + { + "url": "/tables/logical_drives", + "title": "logical_drives", + "htmlId": "table--logicaldrives--b1a4a1c6c1", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "logical_drives", + "boot_partition", + "description", + "device_id", + "file_system", + "free_space", + "size", + "type" + ], + "sectionRelativeRepoPath": "logical_drives", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flogical_drives.yml&value=name%3A%20logical_drives%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/logon_sessions", + "title": "logon_sessions", + "htmlId": "table--logonsessions--407c721831", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "logon_sessions", + "authentication_package", + "dns_domain_name", + "home_directory", + "home_directory_drive", + "logon_domain", + "logon_id", + "logon_script", + "logon_server", + "logon_sid", + "logon_time", + "logon_type", + "profile_path", + "session_id", + "upn", + "user" + ], + "sectionRelativeRepoPath": "logon_sessions", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flogon_sessions.yml&value=name%3A%20logon_sessions%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/lxd_certificates", + "title": "lxd_certificates", + "htmlId": "table--lxdcertificates--f4905dfe96", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "lxd_certificates", + "certificate", + "fingerprint", + "name", + "type" + ], + "sectionRelativeRepoPath": "lxd_certificates", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_certificates.yml&value=name%3A%20lxd_certificates%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/lxd_cluster", + "title": "lxd_cluster", + "htmlId": "table--lxdcluster--e830826c25", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "lxd_cluster", + "enabled", + "member_config_description", + "member_config_entity", + "member_config_key", + "member_config_name", + "member_config_value", + "server_name" + ], + "sectionRelativeRepoPath": "lxd_cluster", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_cluster.yml&value=name%3A%20lxd_cluster%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/lxd_cluster_members", + "title": "lxd_cluster_members", + "htmlId": "table--lxdclustermembers--ceb8aa7ccf", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "lxd_cluster_members", + "database", + "message", + "server_name", + "status", + "url" + ], + "sectionRelativeRepoPath": "lxd_cluster_members", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_cluster_members.yml&value=name%3A%20lxd_cluster_members%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/lxd_images", + "title": "lxd_images", + "htmlId": "table--lxdimages--2c5e205269", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "lxd_images", + "aliases", + "architecture", + "auto_update", + "cached", + "created_at", + "description", + "expires_at", + "filename", + "id", + "last_used_at", + "os", + "public", + "release", + "size", + "update_source_alias", + "update_source_certificate", + "update_source_protocol", + "update_source_server", + "uploaded_at" + ], + "sectionRelativeRepoPath": "lxd_images", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_images.yml&value=name%3A%20lxd_images%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/lxd_instance_config", + "title": "lxd_instance_config", + "htmlId": "table--lxdinstanceconfig--c470d51e8f", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "lxd_instance_config", + "key", + "name", + "value" + ], + "sectionRelativeRepoPath": "lxd_instance_config", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_instance_config.yml&value=name%3A%20lxd_instance_config%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/lxd_instance_devices", + "title": "lxd_instance_devices", + "htmlId": "table--lxdinstancedevices--0115618474", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "lxd_instance_devices", + "device", + "device_type", + "key", + "name", + "value" + ], + "sectionRelativeRepoPath": "lxd_instance_devices", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_instance_devices.yml&value=name%3A%20lxd_instance_devices%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/lxd_instances", + "title": "lxd_instances", + "htmlId": "table--lxdinstances--5a05be64a0", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "lxd_instances", + "architecture", + "base_image", + "created_at", + "description", + "ephemeral", + "name", + "os", + "pid", + "processes", + "stateful", + "status" + ], + "sectionRelativeRepoPath": "lxd_instances", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_instances.yml&value=name%3A%20lxd_instances%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/lxd_networks", + "title": "lxd_networks", + "htmlId": "table--lxdnetworks--718d71aced", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "lxd_networks", + "bytes_received", + "bytes_sent", + "hwaddr", + "ipv4_address", + "ipv6_address", + "managed", + "mtu", + "name", + "packets_received", + "packets_sent", + "state", + "type", + "used_by" + ], + "sectionRelativeRepoPath": "lxd_networks", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_networks.yml&value=name%3A%20lxd_networks%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/lxd_storage_pools", + "title": "lxd_storage_pools", + "htmlId": "table--lxdstoragepools--1cfcc8d26f", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "lxd_storage_pools", + "driver", + "inodes_total", + "inodes_used", + "name", + "size", + "source", + "space_total", + "space_used" + ], + "sectionRelativeRepoPath": "lxd_storage_pools", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_storage_pools.yml&value=name%3A%20lxd_storage_pools%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/macadmins_unified_log", + "title": "macadmins_unified_log", + "htmlId": "table--macadminsunifiedlog--38332f1c41", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "macadmins_unified_log", + "activity_identifier", + "boot_uuid", + "category", + "event_message", + "event_type", + "format_string", + "log_level", + "parent_activity_identifier", + "process_id", + "process_image_path", + "sender_image_path", + "sender_image_uuid", + "sender_program_counter", + "subsystem", + "thread_id", + "timestamp", + "trace_id" + ], + "sectionRelativeRepoPath": "macadmins_unified_log", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macadmins_unified_log.yml" + }, + { + "url": "/tables/macos_profiles", + "title": "macos_profiles", + "htmlId": "table--macosprofiles--7cc75ce911", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "macos_profiles", + "description", + "display_name", + "identifier", + "install_date", + "organization", + "type", + "uuid", + "verification_state" + ], + "sectionRelativeRepoPath": "macos_profiles", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_profiles.yml" + }, + { + "url": "/tables/macos_rsr", + "title": "macos_rsr", + "htmlId": "table--macosrsr--42f0c3ef94", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "macos_rsr", + "full_macos_version", + "macos_version", + "rsr_supported", + "rsr_version" + ], + "sectionRelativeRepoPath": "macos_rsr", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_rsr.yml" + }, + { + "url": "/tables/magic", + "title": "magic", + "htmlId": "table--magic--aa3092ede4", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "magic", + "data", + "magic_db_files", + "mime_encoding", + "mime_type", + "path" + ], + "sectionRelativeRepoPath": "magic", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmagic.yml&value=name%3A%20magic%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/managed_policies", + "title": "managed_policies", + "htmlId": "table--managedpolicies--4f50f98371", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "managed_policies", + "domain", + "manual", + "name", + "username", + "uuid", + "value" + ], + "sectionRelativeRepoPath": "managed_policies", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/managed_policies.yml" + }, + { + "url": "/tables/md_devices", + "title": "md_devices", + "htmlId": "table--mddevices--ef8f1583c9", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "md_devices", + "active_disks", + "bitmap_chunk_size", + "bitmap_external_file", + "bitmap_on_mem", + "check_array_finish", + "check_array_progress", + "check_array_speed", + "chunk_size", + "device_name", + "failed_disks", + "nr_raid_disks", + "other", + "raid_disks", + "raid_level", + "recovery_finish", + "recovery_progress", + "recovery_speed", + "reshape_finish", + "reshape_progress", + "reshape_speed", + "resync_finish", + "resync_progress", + "resync_speed", + "size", + "spare_disks", + "status", + "superblock_state", + "superblock_update_time", + "superblock_version", + "unused_devices", + "working_disks" + ], + "sectionRelativeRepoPath": "md_devices", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmd_devices.yml&value=name%3A%20md_devices%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/md_drives", + "title": "md_drives", + "htmlId": "table--mddrives--3d3e5f0540", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "md_drives", + "drive_name", + "md_device_name", + "slot", + "state" + ], + "sectionRelativeRepoPath": "md_drives", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmd_drives.yml&value=name%3A%20md_drives%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/md_personalities", + "title": "md_personalities", + "htmlId": "table--mdpersonalities--08a9ccc7f6", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "md_personalities", + "name" + ], + "sectionRelativeRepoPath": "md_personalities", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmd_personalities.yml&value=name%3A%20md_personalities%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/mdfind", + "title": "mdfind", + "htmlId": "table--mdfind--b1e40bb209", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "mdfind", + "path", + "query" + ], + "sectionRelativeRepoPath": "mdfind", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmdfind.yml&value=name%3A%20mdfind%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/mdls", + "title": "mdls", + "htmlId": "table--mdls--e8e99e3ce4", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "mdls", + "key", + "path", + "value", + "valuetype" + ], + "sectionRelativeRepoPath": "mdls", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdls.yml" + }, + { + "url": "/tables/mdm", + "title": "mdm", + "htmlId": "table--mdm--80e3800ecb", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "mdm", + "access_rights", + "checkin_url", + "dep_capable", + "enrolled", + "has_scep_payload", + "identity_certificate_uuid", + "install_date", + "installed_from_dep", + "payload_identifier", + "server_url", + "sign_message", + "topic", + "user_approved" + ], + "sectionRelativeRepoPath": "mdm", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm.yml" + }, + { + "url": "/tables/mdm_bridge", + "title": "mdm_bridge", + "htmlId": "table--mdmbridge--7423cd106a", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "mdm_bridge", + "enrolled_user", + "enrollment_status", + "mdm_command_input", + "mdm_command_output", + "raw_mdm_command_output" + ], + "sectionRelativeRepoPath": "mdm_bridge", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml" + }, + { + "url": "/tables/memory_array_mapped_addresses", + "title": "memory_array_mapped_addresses", + "htmlId": "table--memoryarraymappedaddresses--bb2ff310e9", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "memory_array_mapped_addresses", + "ending_address", + "handle", + "memory_array_handle", + "partition_width", + "starting_address" + ], + "sectionRelativeRepoPath": "memory_array_mapped_addresses", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_array_mapped_addresses.yml&value=name%3A%20memory_array_mapped_addresses%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/memory_arrays", + "title": "memory_arrays", + "htmlId": "table--memoryarrays--f1e4bec394", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "memory_arrays", + "handle", + "location", + "max_capacity", + "memory_error_correction", + "memory_error_info_handle", + "number_memory_devices", + "use" + ], + "sectionRelativeRepoPath": "memory_arrays", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_arrays.yml&value=name%3A%20memory_arrays%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/memory_device_mapped_addresses", + "title": "memory_device_mapped_addresses", + "htmlId": "table--memorydevicemappedaddresses--4fe77af2d6", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "memory_device_mapped_addresses", + "ending_address", + "handle", + "interleave_data_depth", + "interleave_position", + "memory_array_mapped_address_handle", + "memory_device_handle", + "partition_row_position", + "starting_address" + ], + "sectionRelativeRepoPath": "memory_device_mapped_addresses", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_device_mapped_addresses.yml&value=name%3A%20memory_device_mapped_addresses%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/memory_devices", + "title": "memory_devices", + "htmlId": "table--memorydevices--5354d4db11", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "memory_devices", + "array_handle", + "asset_tag", + "bank_locator", + "configured_clock_speed", + "configured_voltage", + "data_width", + "device_locator", + "form_factor", + "handle", + "manufacturer", + "max_speed", + "max_voltage", + "memory_type", + "memory_type_details", + "min_voltage", + "part_number", + "serial_number", + "set", + "size", + "total_width" + ], + "sectionRelativeRepoPath": "memory_devices", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_devices.yml&value=name%3A%20memory_devices%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/memory_error_info", + "title": "memory_error_info", + "htmlId": "table--memoryerrorinfo--bcdff56603", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "memory_error_info", + "device_error_address", + "error_granularity", + "error_operation", + "error_resolution", + "error_type", + "handle", + "memory_array_error_address", + "vendor_syndrome" + ], + "sectionRelativeRepoPath": "memory_error_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_error_info.yml&value=name%3A%20memory_error_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/memory_info", + "title": "memory_info", + "htmlId": "table--memoryinfo--82908af68f", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "memory_info", + "active", + "buffers", + "cached", + "inactive", + "memory_available", + "memory_free", + "memory_total", + "swap_cached", + "swap_free", + "swap_total" + ], + "sectionRelativeRepoPath": "memory_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_info.yml&value=name%3A%20memory_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/memory_map", + "title": "memory_map", + "htmlId": "table--memorymap--e25236245e", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "memory_map", + "end", + "name", + "start" + ], + "sectionRelativeRepoPath": "memory_map", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_map.yml&value=name%3A%20memory_map%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/mounts", + "title": "mounts", + "htmlId": "table--mounts--b925aef9c1", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "mounts", + "blocks", + "blocks_available", + "blocks_free", + "blocks_size", + "device", + "device_alias", + "flags", + "inodes", + "inodes_free", + "path", + "type" + ], + "sectionRelativeRepoPath": "mounts", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mounts.yml" + }, + { + "url": "/tables/msr", + "title": "msr", + "htmlId": "table--msr--00632263e3", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "msr", + "feature_control", + "perf_ctl", + "perf_status", + "platform_info", + "processor_number", + "rapl_energy_status", + "rapl_power_limit", + "rapl_power_units", + "turbo_disabled", + "turbo_ratio_limit" + ], + "sectionRelativeRepoPath": "msr", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmsr.yml&value=name%3A%20msr%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/munki_info", + "title": "munki_info", + "htmlId": "table--munkiinfo--b212c1e8ba", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "munki_info", + "console_user", + "end_time", + "errors", + "manifest_name", + "problem_installs", + "start_time", + "success", + "version", + "warnings" + ], + "sectionRelativeRepoPath": "munki_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_info.yml" + }, + { + "url": "/tables/munki_installs", + "title": "munki_installs", + "htmlId": "table--munkiinstalls--9a5361020e", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "munki_installs", + "end_time", + "installed", + "installed_version", + "name" + ], + "sectionRelativeRepoPath": "munki_installs", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_installs.yml" + }, + { + "url": "/tables/network_interfaces", + "title": "network_interfaces", + "htmlId": "table--networkinterfaces--90c47da90a", + "evented": false, + "platforms": [ + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "network_interfaces", + "ipv4", + "ipv6", + "mac" + ], + "sectionRelativeRepoPath": "network_interfaces", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/network_interfaces.yml" + }, + { + "url": "/tables/nfs_shares", + "title": "nfs_shares", + "htmlId": "table--nfsshares--8c50936f16", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "nfs_shares", + "options", + "readonly", + "share" + ], + "sectionRelativeRepoPath": "nfs_shares", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nfs_shares.yml" + }, + { + "url": "/tables/nftables", + "title": "nftables", + "htmlId": "table--nftables--b937d8c4ff", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "nftables", + "fullkey", + "key", + "parent", + "query", + "value" + ], + "sectionRelativeRepoPath": "nftables", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nftables.yml" + }, + { + "url": "/tables/npm_packages", + "title": "npm_packages", + "htmlId": "table--npmpackages--60cc5ee234", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "npm_packages", + "author", + "description", + "directory", + "homepage", + "license", + "mount_namespace_id", + "name", + "path", + "pid_with_namespace", + "version" + ], + "sectionRelativeRepoPath": "npm_packages", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/npm_packages.yml" + }, + { + "url": "/tables/ntdomains", + "title": "ntdomains", + "htmlId": "table--ntdomains--c8c182e7af", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "ntdomains", + "client_site_name", + "dc_site_name", + "dns_forest_name", + "domain_controller_address", + "domain_controller_name", + "domain_name", + "name", + "status" + ], + "sectionRelativeRepoPath": "ntdomains", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ntdomains.yml" + }, + { + "url": "/tables/ntfs_acl_permissions", + "title": "ntfs_acl_permissions", + "htmlId": "table--ntfsaclpermissions--689eaf130f", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "ntfs_acl_permissions", + "access", + "inherited_from", + "path", + "principal", + "type" + ], + "sectionRelativeRepoPath": "ntfs_acl_permissions", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fntfs_acl_permissions.yml&value=name%3A%20ntfs_acl_permissions%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/ntfs_journal_events", + "title": "ntfs_journal_events", + "htmlId": "table--ntfsjournalevents--478da24aae", + "evented": true, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "ntfs_journal_events", + "action", + "category", + "drive_letter", + "eid", + "file_attributes", + "node_ref_number", + "old_path", + "parent_ref_number", + "partial", + "path", + "record_timestamp", + "record_usn", + "time" + ], + "sectionRelativeRepoPath": "ntfs_journal_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fntfs_journal_events.yml&value=name%3A%20ntfs_journal_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/nvram", + "title": "nvram", + "htmlId": "table--nvram--f3b9191fd9", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "nvram", + "name", + "type", + "value" + ], + "sectionRelativeRepoPath": "nvram", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nvram.yml" + }, + { + "url": "/tables/nvram_info", + "title": "nvram_info", + "htmlId": "table--nvraminfo--35b2b0f859", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "nvram_info", + "amfi_enabled" + ], + "sectionRelativeRepoPath": "nvram_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nvram_info.yml" + }, + { + "url": "/tables/oem_strings", + "title": "oem_strings", + "htmlId": "table--oemstrings--cdb0ad5941", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "oem_strings", + "handle", + "number", + "value" + ], + "sectionRelativeRepoPath": "oem_strings", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Foem_strings.yml&value=name%3A%20oem_strings%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/office_mru", + "title": "office_mru", + "htmlId": "table--officemru--f544059b5a", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "office_mru", + "application", + "last_opened_time", + "path", + "sid", + "version" + ], + "sectionRelativeRepoPath": "office_mru", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Foffice_mru.yml&value=name%3A%20office_mru%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/orbit_info", + "title": "orbit_info", + "htmlId": "table--orbitinfo--16617a7b98", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "orbit_info", + "desktop_channel", + "desktop_version", + "device_auth_token", + "enrolled", + "last_recorded_error", + "orbit_channel", + "osqueryd_channel", + "scripts_enabled", + "uptime", + "version" + ], + "sectionRelativeRepoPath": "orbit_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/orbit_info.yml" + }, + { + "url": "/tables/os_version", + "title": "os_version", + "htmlId": "table--osversion--1d5c6d9a8d", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows", + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "os_version", + "arch", + "build", + "codename", + "extra", + "install_date", + "major", + "minor", + "mount_namespace_id", + "name", + "patch", + "pid_with_namespace", + "platform", + "platform_like", + "revision", + "version" + ], + "sectionRelativeRepoPath": "os_version", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/os_version.yml" + }, + { + "url": "/tables/osquery_events", + "title": "osquery_events", + "htmlId": "table--osqueryevents--df9fd8253e", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "osquery_events", + "active", + "events", + "name", + "publisher", + "refreshes", + "subscriptions", + "type" + ], + "sectionRelativeRepoPath": "osquery_events", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_events.yml" + }, + { + "url": "/tables/osquery_extensions", + "title": "osquery_extensions", + "htmlId": "table--osqueryextensions--a545584527", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "osquery_extensions", + "name", + "path", + "sdk_version", + "type", + "uuid", + "version" + ], + "sectionRelativeRepoPath": "osquery_extensions", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_extensions.yml" + }, + { + "url": "/tables/osquery_flags", + "title": "osquery_flags", + "htmlId": "table--osqueryflags--5b6a279c33", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "osquery_flags", + "default_value", + "description", + "name", + "shell_only", + "type", + "value" + ], + "sectionRelativeRepoPath": "osquery_flags", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_flags.yml" + }, + { + "url": "/tables/osquery_info", + "title": "osquery_info", + "htmlId": "table--osqueryinfo--dc3652a959", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux", + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "osquery_info", + "build_distro", + "build_platform", + "config_hash", + "config_valid", + "extensions", + "instance_id", + "pid", + "platform_mask", + "start_time", + "uuid", + "version", + "watcher" + ], + "sectionRelativeRepoPath": "osquery_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_info.yml" + }, + { + "url": "/tables/osquery_packs", + "title": "osquery_packs", + "htmlId": "table--osquerypacks--2c039d7ac9", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "osquery_packs", + "active", + "discovery_cache_hits", + "discovery_executions", + "name", + "platform", + "shard", + "version" + ], + "sectionRelativeRepoPath": "osquery_packs", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_packs.yml" + }, + { + "url": "/tables/osquery_registry", + "title": "osquery_registry", + "htmlId": "table--osqueryregistry--897c7454d4", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "osquery_registry", + "active", + "internal", + "name", + "owner_uuid", + "registry" + ], + "sectionRelativeRepoPath": "osquery_registry", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_registry.yml" + }, + { + "url": "/tables/osquery_schedule", + "title": "osquery_schedule", + "htmlId": "table--osqueryschedule--b083d81447", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "osquery_schedule", + "average_memory", + "denylisted", + "executions", + "interval", + "last_executed", + "last_memory", + "last_system_time", + "last_user_time", + "last_wall_time_ms", + "name", + "output_size", + "query", + "system_time", + "user_time", + "wall_time", + "wall_time_ms" + ], + "sectionRelativeRepoPath": "osquery_schedule", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_schedule.yml" + }, + { + "url": "/tables/package_bom", + "title": "package_bom", + "htmlId": "table--packagebom--9ed683d0d3", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "package_bom", + "filepath", + "gid", + "mode", + "modified_time", + "path", + "size", + "uid" + ], + "sectionRelativeRepoPath": "package_bom", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_bom.yml" + }, + { + "url": "/tables/package_install_history", + "title": "package_install_history", + "htmlId": "table--packageinstallhistory--fed77305b8", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "package_install_history", + "content_type", + "name", + "package_id", + "source", + "time", + "version" + ], + "sectionRelativeRepoPath": "package_install_history", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_install_history.yml" + }, + { + "url": "/tables/package_receipts", + "title": "package_receipts", + "htmlId": "table--packagereceipts--a5f589320c", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "package_receipts", + "install_time", + "installer_name", + "location", + "package_filename", + "package_id", + "path", + "version" + ], + "sectionRelativeRepoPath": "package_receipts", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_receipts.yml" + }, + { + "url": "/tables/parse_ini", + "title": "parse_ini", + "htmlId": "table--parseini--a63a77fbe6", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "parse_ini", + "fullkey", + "key", + "parent", + "path", + "value" + ], + "sectionRelativeRepoPath": "parse_ini", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_ini.yml" + }, + { + "url": "/tables/parse_json", + "title": "parse_json", + "htmlId": "table--parsejson--b12b8e8bb3", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "parse_json", + "fullkey", + "key", + "parent", + "path", + "value" + ], + "sectionRelativeRepoPath": "parse_json", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_json.yml" + }, + { + "url": "/tables/parse_jsonl", + "title": "parse_jsonl", + "htmlId": "table--parsejsonl--6aeab2ee4d", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "parse_jsonl", + "fullkey", + "key", + "parent", + "path", + "value" + ], + "sectionRelativeRepoPath": "parse_jsonl", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_jsonl.yml" + }, + { + "url": "/tables/parse_xml", + "title": "parse_xml", + "htmlId": "table--parsexml--10459b2ecf", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "parse_xml", + "fullkey", + "key", + "parent", + "path", + "value" + ], + "sectionRelativeRepoPath": "parse_xml", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_xml.yml" + }, + { + "url": "/tables/password_policy", + "title": "password_policy", + "htmlId": "table--passwordpolicy--cf2e8ac910", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "password_policy", + "policy_content", + "policy_description", + "policy_identifier", + "uid" + ], + "sectionRelativeRepoPath": "password_policy", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/password_policy.yml" + }, + { + "url": "/tables/patches", + "title": "patches", + "htmlId": "table--patches--51b7b9ee8b", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "patches", + "caption", + "csname", + "description", + "fix_comments", + "hotfix_id", + "install_date", + "installed_by", + "installed_on" + ], + "sectionRelativeRepoPath": "patches", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/patches.yml" + }, + { + "url": "/tables/pci_devices", + "title": "pci_devices", + "htmlId": "table--pcidevices--fe5bc03f6b", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "pci_devices", + "driver", + "model", + "model_id", + "pci_class", + "pci_class_id", + "pci_slot", + "pci_subclass", + "pci_subclass_id", + "subsystem_model", + "subsystem_model_id", + "subsystem_vendor", + "subsystem_vendor_id", + "vendor", + "vendor_id" + ], + "sectionRelativeRepoPath": "pci_devices", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pci_devices.yml" + }, + { + "url": "/tables/physical_disk_performance", + "title": "physical_disk_performance", + "htmlId": "table--physicaldiskperformance--08429f390c", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "physical_disk_performance", + "avg_disk_bytes_per_read", + "avg_disk_bytes_per_write", + "avg_disk_read_queue_length", + "avg_disk_sec_per_read", + "avg_disk_sec_per_write", + "avg_disk_write_queue_length", + "current_disk_queue_length", + "name", + "percent_disk_read_time", + "percent_disk_time", + "percent_disk_write_time", + "percent_idle_time" + ], + "sectionRelativeRepoPath": "physical_disk_performance", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fphysical_disk_performance.yml&value=name%3A%20physical_disk_performance%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/pipes", + "title": "pipes", + "htmlId": "table--pipes--8bfc968443", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "pipes", + "flags", + "instances", + "max_instances", + "name", + "pid" + ], + "sectionRelativeRepoPath": "pipes", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pipes.yml" + }, + { + "url": "/tables/platform_info", + "title": "platform_info", + "htmlId": "table--platforminfo--dc99fd50a7", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "platform_info", + "address", + "date", + "extra", + "firmware_type", + "revision", + "size", + "vendor", + "version", + "volume_size" + ], + "sectionRelativeRepoPath": "platform_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/platform_info.yml" + }, + { + "url": "/tables/plist", + "title": "plist", + "htmlId": "table--plist--298778c63f", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "plist", + "key", + "path", + "subkey", + "value" + ], + "sectionRelativeRepoPath": "plist", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/plist.yml" + }, + { + "url": "/tables/pmset", + "title": "pmset", + "htmlId": "table--pmset--89e3b6e6fe", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "pmset", + "getting", + "json_result" + ], + "sectionRelativeRepoPath": "pmset", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pmset.yml" + }, + { + "url": "/tables/portage_keywords", + "title": "portage_keywords", + "htmlId": "table--portagekeywords--272edb0eff", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "portage_keywords", + "keyword", + "mask", + "package", + "unmask", + "version" + ], + "sectionRelativeRepoPath": "portage_keywords", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fportage_keywords.yml&value=name%3A%20portage_keywords%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/portage_packages", + "title": "portage_packages", + "htmlId": "table--portagepackages--d3dce49932", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "portage_packages", + "build_time", + "eapi", + "package", + "repository", + "size", + "slot", + "version", + "world" + ], + "sectionRelativeRepoPath": "portage_packages", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fportage_packages.yml&value=name%3A%20portage_packages%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/portage_use", + "title": "portage_use", + "htmlId": "table--portageuse--37db25dd6e", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "portage_use", + "package", + "use", + "version" + ], + "sectionRelativeRepoPath": "portage_use", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fportage_use.yml&value=name%3A%20portage_use%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/power_sensors", + "title": "power_sensors", + "htmlId": "table--powersensors--3da04e685d", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "power_sensors", + "category", + "key", + "name", + "value" + ], + "sectionRelativeRepoPath": "power_sensors", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/power_sensors.yml" + }, + { + "url": "/tables/powershell_events", + "title": "powershell_events", + "htmlId": "table--powershellevents--fc7237769d", + "evented": true, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "powershell_events", + "cosine_similarity", + "datetime", + "script_block_count", + "script_block_id", + "script_name", + "script_path", + "script_text", + "time" + ], + "sectionRelativeRepoPath": "powershell_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fpowershell_events.yml&value=name%3A%20powershell_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/preferences", + "title": "preferences", + "htmlId": "table--preferences--e75a728511", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "preferences", + "domain", + "forced", + "host", + "key", + "subkey", + "username", + "value" + ], + "sectionRelativeRepoPath": "preferences", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/preferences.yml" + }, + { + "url": "/tables/prefetch", + "title": "prefetch", + "htmlId": "table--prefetch--453fbf013a", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "prefetch", + "accessed_directories", + "accessed_directories_count", + "accessed_files", + "accessed_files_count", + "filename", + "hash", + "last_run_time", + "other_run_times", + "path", + "run_count", + "size", + "volume_creation", + "volume_serial" + ], + "sectionRelativeRepoPath": "prefetch", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprefetch.yml&value=name%3A%20prefetch%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/privacy_preferences", + "title": "privacy_preferences", + "htmlId": "table--privacypreferences--7b06d84dd1", + "evented": false, + "platforms": [ + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "privacy_preferences", + "ad_measurement_enabled", + "autofill_address_enabled", + "autofill_credit_card_enabled", + "autofill_enabled", + "do_not_track_enabled", + "fledge_enabled", + "hyperlink_auditing_enabled", + "network_prediction_enabled", + "privacy_sandbox_enabled", + "protected_content_enabled", + "referrers_enabled", + "safe_browsing_enabled", + "safe_browsing_extended_reporting_enabled", + "save_passwords_enabled", + "search_suggest_enabled", + "spelling_service_enabled", + "third_party_cookies_allowed", + "topics_enabled", + "translation_service_enabled", + "web_rtc_ip_handling_policy" + ], + "sectionRelativeRepoPath": "privacy_preferences", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/privacy_preferences.yml" + }, + { + "url": "/tables/process_envs", + "title": "process_envs", + "htmlId": "table--processenvs--6652489264", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "process_envs", + "key", + "pid", + "value" + ], + "sectionRelativeRepoPath": "process_envs", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_envs.yml" + }, + { + "url": "/tables/process_etw_events", + "title": "process_etw_events", + "htmlId": "table--processetwevents--209331c6a0", + "evented": true, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "process_etw_events", + "cmdline", + "datetime", + "eid", + "exit_code", + "flags", + "header_pid", + "mandatory_label", + "parent_process_sequence_number", + "path", + "pid", + "ppid", + "process_sequence_number", + "session_id", + "time", + "time_windows", + "token_elevation_status", + "token_elevation_type", + "type", + "username" + ], + "sectionRelativeRepoPath": "process_etw_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_etw_events.yml&value=name%3A%20process_etw_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/process_events", + "title": "process_events", + "htmlId": "table--processevents--ad0c5ef7a0", + "evented": true, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "process_events", + "atime", + "auid", + "btime", + "cmdline", + "cmdline_size", + "ctime", + "cwd", + "egid", + "eid", + "env", + "env_count", + "env_size", + "euid", + "fsgid", + "fsuid", + "gid", + "mode", + "mtime", + "overflows", + "owner_gid", + "owner_uid", + "parent", + "path", + "pid", + "sgid", + "status", + "suid", + "syscall", + "time", + "uid", + "uptime" + ], + "sectionRelativeRepoPath": "process_events", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_events.yml" + }, + { + "url": "/tables/process_file_events", + "title": "process_file_events", + "htmlId": "table--processfileevents--18c555fe80", + "evented": true, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "process_file_events", + "auid", + "cwd", + "dest_path", + "egid", + "eid", + "euid", + "executable", + "fsgid", + "fsuid", + "gid", + "operation", + "partial", + "path", + "pid", + "ppid", + "sgid", + "suid", + "time", + "uid", + "uptime" + ], + "sectionRelativeRepoPath": "process_file_events", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_file_events.yml" + }, + { + "url": "/tables/process_memory_map", + "title": "process_memory_map", + "htmlId": "table--processmemorymap--84fa47d61c", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "process_memory_map", + "device", + "end", + "inode", + "offset", + "path", + "permissions", + "pid", + "pseudo", + "start" + ], + "sectionRelativeRepoPath": "process_memory_map", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_memory_map.yml" + }, + { + "url": "/tables/process_namespaces", + "title": "process_namespaces", + "htmlId": "table--processnamespaces--8b20ff20ba", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "process_namespaces", + "cgroup_namespace", + "ipc_namespace", + "mnt_namespace", + "net_namespace", + "pid", + "pid_namespace", + "user_namespace", + "uts_namespace" + ], + "sectionRelativeRepoPath": "process_namespaces", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_namespaces.yml&value=name%3A%20process_namespaces%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/process_open_files", + "title": "process_open_files", + "htmlId": "table--processopenfiles--d400c1e606", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "process_open_files", + "fd", + "path", + "pid" + ], + "sectionRelativeRepoPath": "process_open_files", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_open_files.yml" + }, + { + "url": "/tables/process_open_pipes", + "title": "process_open_pipes", + "htmlId": "table--processopenpipes--94719aab4e", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "process_open_pipes", + "fd", + "inode", + "mode", + "partner_fd", + "partner_mode", + "partner_pid", + "pid", + "type" + ], + "sectionRelativeRepoPath": "process_open_pipes", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_open_pipes.yml&value=name%3A%20process_open_pipes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/process_open_sockets", + "title": "process_open_sockets", + "htmlId": "table--processopensockets--e163b1f60b", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "process_open_sockets", + "family", + "fd", + "local_address", + "local_port", + "net_namespace", + "path", + "pid", + "protocol", + "remote_address", + "remote_port", + "socket", + "state" + ], + "sectionRelativeRepoPath": "process_open_sockets", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_open_sockets.yml" + }, + { + "url": "/tables/processes", + "title": "processes", + "htmlId": "table--processes--a3dfddcd52", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "processes", + "cgroup_path", + "cmdline", + "cpu_subtype", + "cpu_type", + "cwd", + "disk_bytes_read", + "disk_bytes_written", + "egid", + "elapsed_time", + "elevated_token", + "euid", + "gid", + "handle_count", + "name", + "nice", + "on_disk", + "parent", + "path", + "percent_processor_time", + "pgroup", + "pid", + "protection_type", + "resident_size", + "root", + "secure_process", + "sgid", + "start_time", + "state", + "suid", + "system_time", + "threads", + "total_size", + "translated", + "uid", + "upid", + "uppid", + "user_time", + "virtual_process", + "wired_size" + ], + "sectionRelativeRepoPath": "processes", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/processes.yml" + }, + { + "url": "/tables/programs", + "title": "programs", + "htmlId": "table--programs--bd20b1c857", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "programs", + "identifying_number", + "install_date", + "install_location", + "install_source", + "language", + "name", + "publisher", + "uninstall_string", + "version" + ], + "sectionRelativeRepoPath": "programs", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/programs.yml" + }, + { + "url": "/tables/prometheus_metrics", + "title": "prometheus_metrics", + "htmlId": "table--prometheusmetrics--810cfe9c1f", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "prometheus_metrics", + "metric_name", + "metric_value", + "target_name", + "timestamp_ms" + ], + "sectionRelativeRepoPath": "prometheus_metrics", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprometheus_metrics.yml&value=name%3A%20prometheus_metrics%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/puppet_info", + "title": "puppet_info", + "htmlId": "table--puppetinfo--9c28500bf5", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "puppet_info", + "cached_catalog_status", + "catalog_uuid", + "code_id", + "configuration_version", + "corrective_change", + "environment", + "host", + "kind", + "master_used", + "noop", + "noop_pending", + "puppet_version", + "report_format", + "status", + "time", + "transaction_completed", + "transaction_uuid" + ], + "sectionRelativeRepoPath": "puppet_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_info.yml" + }, + { + "url": "/tables/puppet_logs", + "title": "puppet_logs", + "htmlId": "table--puppetlogs--1bb88be1ec", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "puppet_logs", + "file", + "level", + "line", + "message", + "source", + "time" + ], + "sectionRelativeRepoPath": "puppet_logs", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_logs.yml" + }, + { + "url": "/tables/puppet_state", + "title": "puppet_state", + "htmlId": "table--puppetstate--7ea179db18", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "puppet_state", + "change_count", + "changed", + "corrective_change", + "evaluation_time", + "failed", + "file", + "line", + "out_of_sync", + "out_of_sync_count", + "resource", + "resource_type", + "skipped", + "title" + ], + "sectionRelativeRepoPath": "puppet_state", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_state.yml" + }, + { + "url": "/tables/pwd_policy", + "title": "pwd_policy", + "htmlId": "table--pwdpolicy--a8d277dc32", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "pwd_policy", + "days_to_expiration", + "expires_every_n_days", + "history_depth", + "max_failed_attempts", + "min_mixed_case_characters" + ], + "sectionRelativeRepoPath": "pwd_policy", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pwd_policy.yml" + }, + { + "url": "/tables/python_packages", + "title": "python_packages", + "htmlId": "table--pythonpackages--3418965b2d", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "python_packages", + "author", + "directory", + "license", + "name", + "path", + "pid_with_namespace", + "summary", + "version" + ], + "sectionRelativeRepoPath": "python_packages", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/python_packages.yml" + }, + { + "url": "/tables/quicklook_cache", + "title": "quicklook_cache", + "htmlId": "table--quicklookcache--bbd52f27e6", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "quicklook_cache", + "cache_path", + "fs_id", + "hit_count", + "icon_mode", + "inode", + "label", + "last_hit_date", + "mtime", + "path", + "rowid", + "size", + "volume_id" + ], + "sectionRelativeRepoPath": "quicklook_cache", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fquicklook_cache.yml&value=name%3A%20quicklook_cache%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/registry", + "title": "registry", + "htmlId": "table--registry--1dd369b263", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "registry", + "data", + "key", + "mtime", + "name", + "path", + "type" + ], + "sectionRelativeRepoPath": "registry", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/registry.yml" + }, + { + "url": "/tables/routes", + "title": "routes", + "htmlId": "table--routes--e1f3ee7062", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "routes", + "destination", + "flags", + "gateway", + "hopcount", + "interface", + "metric", + "mtu", + "netmask", + "source", + "type" + ], + "sectionRelativeRepoPath": "routes", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/routes.yml" + }, + { + "url": "/tables/rpm_package_files", + "title": "rpm_package_files", + "htmlId": "table--rpmpackagefiles--987985a5f0", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "rpm_package_files", + "groupname", + "mode", + "package", + "path", + "sha256", + "size", + "username" + ], + "sectionRelativeRepoPath": "rpm_package_files", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Frpm_package_files.yml&value=name%3A%20rpm_package_files%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/rpm_packages", + "title": "rpm_packages", + "htmlId": "table--rpmpackages--b5248f26ae", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "rpm_packages", + "arch", + "epoch", + "install_time", + "mount_namespace_id", + "name", + "package_group", + "pid_with_namespace", + "release", + "sha1", + "size", + "source", + "vendor", + "version" + ], + "sectionRelativeRepoPath": "rpm_packages", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/rpm_packages.yml" + }, + { + "url": "/tables/running_apps", + "title": "running_apps", + "htmlId": "table--runningapps--cd6ead8455", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "running_apps", + "bundle_identifier", + "is_active", + "pid" + ], + "sectionRelativeRepoPath": "running_apps", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/running_apps.yml" + }, + { + "url": "/tables/safari_extensions", + "title": "safari_extensions", + "htmlId": "table--safariextensions--6250d10adf", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "safari_extensions", + "author", + "bundle_version", + "copyright", + "description", + "developer_id", + "extension_type", + "identifier", + "name", + "path", + "sdk", + "uid", + "update_url", + "version" + ], + "sectionRelativeRepoPath": "safari_extensions", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/safari_extensions.yml" + }, + { + "url": "/tables/sandboxes", + "title": "sandboxes", + "htmlId": "table--sandboxes--4dfe5fde32", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "sandboxes", + "build_id", + "bundle_path", + "enabled", + "label", + "path", + "user" + ], + "sectionRelativeRepoPath": "sandboxes", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsandboxes.yml&value=name%3A%20sandboxes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/scheduled_tasks", + "title": "scheduled_tasks", + "htmlId": "table--scheduledtasks--9f6fd172c3", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "scheduled_tasks", + "action", + "enabled", + "hidden", + "last_run_code", + "last_run_message", + "last_run_time", + "name", + "next_run_time", + "path", + "state" + ], + "sectionRelativeRepoPath": "scheduled_tasks", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/scheduled_tasks.yml" + }, + { + "url": "/tables/screenlock", + "title": "screenlock", + "htmlId": "table--screenlock--ad6884fb04", + "evented": false, + "platforms": [ + "darwin", + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "screenlock", + "enabled", + "grace_period" + ], + "sectionRelativeRepoPath": "screenlock", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/screenlock.yml" + }, + { + "url": "/tables/seccomp_events", + "title": "seccomp_events", + "htmlId": "table--seccompevents--746b10d1fe", + "evented": true, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "seccomp_events", + "arch", + "auid", + "code", + "comm", + "compat", + "exe", + "gid", + "ip", + "pid", + "ses", + "sig", + "syscall", + "time", + "uid", + "uptime" + ], + "sectionRelativeRepoPath": "seccomp_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fseccomp_events.yml&value=name%3A%20seccomp_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/secureboot", + "title": "secureboot", + "htmlId": "table--secureboot--2fdb69f2da", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "secureboot", + "description", + "kernel_extensions", + "mdm_operations", + "secure_boot", + "secure_mode", + "setup_mode" + ], + "sectionRelativeRepoPath": "secureboot", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/secureboot.yml" + }, + { + "url": "/tables/security_profile_info", + "title": "security_profile_info", + "htmlId": "table--securityprofileinfo--66379dbd45", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "security_profile_info", + "audit_account_logon", + "audit_account_manage", + "audit_ds_access", + "audit_logon_events", + "audit_object_access", + "audit_policy_change", + "audit_privilege_use", + "audit_process_tracking", + "audit_system_events", + "clear_text_password", + "enable_admin_account", + "enable_guest_account", + "force_logoff_when_expire", + "lockout_bad_count", + "logon_to_change_password", + "lsa_anonymous_name_lookup", + "maximum_password_age", + "minimum_password_age", + "minimum_password_length", + "new_administrator_name", + "new_guest_name", + "password_complexity", + "password_history_size" + ], + "sectionRelativeRepoPath": "security_profile_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsecurity_profile_info.yml&value=name%3A%20security_profile_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/selinux_events", + "title": "selinux_events", + "htmlId": "table--selinuxevents--2da3fa9426", + "evented": true, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "selinux_events", + "eid", + "message", + "time", + "type", + "uptime" + ], + "sectionRelativeRepoPath": "selinux_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fselinux_events.yml&value=name%3A%20selinux_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/selinux_settings", + "title": "selinux_settings", + "htmlId": "table--selinuxsettings--00d49fe417", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "selinux_settings", + "key", + "scope", + "value" + ], + "sectionRelativeRepoPath": "selinux_settings", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fselinux_settings.yml&value=name%3A%20selinux_settings%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/services", + "title": "services", + "htmlId": "table--services--7fd725a72c", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "services", + "description", + "display_name", + "module_path", + "name", + "path", + "pid", + "service_exit_code", + "service_type", + "start_type", + "status", + "user_account", + "win32_exit_code" + ], + "sectionRelativeRepoPath": "services", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fservices.yml&value=name%3A%20services%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/shadow", + "title": "shadow", + "htmlId": "table--shadow--600e9768a3", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "shadow", + "expire", + "flag", + "hash_alg", + "inactive", + "last_change", + "max", + "min", + "password_status", + "username", + "warning" + ], + "sectionRelativeRepoPath": "shadow", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fshadow.yml&value=name%3A%20shadow%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/shared_folders", + "title": "shared_folders", + "htmlId": "table--sharedfolders--80d9e4dd57", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "shared_folders", + "name", + "path" + ], + "sectionRelativeRepoPath": "shared_folders", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shared_folders.yml" + }, + { + "url": "/tables/shared_memory", + "title": "shared_memory", + "htmlId": "table--sharedmemory--03832cd7cc", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "shared_memory", + "atime", + "attached", + "creator_pid", + "creator_uid", + "ctime", + "dtime", + "locked", + "owner_uid", + "permissions", + "pid", + "shmid", + "size", + "status" + ], + "sectionRelativeRepoPath": "shared_memory", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fshared_memory.yml&value=name%3A%20shared_memory%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/shared_resources", + "title": "shared_resources", + "htmlId": "table--sharedresources--eb38ecd1f2", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "shared_resources", + "allow_maximum", + "description", + "install_date", + "maximum_allowed", + "name", + "path", + "status", + "type", + "type_name" + ], + "sectionRelativeRepoPath": "shared_resources", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shared_resources.yml" + }, + { + "url": "/tables/sharing_preferences", + "title": "sharing_preferences", + "htmlId": "table--sharingpreferences--9f16698fa4", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "sharing_preferences", + "bluetooth_sharing", + "content_caching", + "disc_sharing", + "file_sharing", + "internet_sharing", + "printer_sharing", + "remote_apple_events", + "remote_login", + "remote_management", + "screen_sharing" + ], + "sectionRelativeRepoPath": "sharing_preferences", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sharing_preferences.yml" + }, + { + "url": "/tables/shell_history", + "title": "shell_history", + "htmlId": "table--shellhistory--dc2e14c01c", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "shell_history", + "command", + "history_file", + "time", + "uid" + ], + "sectionRelativeRepoPath": "shell_history", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shell_history.yml" + }, + { + "url": "/tables/shellbags", + "title": "shellbags", + "htmlId": "table--shellbags--c0e6d5a169", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "shellbags", + "accessed_time", + "created_time", + "mft_entry", + "mft_sequence", + "modified_time", + "path", + "sid", + "source" + ], + "sectionRelativeRepoPath": "shellbags", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fshellbags.yml&value=name%3A%20shellbags%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/shimcache", + "title": "shimcache", + "htmlId": "table--shimcache--bbe2a80661", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "shimcache", + "entry", + "execution_flag", + "modified_time", + "path" + ], + "sectionRelativeRepoPath": "shimcache", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shimcache.yml" + }, + { + "url": "/tables/signature", + "title": "signature", + "htmlId": "table--signature--5b4399a6ce", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "signature", + "arch", + "authority", + "cdhash", + "hash_resources", + "identifier", + "path", + "signed", + "team_identifier" + ], + "sectionRelativeRepoPath": "signature", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/signature.yml" + }, + { + "url": "/tables/sip_config", + "title": "sip_config", + "htmlId": "table--sipconfig--2a1b4b38a7", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "sip_config", + "config_flag", + "enabled", + "enabled_nvram" + ], + "sectionRelativeRepoPath": "sip_config", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sip_config.yml" + }, + { + "url": "/tables/smbios_tables", + "title": "smbios_tables", + "htmlId": "table--smbiostables--e819efcca9", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "smbios_tables", + "description", + "handle", + "header_size", + "md5", + "number", + "size", + "type" + ], + "sectionRelativeRepoPath": "smbios_tables", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/smbios_tables.yml" + }, + { + "url": "/tables/smc_keys", + "title": "smc_keys", + "htmlId": "table--smckeys--1093645ab1", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "smc_keys", + "hidden", + "key", + "size", + "type", + "value" + ], + "sectionRelativeRepoPath": "smc_keys", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/smc_keys.yml" + }, + { + "url": "/tables/sntp_request", + "title": "sntp_request", + "htmlId": "table--sntprequest--90e80230b2", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "sntp_request", + "clock_offset_ms", + "server", + "timestamp_ms" + ], + "sectionRelativeRepoPath": "sntp_request", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sntp_request.yml" + }, + { + "url": "/tables/socket_events", + "title": "socket_events", + "htmlId": "table--socketevents--6bcd868d03", + "evented": true, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "socket_events", + "action", + "auid", + "eid", + "family", + "fd", + "local_address", + "local_port", + "path", + "pid", + "protocol", + "remote_address", + "remote_port", + "socket", + "status", + "success", + "time", + "uptime" + ], + "sectionRelativeRepoPath": "socket_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsocket_events.yml&value=name%3A%20socket_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/sofa_security_release_info", + "title": "sofa_security_release_info", + "htmlId": "table--sofasecurityreleaseinfo--50c9037b36", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "sofa_security_release_info", + "days_since_previous_release", + "os_version", + "product_version", + "release_date", + "security_info", + "unique_cves_count", + "update_name" + ], + "sectionRelativeRepoPath": "sofa_security_release_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sofa_security_release_info.yml" + }, + { + "url": "/tables/sofa_unpatched_cves", + "title": "sofa_unpatched_cves", + "htmlId": "table--sofaunpatchedcves--7e2cd697a3", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "sofa_unpatched_cves", + "actively_exploited", + "cve", + "os_version", + "patched_version" + ], + "sectionRelativeRepoPath": "sofa_unpatched_cves", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sofa_unpatched_cves.yml" + }, + { + "url": "/tables/software_update", + "title": "software_update", + "htmlId": "table--softwareupdate--e41de55074", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "software_update", + "software_update_required" + ], + "sectionRelativeRepoPath": "software_update", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml" + }, + { + "url": "/tables/ssh_configs", + "title": "ssh_configs", + "htmlId": "table--sshconfigs--0ac7f772f2", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "ssh_configs", + "block", + "option", + "ssh_config_file", + "uid" + ], + "sectionRelativeRepoPath": "ssh_configs", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ssh_configs.yml" + }, + { + "url": "/tables/startup_items", + "title": "startup_items", + "htmlId": "table--startupitems--01c26852c3", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "startup_items", + "args", + "name", + "path", + "source", + "status", + "type", + "username" + ], + "sectionRelativeRepoPath": "startup_items", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/startup_items.yml" + }, + { + "url": "/tables/sudo_info", + "title": "sudo_info", + "htmlId": "table--sudoinfo--9e3e5840b9", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "sudo_info", + "json_result" + ], + "sectionRelativeRepoPath": "sudo_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sudo_info.yml" + }, + { + "url": "/tables/sudoers", + "title": "sudoers", + "htmlId": "table--sudoers--41d65ef3de", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "sudoers", + "header", + "rule_details", + "source" + ], + "sectionRelativeRepoPath": "sudoers", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sudoers.yml" + }, + { + "url": "/tables/suid_bin", + "title": "suid_bin", + "htmlId": "table--suidbin--a9aecacdf7", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "suid_bin", + "groupname", + "path", + "permissions", + "pid_with_namespace", + "username" + ], + "sectionRelativeRepoPath": "suid_bin", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/suid_bin.yml" + }, + { + "url": "/tables/syslog_events", + "title": "syslog_events", + "htmlId": "table--syslogevents--f1e81ac053", + "evented": true, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "syslog_events", + "datetime", + "eid", + "facility", + "host", + "message", + "severity", + "tag", + "time" + ], + "sectionRelativeRepoPath": "syslog_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsyslog_events.yml&value=name%3A%20syslog_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/system_controls", + "title": "system_controls", + "htmlId": "table--systemcontrols--4fb24f6308", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "system_controls", + "config_value", + "current_value", + "field_name", + "name", + "oid", + "subsystem", + "type" + ], + "sectionRelativeRepoPath": "system_controls", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_controls.yml" + }, + { + "url": "/tables/system_extensions", + "title": "system_extensions", + "htmlId": "table--systemextensions--c6bb0fcfb3", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "system_extensions", + "UUID", + "bundle_path", + "category", + "identifier", + "mdm_managed", + "path", + "state", + "team", + "version" + ], + "sectionRelativeRepoPath": "system_extensions", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_extensions.yml" + }, + { + "url": "/tables/system_info", + "title": "system_info", + "htmlId": "table--systeminfo--8d74915f82", + "evented": false, + "platforms": [ + "windows", + "darwin", + "linux", + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "system_info", + "board_model", + "board_serial", + "board_vendor", + "board_version", + "computer_name", + "cpu_brand", + "cpu_logical_cores", + "cpu_microcode", + "cpu_physical_cores", + "cpu_sockets", + "cpu_subtype", + "cpu_type", + "hardware_model", + "hardware_serial", + "hardware_vendor", + "hardware_version", + "hostname", + "local_hostname", + "physical_memory", + "uuid" + ], + "sectionRelativeRepoPath": "system_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_info.yml" + }, + { + "url": "/tables/system_state", + "title": "system_state", + "htmlId": "table--systemstate--6c03b60c4f", + "evented": false, + "platforms": [ + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "system_state", + "idle_state" + ], + "sectionRelativeRepoPath": "system_state", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_state.yml" + }, + { + "url": "/tables/systemd_units", + "title": "systemd_units", + "htmlId": "table--systemdunits--92e872ddbb", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "systemd_units", + "active_state", + "description", + "following", + "fragment_path", + "id", + "job_id", + "job_path", + "job_type", + "load_state", + "object_path", + "source_path", + "sub_state", + "unit_file_state", + "user" + ], + "sectionRelativeRepoPath": "systemd_units", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsystemd_units.yml&value=name%3A%20systemd_units%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/tcc_access", + "title": "tcc_access", + "htmlId": "table--tccaccess--8a475d4133", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "tcc_access", + "auth_reason", + "auth_value", + "client", + "client_type", + "indirect_object_identifier", + "indirect_object_identifier_type", + "last_modified", + "policy_id", + "service", + "source", + "uid" + ], + "sectionRelativeRepoPath": "tcc_access", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/tcc_access.yml" + }, + { + "url": "/tables/temperature_sensors", + "title": "temperature_sensors", + "htmlId": "table--temperaturesensors--94b32a5c69", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "temperature_sensors", + "celsius", + "fahrenheit", + "key", + "name" + ], + "sectionRelativeRepoPath": "temperature_sensors", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/temperature_sensors.yml" + }, + { + "url": "/tables/time", + "title": "time", + "htmlId": "table--time--1b3592cfa3", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "time", + "datetime", + "day", + "hour", + "iso_8601", + "local_timezone", + "minutes", + "month", + "seconds", + "timestamp", + "timezone", + "unix_time", + "weekday", + "win_timestamp", + "year" + ], + "sectionRelativeRepoPath": "time", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time.yml" + }, + { + "url": "/tables/time_machine_backups", + "title": "time_machine_backups", + "htmlId": "table--timemachinebackups--de33aefff1", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "time_machine_backups", + "backup_date", + "destination_id" + ], + "sectionRelativeRepoPath": "time_machine_backups", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time_machine_backups.yml" + }, + { + "url": "/tables/time_machine_destinations", + "title": "time_machine_destinations", + "htmlId": "table--timemachinedestinations--539b98ee91", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "time_machine_destinations", + "alias", + "bytes_available", + "bytes_used", + "consistency_scan_date", + "destination_id", + "encryption", + "root_volume_uuid" + ], + "sectionRelativeRepoPath": "time_machine_destinations", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time_machine_destinations.yml" + }, + { + "url": "/tables/tpm_info", + "title": "tpm_info", + "htmlId": "table--tpminfo--396d9c578b", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "tpm_info", + "activated", + "enabled", + "manufacturer_id", + "manufacturer_name", + "manufacturer_version", + "owned", + "physical_presence_version", + "product_name", + "spec_version" + ], + "sectionRelativeRepoPath": "tpm_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Ftpm_info.yml&value=name%3A%20tpm_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/ulimit_info", + "title": "ulimit_info", + "htmlId": "table--ulimitinfo--5a239b79bc", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "ulimit_info", + "hard_limit", + "soft_limit", + "type" + ], + "sectionRelativeRepoPath": "ulimit_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ulimit_info.yml" + }, + { + "url": "/tables/unified_log", + "title": "unified_log", + "htmlId": "table--unifiedlog--9794c5d6f5", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "unified_log", + "activity", + "category", + "level", + "max_rows", + "message", + "pid", + "predicate", + "process", + "sender", + "storage", + "subsystem", + "tid", + "timestamp" + ], + "sectionRelativeRepoPath": "unified_log", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Funified_log.yml&value=name%3A%20unified_log%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/uptime", + "title": "uptime", + "htmlId": "table--uptime--c4c605e6c3", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "uptime", + "days", + "hours", + "minutes", + "seconds", + "total_seconds" + ], + "sectionRelativeRepoPath": "uptime", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/uptime.yml" + }, + { + "url": "/tables/usb_devices", + "title": "usb_devices", + "htmlId": "table--usbdevices--34406afdaf", + "evented": false, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "usb_devices", + "class", + "model", + "model_id", + "protocol", + "removable", + "serial", + "subclass", + "usb_address", + "usb_port", + "vendor", + "vendor_id", + "version" + ], + "sectionRelativeRepoPath": "usb_devices", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/usb_devices.yml" + }, + { + "url": "/tables/user_events", + "title": "user_events", + "htmlId": "table--userevents--79413d7f5c", + "evented": true, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "user_events", + "address", + "auid", + "eid", + "message", + "path", + "pid", + "terminal", + "time", + "type", + "uid", + "uptime" + ], + "sectionRelativeRepoPath": "user_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fuser_events.yml&value=name%3A%20user_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/user_groups", + "title": "user_groups", + "htmlId": "table--usergroups--76a18355bd", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "user_groups", + "gid", + "uid" + ], + "sectionRelativeRepoPath": "user_groups", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fuser_groups.yml&value=name%3A%20user_groups%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/user_interaction_events", + "title": "user_interaction_events", + "htmlId": "table--userinteractionevents--1810ff3487", + "evented": true, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "user_interaction_events", + "time" + ], + "sectionRelativeRepoPath": "user_interaction_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fuser_interaction_events.yml&value=name%3A%20user_interaction_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/user_login_settings", + "title": "user_login_settings", + "htmlId": "table--userloginsettings--f880540fae", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "user_login_settings", + "password_hint_enabled" + ], + "sectionRelativeRepoPath": "user_login_settings", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/user_login_settings.yml" + }, + { + "url": "/tables/user_ssh_keys", + "title": "user_ssh_keys", + "htmlId": "table--usersshkeys--538ec922b6", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "user_ssh_keys", + "encrypted", + "key_type", + "path", + "pid_with_namespace", + "uid" + ], + "sectionRelativeRepoPath": "user_ssh_keys", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/user_ssh_keys.yml" + }, + { + "url": "/tables/userassist", + "title": "userassist", + "htmlId": "table--userassist--08542b9d51", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "userassist", + "count", + "last_execution_time", + "path", + "sid" + ], + "sectionRelativeRepoPath": "userassist", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/userassist.yml" + }, + { + "url": "/tables/users", + "title": "users", + "htmlId": "table--users--e74270fb84", + "evented": false, + "platforms": [ + "darwin", + "windows", + "linux", + "chrome" + ], + "keywordsForSyntaxHighlighting": [ + "users", + "description", + "directory", + "email", + "gid", + "gid_signed", + "is_hidden", + "pid_with_namespace", + "shell", + "type", + "uid", + "uid_signed", + "username", + "uuid" + ], + "sectionRelativeRepoPath": "users", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/users.yml" + }, + { + "url": "/tables/video_info", + "title": "video_info", + "htmlId": "table--videoinfo--9eb3ce33ac", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "video_info", + "color_depth", + "driver", + "driver_date", + "driver_version", + "manufacturer", + "model", + "series", + "video_mode" + ], + "sectionRelativeRepoPath": "video_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fvideo_info.yml&value=name%3A%20video_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/virtual_memory_info", + "title": "virtual_memory_info", + "htmlId": "table--virtualmemoryinfo--93cc423397", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "virtual_memory_info", + "active", + "anonymous", + "compressed", + "compressor", + "copy", + "decompressed", + "faults", + "file_backed", + "free", + "inactive", + "page_ins", + "page_outs", + "purgeable", + "purged", + "reactivated", + "speculative", + "swap_ins", + "swap_outs", + "throttled", + "uncompressed", + "wired", + "zero_fill" + ], + "sectionRelativeRepoPath": "virtual_memory_info", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/virtual_memory_info.yml" + }, + { + "url": "/tables/vscode_extensions", + "title": "vscode_extensions", + "htmlId": "table--vscodeextensions--2737d7de85", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "vscode_extensions", + "installed_at", + "name", + "path", + "prerelease", + "publisher", + "publisher_id", + "uid", + "uuid", + "version" + ], + "sectionRelativeRepoPath": "vscode_extensions", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/vscode_extensions.yml" + }, + { + "url": "/tables/wifi_networks", + "title": "wifi_networks", + "htmlId": "table--wifinetworks--dbf9e8c630", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "wifi_networks", + "add_reason", + "added_at", + "auto_join", + "auto_login", + "captive_login_date", + "captive_portal", + "disabled", + "last_connected", + "network_name", + "passpoint", + "personal_hotspot", + "possibly_hidden", + "roaming", + "roaming_profile", + "security_type", + "ssid", + "temporarily_disabled", + "was_captive_network" + ], + "sectionRelativeRepoPath": "wifi_networks", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_networks.yml" + }, + { + "url": "/tables/wifi_status", + "title": "wifi_status", + "htmlId": "table--wifistatus--f420ee60fb", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "wifi_status", + "bssid", + "channel", + "channel_band", + "channel_width", + "country_code", + "interface", + "mode", + "network_name", + "noise", + "rssi", + "security_type", + "ssid", + "transmit_rate" + ], + "sectionRelativeRepoPath": "wifi_status", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_status.yml" + }, + { + "url": "/tables/wifi_survey", + "title": "wifi_survey", + "htmlId": "table--wifisurvey--78509e80b7", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "wifi_survey", + "bssid", + "channel", + "channel_band", + "channel_width", + "country_code", + "interface", + "network_name", + "noise", + "rssi", + "ssid" + ], + "sectionRelativeRepoPath": "wifi_survey", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_survey.yml" + }, + { + "url": "/tables/winbaseobj", + "title": "winbaseobj", + "htmlId": "table--winbaseobj--880aabbcbb", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "winbaseobj", + "object_name", + "object_type", + "session_id" + ], + "sectionRelativeRepoPath": "winbaseobj", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwinbaseobj.yml&value=name%3A%20winbaseobj%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/windows_crashes", + "title": "windows_crashes", + "htmlId": "table--windowscrashes--2e304082e6", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "windows_crashes", + "build_number", + "command_line", + "crash_path", + "current_directory", + "datetime", + "exception_address", + "exception_code", + "exception_message", + "machine_name", + "major_version", + "minor_version", + "module", + "path", + "pid", + "process_uptime", + "registers", + "stack_trace", + "tid", + "type", + "username", + "version" + ], + "sectionRelativeRepoPath": "windows_crashes", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_crashes.yml&value=name%3A%20windows_crashes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/windows_eventlog", + "title": "windows_eventlog", + "htmlId": "table--windowseventlog--a5b61bb092", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "windows_eventlog", + "channel", + "computer_name", + "data", + "datetime", + "eventid", + "keywords", + "level", + "pid", + "provider_guid", + "provider_name", + "task", + "tid", + "time_range", + "timestamp", + "xpath" + ], + "sectionRelativeRepoPath": "windows_eventlog", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_eventlog.yml" + }, + { + "url": "/tables/windows_events", + "title": "windows_events", + "htmlId": "table--windowsevents--fe0564c923", + "evented": true, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "windows_events", + "computer_name", + "data", + "datetime", + "eid", + "eventid", + "keywords", + "level", + "provider_guid", + "provider_name", + "source", + "task", + "time" + ], + "sectionRelativeRepoPath": "windows_events", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_events.yml&value=name%3A%20windows_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/windows_firewall_rules", + "title": "windows_firewall_rules", + "htmlId": "table--windowsfirewallrules--03777ff61f", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "windows_firewall_rules", + "action", + "app_name", + "direction", + "enabled", + "grouping", + "icmp_types_codes", + "local_addresses", + "local_ports", + "name", + "profile_domain", + "profile_private", + "profile_public", + "protocol", + "remote_addresses", + "remote_ports", + "service_name" + ], + "sectionRelativeRepoPath": "windows_firewall_rules", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_firewall_rules.yml" + }, + { + "url": "/tables/windows_optional_features", + "title": "windows_optional_features", + "htmlId": "table--windowsoptionalfeatures--551b5e1d80", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "windows_optional_features", + "caption", + "name", + "state", + "statename" + ], + "sectionRelativeRepoPath": "windows_optional_features", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_optional_features.yml" + }, + { + "url": "/tables/windows_search", + "title": "windows_search", + "htmlId": "table--windowssearch--aecbd5584f", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "windows_search", + "additional_properties", + "date_created", + "date_modified", + "max_results", + "name", + "owner", + "path", + "properties", + "query", + "size", + "sort", + "type" + ], + "sectionRelativeRepoPath": "windows_search", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_search.yml&value=name%3A%20windows_search%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/windows_security_center", + "title": "windows_security_center", + "htmlId": "table--windowssecuritycenter--9e610c0b00", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "windows_security_center", + "antispyware", + "antivirus", + "autoupdate", + "firewall", + "internet_settings", + "user_account_control", + "windows_security_center_service" + ], + "sectionRelativeRepoPath": "windows_security_center", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_security_center.yml&value=name%3A%20windows_security_center%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/windows_security_products", + "title": "windows_security_products", + "htmlId": "table--windowssecurityproducts--9c04a14fbe", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "windows_security_products", + "name", + "remediation_path", + "signatures_up_to_date", + "state", + "state_timestamp", + "type" + ], + "sectionRelativeRepoPath": "windows_security_products", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_security_products.yml&value=name%3A%20windows_security_products%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/windows_update_history", + "title": "windows_update_history", + "htmlId": "table--windowsupdatehistory--39d94868df", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "windows_update_history", + "client_app_id", + "date", + "description", + "hresult", + "operation", + "result_code", + "server_selection", + "service_id", + "support_url", + "title", + "update_id", + "update_revision" + ], + "sectionRelativeRepoPath": "windows_update_history", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_update_history.yml&value=name%3A%20windows_update_history%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/windows_updates", + "title": "windows_updates", + "htmlId": "table--windowsupdates--002065ccf3", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "windows_updates", + "fullkey", + "is_default", + "key", + "locale", + "parent", + "query", + "value" + ], + "sectionRelativeRepoPath": "windows_updates", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_updates.yml" + }, + { + "url": "/tables/wmi_bios_info", + "title": "wmi_bios_info", + "htmlId": "table--wmibiosinfo--5a34e0ddaf", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "wmi_bios_info", + "name", + "value" + ], + "sectionRelativeRepoPath": "wmi_bios_info", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_bios_info.yml&value=name%3A%20wmi_bios_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/wmi_cli_event_consumers", + "title": "wmi_cli_event_consumers", + "htmlId": "table--wmiclieventconsumers--bba3dde014", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "wmi_cli_event_consumers", + "class", + "command_line_template", + "executable_path", + "name", + "relative_path" + ], + "sectionRelativeRepoPath": "wmi_cli_event_consumers", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_cli_event_consumers.yml&value=name%3A%20wmi_cli_event_consumers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/wmi_event_filters", + "title": "wmi_event_filters", + "htmlId": "table--wmieventfilters--2f3af06452", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "wmi_event_filters", + "class", + "name", + "query", + "query_language", + "relative_path" + ], + "sectionRelativeRepoPath": "wmi_event_filters", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_event_filters.yml&value=name%3A%20wmi_event_filters%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/wmi_filter_consumer_binding", + "title": "wmi_filter_consumer_binding", + "htmlId": "table--wmifilterconsumerbinding--9eaa6581a1", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "wmi_filter_consumer_binding", + "class", + "consumer", + "filter", + "relative_path" + ], + "sectionRelativeRepoPath": "wmi_filter_consumer_binding", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_filter_consumer_binding.yml&value=name%3A%20wmi_filter_consumer_binding%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/wmi_script_event_consumers", + "title": "wmi_script_event_consumers", + "htmlId": "table--wmiscripteventconsumers--36a6a2005c", + "evented": false, + "platforms": [ + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "wmi_script_event_consumers", + "class", + "name", + "relative_path", + "script_file_name", + "script_text", + "scripting_engine" + ], + "sectionRelativeRepoPath": "wmi_script_event_consumers", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_script_event_consumers.yml&value=name%3A%20wmi_script_event_consumers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/xprotect_entries", + "title": "xprotect_entries", + "htmlId": "table--xprotectentries--a7e094d93d", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "xprotect_entries", + "filename", + "filetype", + "identity", + "launch_type", + "name", + "optional", + "uses_pattern" + ], + "sectionRelativeRepoPath": "xprotect_entries", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_entries.yml" + }, + { + "url": "/tables/xprotect_meta", + "title": "xprotect_meta", + "htmlId": "table--xprotectmeta--5e905ccfd7", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "xprotect_meta", + "developer_id", + "identifier", + "min_version", + "type" + ], + "sectionRelativeRepoPath": "xprotect_meta", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_meta.yml" + }, + { + "url": "/tables/xprotect_reports", + "title": "xprotect_reports", + "htmlId": "table--xprotectreports--d55daafb4a", + "evented": false, + "platforms": [ + "darwin" + ], + "keywordsForSyntaxHighlighting": [ + "xprotect_reports", + "name", + "time", + "user_action" + ], + "sectionRelativeRepoPath": "xprotect_reports", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_reports.yml" + }, + { + "url": "/tables/yara", + "title": "yara", + "htmlId": "table--yara--6473c921d1", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "yara", + "count", + "matches", + "path", + "pid_with_namespace", + "sig_group", + "sigfile", + "sigrule", + "sigurl", + "strings", + "tags" + ], + "sectionRelativeRepoPath": "yara", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yara.yml" + }, + { + "url": "/tables/yara_events", + "title": "yara_events", + "htmlId": "table--yaraevents--8757715056", + "evented": true, + "platforms": [ + "darwin", + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "yara_events", + "action", + "category", + "count", + "eid", + "matches", + "strings", + "tags", + "target_path", + "time", + "transaction_id" + ], + "sectionRelativeRepoPath": "yara_events", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yara_events.yml" + }, + { + "url": "/tables/ycloud_instance_metadata", + "title": "ycloud_instance_metadata", + "htmlId": "table--ycloudinstancemetadata--3716d6f478", + "evented": false, + "platforms": [ + "darwin", + "linux", + "windows" + ], + "keywordsForSyntaxHighlighting": [ + "ycloud_instance_metadata", + "cloud_id", + "description", + "folder_id", + "hostname", + "instance_id", + "metadata_endpoint", + "name", + "serial_port_enabled", + "ssh_public_key", + "zone" + ], + "sectionRelativeRepoPath": "ycloud_instance_metadata", + "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fycloud_instance_metadata.yml&value=name%3A%20ycloud_instance_metadata%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." + }, + { + "url": "/tables/yum_sources", + "title": "yum_sources", + "htmlId": "table--yumsources--df3b0957df", + "evented": false, + "platforms": [ + "linux" + ], + "keywordsForSyntaxHighlighting": [ + "yum_sources", + "baseurl", + "enabled", + "gpgcheck", + "gpgkey", + "mirrorlist", + "name", + "pid_with_namespace" + ], + "sectionRelativeRepoPath": "yum_sources", + "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yum_sources.yml" + } + ], + "appLibrary": [ + { + "identifier": "cloudflare-warp", + "bundleIdentifier": "com.cloudflare.1dot1dot1dot1.macos", + "installerFormat": "pkg", + "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.cloudflare.1dot1dot1dot1.macos.loginlauncherapp' && remove_launchctl_service 'com.cloudflare.1dot1dot1dot1.macos.warp.daemon' && quit_application 'com.cloudflare.1dot1dot1dot1.macos' && sudo pkgutil --forget 'com.cloudflare.1dot1dot1dot1.macos' && /Applications/Cloudflare\\ WARP.app/Contents/Resources/uninstall.sh && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.cloudflare.1dot1dot1dot1.macos.loginlauncherapp' && trash $LOGGED_IN_USER '~/Library/Application Support/com.cloudflare.1dot1dot1dot1.macos' && trash $LOGGED_IN_USER '~/Library/Caches/com.cloudflare.1dot1dot1dot1.macos' && trash $LOGGED_IN_USER '~/Library/Caches/com.plausiblelabs.crashreporter.data/com.cloudflare.1dot1dot1dot1.macos' && trash $LOGGED_IN_USER '~/Library/Containers/com.cloudflare.1dot1dot1dot1.macos.loginlauncherapp' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.cloudflare.1dot1dot1dot1.macos' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.cloudflare.1dot1dot1dot1.macos.binarycookies' && trash $LOGGED_IN_USER '~/Library/Preferences/com.cloudflare.1dot1dot1dot1.macos.plist'", + "version": "2024.6.474.0", + "description": "Free app that makes your Internet safer", + "name": "Cloudflare WARP" + }, + { + "identifier": "brave-browser", + "bundleIdentifier": "com.brave.Browser", + "installerFormat": "dmg:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/Brave Browser.app\" && trash $LOGGED_IN_USER '~/Library/Application Support/BraveSoftware' && trash $LOGGED_IN_USER '~/Library/Caches/BraveSoftware' && trash $LOGGED_IN_USER '~/Library/Caches/com.brave.Browser' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.brave.Browser' && trash $LOGGED_IN_USER '~/Library/Preferences/com.brave.Browser.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.brave.Browser.savedState'", + "version": "1.69.162.0", + "description": "Web browser focusing on privacy", + "name": "Brave" + }, + { + "identifier": "firefox", + "bundleIdentifier": "org.mozilla.firefox", + "installerFormat": "dmg:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && quit_application 'org.mozilla.firefox' && sudo rm -rf \"$APPDIR/Firefox.app\" && sudo rm -rf 'firefox' && sudo rmdir '~/Library/Application Support/Mozilla' && sudo rmdir '~/Library/Caches/Mozilla' && sudo rmdir '~/Library/Caches/Mozilla/updates' && sudo rmdir '~/Library/Caches/Mozilla/updates/Applications' && trash $LOGGED_IN_USER '/Library/Logs/DiagnosticReports/firefox_*' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/org.mozilla.firefox.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/CrashReporter/firefox_*' && trash $LOGGED_IN_USER '~/Library/Application Support/Firefox' && trash $LOGGED_IN_USER '~/Library/Caches/Firefox' && trash $LOGGED_IN_USER '~/Library/Caches/Mozilla/updates/Applications/Firefox' && trash $LOGGED_IN_USER '~/Library/Caches/org.mozilla.crashreporter' && trash $LOGGED_IN_USER '~/Library/Caches/org.mozilla.firefox' && trash $LOGGED_IN_USER '~/Library/Preferences/org.mozilla.crashreporter.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/org.mozilla.firefox.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/org.mozilla.firefox.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/org.mozilla.firefox'", + "version": "130.0", + "description": "Web browser", + "name": "Mozilla Firefox" + }, + { + "identifier": "figma", + "bundleIdentifier": "com.figma.Desktop", + "installerFormat": "zip:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/Figma.app\" && trash $LOGGED_IN_USER '~/Library/Application Support/Figma' && trash $LOGGED_IN_USER '~/Library/Application Support/figma-desktop' && trash $LOGGED_IN_USER '~/Library/Caches/com.figma.agent' && trash $LOGGED_IN_USER '~/Library/Caches/com.figma.Desktop' && trash $LOGGED_IN_USER '~/Library/Preferences/com.figma.Desktop.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.figma.Desktop.savedState'", + "version": "124.3.2", + "description": "Collaborative team software", + "name": "Figma" + }, + { + "identifier": "google-chrome", + "bundleIdentifier": "com.google.Chrome", + "installerFormat": "dmg:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/Google Chrome.app\" && remove_launchctl_service 'com.google.keystone.agent' && remove_launchctl_service 'com.google.keystone.daemon' && sudo rmdir '/Library/Google' && sudo rmdir '~/Library/Application Support/Google' && sudo rmdir '~/Library/Caches/Google' && sudo rmdir '~/Library/Google' && trash $LOGGED_IN_USER '/Library/Caches/com.google.SoftwareUpdate.*' && trash $LOGGED_IN_USER '/Library/Google/Google Chrome Brand.plist' && trash $LOGGED_IN_USER '/Library/Google/GoogleSoftwareUpdate' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.google.chrome.app.*.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.google.chrome.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/Google/Chrome' && trash $LOGGED_IN_USER '~/Library/Caches/com.google.Chrome' && trash $LOGGED_IN_USER '~/Library/Caches/com.google.Chrome.helper.*' && trash $LOGGED_IN_USER '~/Library/Caches/com.google.Keystone' && trash $LOGGED_IN_USER '~/Library/Caches/com.google.Keystone.Agent' && trash $LOGGED_IN_USER '~/Library/Caches/com.google.SoftwareUpdate' && trash $LOGGED_IN_USER '~/Library/Caches/Google/Chrome' && trash $LOGGED_IN_USER '~/Library/Google/Google Chrome Brand.plist' && trash $LOGGED_IN_USER '~/Library/Google/GoogleSoftwareUpdate' && trash $LOGGED_IN_USER '~/Library/LaunchAgents/com.google.keystone.agent.plist' && trash $LOGGED_IN_USER '~/Library/LaunchAgents/com.google.keystone.xpcservice.plist' && trash $LOGGED_IN_USER '~/Library/Logs/GoogleSoftwareUpdateAgent.log' && trash $LOGGED_IN_USER '~/Library/Preferences/com.google.Chrome.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.google.Keystone.Agent.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.google.Chrome.app.*.savedState' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.google.Chrome.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/com.google.Chrome'", + "version": "128.0.6613.120", + "description": "Web browser", + "name": "Google Chrome" + }, + { + "identifier": "microsoft-excel", + "bundleIdentifier": "com.microsoft.Excel", + "installerFormat": "pkg", + "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.microsoft.office.licensingV2.helper' && quit_application 'com.microsoft.autoupdate2' && sudo pkgutil --forget 'com.microsoft.package.Microsoft_Excel.app' && sudo pkgutil --forget 'com.microsoft.pkg.licensing' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.Excel' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.microsoft.excel.sfl*' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.Excel' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.Excel' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.Excel.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.Excel.savedState' && trash $LOGGED_IN_USER '~/Library/Webkit/com.microsoft.Excel'", + "version": "16.88.24081116", + "description": "Spreadsheet software", + "name": "Microsoft Excel" + }, + { + "identifier": "microsoft-edge", + "bundleIdentifier": "com.microsoft.edgemac", + "installerFormat": "pkg", + "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.microsoft.EdgeUpdater.update-internal.109.0.1518.89.system' && remove_launchctl_service 'com.microsoft.EdgeUpdater.update.system' && remove_launchctl_service 'com.microsoft.EdgeUpdater.wake.system' && sudo pkgutil --forget 'com.microsoft.edgemac' && sudo rm -rf '/Library/Application Support/Microsoft/EdgeUpdater' && sudo rmdir '/Library/Application Support/Microsoft' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.edgemac.wdgExtension' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft Edge' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft/EdgeUpdater' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.edgemac' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.EdgeUpdater' && trash $LOGGED_IN_USER '~/Library/Caches/Microsoft Edge' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.edgemac.wdgExtension' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.microsoft.edge*' && trash $LOGGED_IN_USER '~/Library/LaunchAgents/com.microsoft.EdgeUpdater.*.plist' && trash $LOGGED_IN_USER '~/Library/Microsoft/EdgeUpdater' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.edgemac.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.edgemac.*' && trash $LOGGED_IN_USER '~/Library/WebKit/com.microsoft.edgemac'", + "version": "128.0.2739.67", + "description": "Web browser", + "name": "Microsoft Edge" + }, + { + "identifier": "microsoft-word", + "bundleIdentifier": "com.microsoft.Word", + "installerFormat": "pkg", + "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.microsoft.office.licensingV2.helper' && quit_application 'com.microsoft.autoupdate2' && sudo pkgutil --forget 'com.microsoft.package.Microsoft_Word.app' && sudo pkgutil --forget 'com.microsoft.pkg.licensing' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.Word' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.microsoft.word.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/CrashReporter/Microsoft Word_*.plist' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.Word' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.Word.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.Word.savedState'", + "version": "16.88.24081116", + "description": "Word processor", + "name": "Microsoft Word" + }, + { + "identifier": "box-drive", + "bundleIdentifier": "com.box.desktop", + "installerFormat": "pkg", + "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && (cd /Users/$LOGGED_IN_USER; sudo -u $LOGGED_IN_USER fileproviderctl domain remove -A com.box.desktop.boxfileprovider) && (cd /Users/$LOGGED_IN_USER; sudo -u $LOGGED_IN_USER /Applications/Box.app/Contents/MacOS/fpe/streem --remove-fpe-domain-and-archive-unsynced-content Box) && (cd /Users/$LOGGED_IN_USER; sudo -u $LOGGED_IN_USER /Applications/Box.app/Contents/MacOS/fpe/streem --remove-fpe-domain-and-preserve-unsynced-content Box) && (cd /Users/$LOGGED_IN_USER; defaults delete com.box.desktop) && echo \"${LOGGED_IN_USER} ALL = (root) NOPASSWD: /Library/Application\\ Support/Box/uninstall_box_drive_r\" >> /etc/sudoers.d/box_uninstall && remove_launchctl_service 'com.box.desktop.helper' && quit_application 'com.box.Box-Local-Com-Server' && quit_application 'com.box.desktop' && quit_application 'com.box.desktop.findersyncext' && quit_application 'com.box.desktop.helper' && quit_application 'com.box.desktop.ui' && (cd /Users/$LOGGED_IN_USER && sudo -u \"$LOGGED_IN_USER\" '/Library/Application Support/Box/uninstall_box_drive') && sudo pkgutil --forget 'com.box.desktop.installer.*' && rm /etc/sudoers.d/box_uninstall && trash $LOGGED_IN_USER '~/.Box_*' && trash $LOGGED_IN_USER '~/Library/Application Support/Box/Box' && trash $LOGGED_IN_USER '~/Library/Application Support/FileProvider/com.box.desktop.boxfileprovider' && trash $LOGGED_IN_USER '~/Library/Containers/com.box.desktop.findersyncext' && trash $LOGGED_IN_USER '~/Library/Logs/Box/Box' && trash $LOGGED_IN_USER '~/Library/Preferences/com.box.desktop.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.box.desktop.ui.plist'", + "version": "2.40.345", + "description": "Client for the Box cloud storage service", + "name": "Box Drive" + }, + { + "identifier": "microsoft-teams", + "bundleIdentifier": "com.microsoft.teams2", + "installerFormat": "pkg", + "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.microsoft.teams.TeamsUpdaterDaemon' && quit_application 'com.microsoft.autoupdate2' && sudo pkgutil --forget 'com.microsoft.MSTeamsAudioDevice' && sudo pkgutil --forget 'com.microsoft.package.Microsoft_AutoUpdate.app' && sudo pkgutil --forget 'com.microsoft.teams2' && sudo rm -rf '/Applications/Microsoft Teams.app' && sudo rm -rf '/Library/Application Support/Microsoft/TeamsUpdaterDaemon' && sudo rm -rf '/Library/Logs/Microsoft/MSTeams' && sudo rm -rf '/Library/Logs/Microsoft/Teams' && sudo rm -rf '/Library/Preferences/com.microsoft.teams.plist' && sudo rmdir '~/Library/Application Support/Microsoft' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.teams2' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.teams2.launcher' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.teams2.notificationcenter' && trash $LOGGED_IN_USER '~/Library/Application Support/com.microsoft.teams' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft/Teams' && trash $LOGGED_IN_USER '~/Library/Application Support/Teams' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.teams' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.teams2' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.teams2.launcher' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.teams2.notificationcenter' && trash $LOGGED_IN_USER '~/Library/Cookies/com.microsoft.teams.binarycookies' && trash $LOGGED_IN_USER '~/Library/Group Containers/*.com.microsoft.teams' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.microsoft.teams' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.microsoft.teams.binarycookies' && trash $LOGGED_IN_USER '~/Library/Logs/Microsoft Teams Helper (Renderer)' && trash $LOGGED_IN_USER '~/Library/Logs/Microsoft Teams' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.teams.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.teams.savedState' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.teams2.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/com.microsoft.teams'", + "version": "24215.1002.3039.5089", + "description": "Meet, chat, call, and collaborate in just one place", + "name": "Microsoft Teams" + }, + { + "identifier": "notion", + "bundleIdentifier": "notion.id", + "installerFormat": "dmg:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/Notion.app\" && trash $LOGGED_IN_USER '~/Library/Application Support/Caches/notion-updater' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/notion.id.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/Notion' && trash $LOGGED_IN_USER '~/Library/Caches/notion.id*' && trash $LOGGED_IN_USER '~/Library/Logs/Notion' && trash $LOGGED_IN_USER '~/Library/Preferences/ByHost/notion.id.*' && trash $LOGGED_IN_USER '~/Library/Preferences/notion.id.*' && trash $LOGGED_IN_USER '~/Library/Saved Application State/notion.id.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/notion.id'", + "version": "3.14.0", + "description": "App to write, plan, collaborate, and get organised", + "name": "Notion" + }, + { + "identifier": "slack", + "bundleIdentifier": "com.tinyspeck.slackmacgap", + "installerFormat": "dmg:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && quit_application 'com.tinyspeck.slackmacgap' && sudo rm -rf \"$APPDIR/Slack.app\" && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.tinyspeck.slackmacgap' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.tinyspeck.slackmacgap.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/Slack' && trash $LOGGED_IN_USER '~/Library/Caches/com.tinyspeck.slackmacgap*' && trash $LOGGED_IN_USER '~/Library/Containers/com.tinyspeck.slackmacgap*' && trash $LOGGED_IN_USER '~/Library/Cookies/com.tinyspeck.slackmacgap.binarycookies' && trash $LOGGED_IN_USER '~/Library/Group Containers/*.com.tinyspeck.slackmacgap' && trash $LOGGED_IN_USER '~/Library/Group Containers/*.slack' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.tinyspeck.slackmacgap*' && trash $LOGGED_IN_USER '~/Library/Logs/Slack' && trash $LOGGED_IN_USER '~/Library/Preferences/ByHost/com.tinyspeck.slackmacgap.ShipIt.*.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.tinyspeck.slackmacgap*' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.tinyspeck.slackmacgap.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/com.tinyspeck.slackmacgap'", + "version": "4.40.126", + "description": "Team communication and collaboration software", + "name": "Slack" + }, + { + "identifier": "teamviewer", + "bundleIdentifier": "com.teamviewer.TeamViewer", + "installerFormat": "pkg", + "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.teamviewer.desktop' && remove_launchctl_service 'com.teamviewer.Helper' && remove_launchctl_service 'com.teamviewer.service' && remove_launchctl_service 'com.teamviewer.teamviewer' && remove_launchctl_service 'com.teamviewer.teamviewer_desktop' && remove_launchctl_service 'com.teamviewer.teamviewer_service' && remove_launchctl_service 'com.teamviewer.UninstallerHelper' && remove_launchctl_service 'com.teamviewer.UninstallerWatcher' && quit_application 'com.teamviewer.TeamViewer' && quit_application 'com.teamviewer.TeamViewerUninstaller' && sudo pkgutil --forget 'com.teamviewer.AuthorizationPlugin' && sudo pkgutil --forget 'com.teamviewer.remoteaudiodriver' && sudo pkgutil --forget 'com.teamviewer.teamviewer.*' && sudo pkgutil --forget 'TeamViewerUninstaller' && sudo rm -rf '/Applications/TeamViewer.app' && sudo rm -rf '/Library/Preferences/com.teamviewer*' && trash $LOGGED_IN_USER '~/Library/Application Support/TeamViewer' && trash $LOGGED_IN_USER '~/Library/Caches/com.teamviewer.TeamViewer' && trash $LOGGED_IN_USER '~/Library/Caches/TeamViewer' && trash $LOGGED_IN_USER '~/Library/Cookies/com.teamviewer.TeamViewer.binarycookies' && trash $LOGGED_IN_USER '~/Library/Logs/TeamViewer' && trash $LOGGED_IN_USER '~/Library/Preferences/com.teamviewer*' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.teamviewer.TeamViewer.savedState'", + "version": "15.57.5", + "description": "Remote access and connectivity software focused on security", + "name": "TeamViewer" + }, + { + "identifier": "postman", + "bundleIdentifier": "com.postmanlabs.mac", + "installerFormat": "zip:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/Postman.app\" && trash $LOGGED_IN_USER '~/Library/Application Support/com.postmanlabs.mac.ShipIt' && trash $LOGGED_IN_USER '~/Library/Application Support/Postman' && trash $LOGGED_IN_USER '~/Library/Caches/com.postmanlabs.mac' && trash $LOGGED_IN_USER '~/Library/Caches/com.postmanlabs.mac.ShipIt' && trash $LOGGED_IN_USER '~/Library/Caches/Postman' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.postmanlabs.mac' && trash $LOGGED_IN_USER '~/Library/Preferences/ByHost/com.postmanlabs.mac.ShipIt.*.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.postmanlabs.mac.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.postmanlabs.mac.savedState'", + "version": "11.12.0", + "description": "Collaboration platform for API development", + "name": "Postman" + }, + { + "identifier": "visual-studio-code", + "bundleIdentifier": "com.microsoft.VSCode", + "installerFormat": "zip:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.microsoft.VSCode.ShipIt' && quit_application 'com.microsoft.VSCode' && sudo rm -rf \"$APPDIR/Visual Studio Code.app\" && trash $LOGGED_IN_USER '~/.vscode' && trash $LOGGED_IN_USER '~/Library/Application Support/Code' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.microsoft.vscode.sfl*' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.VSCode' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.VSCode.ShipIt' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.microsoft.VSCode' && trash $LOGGED_IN_USER '~/Library/Preferences/ByHost/com.microsoft.VSCode.ShipIt.*.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.VSCode.helper.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.VSCode.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.VSCode.savedState'", + "version": "1.93.0", + "description": "Open-source code editor", + "name": "Microsoft Visual Studio Code" + }, + { + "identifier": "whatsapp", + "bundleIdentifier": "net.whatsapp.WhatsApp", + "installerFormat": "zip:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/WhatsApp.app\" && trash $LOGGED_IN_USER '~/Library/Application Scripts/net.whatsapp.WhatsApp*' && trash $LOGGED_IN_USER '~/Library/Caches/net.whatsapp.WhatsApp' && trash $LOGGED_IN_USER '~/Library/Containers/net.whatsapp.WhatsApp*' && trash $LOGGED_IN_USER '~/Library/Group Containers/group.com.facebook.family' && trash $LOGGED_IN_USER '~/Library/Group Containers/group.net.whatsapp*' && trash $LOGGED_IN_USER '~/Library/Saved Application State/net.whatsapp.WhatsApp.savedState'", + "version": "2.24.16.80", + "description": "Native desktop client for WhatsApp", + "name": "WhatsApp" + }, + { + "identifier": "1password", + "bundleIdentifier": "com.1password.1password", + "installerFormat": "zip:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/1Password.app\" && trash $LOGGED_IN_USER '~/Library/Application Scripts/2BUA8C4S2C.com.1password*' && trash $LOGGED_IN_USER '~/Library/Application Scripts/2BUA8C4S2C.com.agilebits' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.1password.1password-launcher' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.1password.browser-support' && trash $LOGGED_IN_USER '~/Library/Application Support/1Password' && trash $LOGGED_IN_USER '~/Library/Application Support/Arc/User Data/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.1password.1password.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/CrashReporter/1Password*' && trash $LOGGED_IN_USER '~/Library/Application Support/Google/Chrome Beta/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Google/Chrome Canary/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Google/Chrome Dev/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft Edge Beta/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft Edge Canary/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft Edge Dev/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft Edge/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Mozilla/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Vivaldi/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Containers/2BUA8C4S2C.com.1password.browser-helper' && trash $LOGGED_IN_USER '~/Library/Containers/com.1password.1password*' && trash $LOGGED_IN_USER '~/Library/Containers/com.1password.browser-support' && trash $LOGGED_IN_USER '~/Library/Group Containers/2BUA8C4S2C.com.1password' && trash $LOGGED_IN_USER '~/Library/Group Containers/2BUA8C4S2C.com.agilebits' && trash $LOGGED_IN_USER '~/Library/Logs/1Password' && trash $LOGGED_IN_USER '~/Library/Preferences/com.1password.1password.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/group.com.1password.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.1password.1password.savedState'", + "version": "8.10.44", + "description": "Password manager that keeps all passwords secure behind one password", + "name": "1Password" + }, + { + "identifier": "adobe-acrobat-reader", + "bundleIdentifier": "com.adobe.Reader", + "installerFormat": "dmg:pkg", + "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.adobe.ARMDC.Communicator' && remove_launchctl_service 'com.adobe.ARMDC.SMJobBlessHelper' && remove_launchctl_service 'com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d' && quit_application 'com.adobe.AdobeRdrCEF' && quit_application 'com.adobe.AdobeRdrCEFHelper' && quit_application 'com.adobe.Reader' && sudo pkgutil --forget 'com.adobe.acrobat.DC.reader.*' && sudo pkgutil --forget 'com.adobe.armdc.app.pkg' && sudo pkgutil --forget 'com.adobe.RdrServicesUpdater' && sudo rm -rf '/Applications/Adobe Acrobat Reader.app' && sudo rm -rf '/Library/Preferences/com.adobe.reader.DC.WebResource.plist' && trash $LOGGED_IN_USER '~/Library/Caches/com.adobe.Reader' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.adobe.Reader.binarycookies' && trash $LOGGED_IN_USER '~/Library/Preferences/com.adobe.AdobeRdrCEFHelper.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.adobe.crashreporter.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.adobe.Reader.plist'", + "version": "24.002.21005", + "description": "View, print, and comment on PDF documents", + "name": "Adobe Acrobat Reader" + }, + { + "identifier": "zoom-for-it-admins", + "bundleIdentifier": "us.zoom.xos", + "installerFormat": "pkg", + "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && send_signal() { local signal=\"$1\"; local bundle_id=\"$2\"; local logged_in_user=\"$3\"; local logged_in_uid pids; if [ -z \"$signal\" ] || [ -z \"$bundle_id\" ] || [ -z \"$logged_in_user\" ]; then echo \"Usage: uninstall_signal \"; return 1 fi; logged_in_uid=$(id -u \"$logged_in_user\"); if [ -z \"$logged_in_uid\" ]; then echo \"Could not find UID for user '$logged_in_user'.\"; return 1 fi; echo \"Signalling '$signal' to application ID '$bundle_id' for user '$logged_in_user'\"; pids=$(/bin/launchctl asuser \"$logged_in_uid\" sudo -iu \"$logged_in_user\" /bin/launchctl list | awk -v bundle_id=\"$bundle_id\" '; $3 ~ bundle_id { print $1 }'); if [ -z \"$pids\" ]; then echo \"No processes found for bundle ID '$bundle_id'.\"; return 0 fi; echo \"Unix PIDs are $pids for processes with bundle identifier $bundle_id\"; for pid in $pids; do if kill -s \"$signal\" \"$pid\" 2>/dev/null; then echo \"Successfully signaled PID $pid with signal $signal.\"; else echo \"Failed to kill PID $pid with signal $signal. Check permissions.\"; fi; done sleep 3 } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'us.zoom.ZoomDaemon' && send_signal 'KILL' 'us.zoom.xos' \"$LOGGED_IN_USER\" && sudo pkgutil --forget 'us.zoom.pkg.videomeeting' && sudo rm -rf '/Applications/zoom.us.app' && sudo rm -rf '/Library/Audio/Plug-Ins/HAL/ZoomAudioDevice.driver' && sudo rm -rf '/Library/Internet Plug-Ins/ZoomUsPlugIn.plugin' && sudo rm -rf '/Library/Logs/DiagnosticReports/zoom.us*' && sudo rm -rf '/Library/PrivilegedHelperTools/us.zoom.ZoomDaemon' && trash $LOGGED_IN_USER '/Library/Preferences/us.zoom.config.plist' && trash $LOGGED_IN_USER '~/.zoomus' && trash $LOGGED_IN_USER '~/Desktop/Zoom' && trash $LOGGED_IN_USER '~/Documents/Zoom' && trash $LOGGED_IN_USER '~/Library/Application Scripts/*.ZoomClient3rd' && trash $LOGGED_IN_USER '~/Library/Application Support/CloudDocs/session/containers/iCloud.us.zoom.videomeetings' && trash $LOGGED_IN_USER '~/Library/Application Support/CloudDocs/session/containers/iCloud.us.zoom.videomeetings.plist' && trash $LOGGED_IN_USER '~/Library/Application Support/CrashReporter/zoom.us*' && trash $LOGGED_IN_USER '~/Library/Application Support/zoom.us' && trash $LOGGED_IN_USER '~/Library/Caches/us.zoom.xos' && trash $LOGGED_IN_USER '~/Library/Cookies/us.zoom.xos.binarycookies' && trash $LOGGED_IN_USER '~/Library/Group Containers/*.ZoomClient3rd' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/us.zoom.xos' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/us.zoom.xos.binarycookies' && trash $LOGGED_IN_USER '~/Library/Internet Plug-Ins/ZoomUsPlugIn.plugin' && trash $LOGGED_IN_USER '~/Library/Logs/zoom.us' && trash $LOGGED_IN_USER '~/Library/Logs/zoominstall.log' && trash $LOGGED_IN_USER '~/Library/Logs/ZoomPhone' && trash $LOGGED_IN_USER '~/Library/Mobile Documents/iCloud~us~zoom~videomeetings' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.airhost.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.caphost.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.Transcode.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.xos.Hotkey.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.xos.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.ZoomAutoUpdater.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/ZoomChat.plist' && trash $LOGGED_IN_USER '~/Library/Safari/PerSiteZoomPreferences.plist' && trash $LOGGED_IN_USER '~/Library/SafariTechnologyPreview/PerSiteZoomPreferences.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/us.zoom.xos.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/us.zoom.xos'", + "version": "6.2.11.43613", + "description": "Video communication and virtual meeting platform", + "name": "Zoom for IT Admins" + }, + { + "identifier": "docker", + "bundleIdentifier": "com.docker.docker", + "installerFormat": "dmg:app", + "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.docker.helper' && remove_launchctl_service 'com.docker.socket' && remove_launchctl_service 'com.docker.vmnetd' && quit_application 'com.docker.docker' && sudo rm -rf '/Library/PrivilegedHelperTools/com.docker.socket' && sudo rm -rf '/Library/PrivilegedHelperTools/com.docker.vmnetd' && sudo rmdir '~/.docker/bin' && sudo rm -rf \"$APPDIR/Docker.app\" && sudo rm -rf '/usr/local/bin/docker' && sudo rm -rf '/usr/local/bin/docker-credential-desktop' && sudo rm -rf '/usr/local/bin/docker-credential-ecr-login' && sudo rm -rf '/usr/local/bin/docker-credential-osxkeychain' && sudo rm -rf '/usr/local/bin/docker-index' && sudo rm -rf '/usr/local/bin/kubectl.docker' && sudo rm -rf '/usr/local/cli-plugins/docker-compose' && sudo rm -rf '/usr/local/bin/hub-tool' && sudo rmdir '~/Library/Caches/com.plausiblelabs.crashreporter.data' && sudo rmdir '~/Library/Caches/KSCrashReports' && trash $LOGGED_IN_USER '/usr/local/bin/docker-compose.backup' && trash $LOGGED_IN_USER '/usr/local/bin/docker.backup' && trash $LOGGED_IN_USER '~/.docker' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.docker.helper' && trash $LOGGED_IN_USER '~/Library/Application Scripts/group.com.docker' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.docker.helper.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.electron.dockerdesktop.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/com.bugsnag.Bugsnag/com.docker.docker' && trash $LOGGED_IN_USER '~/Library/Application Support/Docker Desktop' && trash $LOGGED_IN_USER '~/Library/Caches/com.docker.docker' && trash $LOGGED_IN_USER '~/Library/Caches/com.plausiblelabs.crashreporter.data/com.docker.docker' && trash $LOGGED_IN_USER '~/Library/Caches/KSCrashReports/Docker' && trash $LOGGED_IN_USER '~/Library/Containers/com.docker.docker' && trash $LOGGED_IN_USER '~/Library/Containers/com.docker.helper' && trash $LOGGED_IN_USER '~/Library/Group Containers/group.com.docker' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.docker.docker' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.docker.docker.binarycookies' && trash $LOGGED_IN_USER '~/Library/Logs/Docker Desktop' && trash $LOGGED_IN_USER '~/Library/Preferences/com.docker.docker.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.electron.docker-frontend.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.electron.dockerdesktop.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.electron.docker-frontend.savedState' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.electron.dockerdesktop.savedState'", + "version": "4.34.0", + "description": "App to build and share containerised applications and microservices", + "name": "Docker Desktop" + } + ], + "rituals": { + "handbook/engineering/engineering.rituals.yml": [ + { + "task": "Rotate the TUF root keys", + "startedOn": "2024-09-01", + "frequency": "Annually", + "description": "https://fleetdm.com/handbook/engineering/tuf#rotate-the-root-keys", + "moreInfoUrl": "https://fleetdm.com/handbook/engineering/tuf#rotate-the-root-keys", + "dri": "lukeheath", + "autoIssue": { + "labels": [ + "~engineering-initiated", + "P2" + ], + "repo": "fleet" + } + }, + { + "task": "Renew Apple certificate signing request (CSR)", + "startedOn": "2024-09-01", + "frequency": "Annually", + "description": "https://fleetdm.com/handbook/engineering#renew-mdm-certificate-signing-request-csr", + "moreInfoUrl": "https://fleetdm.com/handbook/engineering#renew-mdm-certificate-signing-request-csr", + "dri": "lukeheath", + "autoIssue": { + "labels": [ + "~engineering-initiated" + ], + "repo": "fleet" + } + }, + { + "task": "Oncall handoff", + "startedOn": "2023-08-09", + "frequency": "Weekly", + "description": "Hand off the oncall engineering responsibilities to the next oncall engineer.", + "moreInfoUrl": null, + "dri": "lukeheath" + }, + { + "task": "Vulnerability alerts (fleetdm.com)", + "startedOn": "2023-08-09", + "frequency": "Weekly", + "description": "Review and remediate or dismiss vulnerability alerts for the fleetdm.com codebase on GitHub.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/security", + "dri": "eashaw" + }, + { + "task": "Vulnerability alerts (frontend)", + "startedOn": "2023-08-09", + "frequency": "Weekly", + "description": "Review and remediate or dismiss vulnerability alerts for the Fleet frontend codebase (and related JS) on GitHub.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/security", + "dri": "lukeheath" + }, + { + "task": "Vulnerability alerts (backend)", + "startedOn": "2023-08-09", + "frequency": "Weekly", + "description": "Review and remediate or dismiss vulnerability alerts for the Fleet backend codebase (and all Go code) on GitHub.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/security", + "dri": "lukeheath" + }, + { + "task": "Release candidate ritual", + "startedOn": "2023-08-09", + "frequency": "Triweekly", + "description": "Go through the process of creating a release candidate.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/blob/main/tools/release/README.md#minor-release-typically-end-of-sprint", + "dri": "lukeheath" + }, + { + "task": "Release ritual", + "startedOn": "2023-08-09", + "frequency": "Triweekly", + "description": "Go through the process of releasing the next iteration of Fleet.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md", + "dri": "lukeheath" + }, + { + "task": "Create patch release branch", + "startedOn": "2023-08-09", + "frequency": "Every patch release", + "description": "Go through the process of creating a patch release branch, cherry picking commits, and pushing the branch to github.com/fleetdm/fleet.", + "moreInfoUrl": "https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md#patch-releases", + "dri": "lukeheath" + }, + { + "task": "Bug review", + "startedOn": "2023-08-09", + "frequency": "Weekly", + "description": "Review bugs that are in QA's inbox.", + "moreInfoUrl": "https://www.fleetdm.com/handbook/company/product-groups#inbox", + "dri": "xpkoala" + }, + { + "task": "QA report", + "startedOn": "2023-08-09", + "frequency": "Triweekly", + "description": "Every release cycle, on the Monday of release week, update the DRI for the release ritual on status of testing.", + "moreInfoUrl": null, + "dri": "xpkoala" + }, + { + "task": "Release QA", + "startedOn": "2023-08-09", + "frequency": "Triweekly", + "description": "Every release cycle, by end of day Friday of release week, move all issues to the ”✅ Ready for release” column on the #g-mdm and #g-endpoint-ops sprint boards.", + "moreInfoUrl": null, + "dri": "xpkoala" + }, + { + "task": "Review ongoing articles", + "startedOn": "2023-10-02", + "frequency": "Daily", + "description": "Check 📃 Planned articles and complete steps in each issue", + "moreInfoUrl": "https://fleetdm.com/handbook/demand#review-ongoing-articles", + "dri": "rachaelshaw" + } + ], + "handbook/finance/finance.rituals.yml": [ + { + "task": "Communicate the status of customer financial actions", + "startedOn": "2024-02-12", + "frequency": "Weekly", + "description": "At the start of every week, check the Salesforce reports for past due invoices, non-invoiced opportunities, and past due renewals. Report findings to in the `#g-sales` channel.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#communicate-the-status-of-customer-financial-actions", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "AP invoice monitoring", + "startedOn": "2024-04-01", + "frequency": "Weekly", + "description": "Look for new accounts payable invoices and make sure that Fleet's suppliers are paid.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#process-a-new-vendor-invoice", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Complete Finance KPI inputs", + "startedOn": "2024-02-16", + "frequency": "Weekly", + "description": "Create the weekly team KPI issue, complete the finance update.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#update-weekly-kpis", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Key review prep", + "startedOn": "2024-02-14", + "frequency": "Triweekly", + "description": "Prepare for this sprint's Key review meeting.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/leadership#key-reviews", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Prioritize for next sprint", + "startedOn": "2023-08-09", + "frequency": "Triweekly", + "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Reconcile monthly recurring expenses", + "startedOn": "2024-02-28", + "frequency": "Monthly", + "description": "Each month, update the inputs in “The numbers” spreadsheet to reflect the actuals for recurring non-personnel spend, and identify any unexpected increase or decrease in spend.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#reconcile-monthly-recurring-expenses", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Monthly accounting", + "startedOn": "2024-02-28", + "frequency": "Monthly", + "description": "Create the monthly close GitHub issue and walk through the steps. This process includes fulfilling the monthly reporting requirement for SVB.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#process-monthly-accounting", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Run regular payroll", + "startedOn": "2024-02-24", + "frequency": "Monthly", + "description": "Verify auto-populated payroll for all full time employees is accurate, and approve for processing.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-payroll", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Monthly mail review", + "startedOn": "2024-04-15", + "frequency": "Monthly", + "description": "Review and clear mail incurring storage fees", + "moreInfoUrl": null, + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Run US contractor payroll", + "startedOn": "2024-02-27", + "frequency": "Monthly", + "description": "Manually process US contractor payroll by verifying and syncing time contractor worked, then processing payment.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-us-contractor-payroll", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Run US commission payroll", + "startedOn": "2024-01-31", + "frequency": "Monthly", + "description": "Verify closed-won deal amounts, use commission calculators to determine commissions owed, and process payroll.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-us-commission-payroll", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Run bonus payroll", + "startedOn": "2024-01-31", + "frequency": "Quarterly", + "description": "Verify completion of any objective or outcome based bonus plans, and process payroll.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-us-commission-payroll", + "dri": "ireedy" + }, + { + "task": "Review state filings for the previous quarter", + "startedOn": "2024-07-19", + "frequency": "Quarterly", + "description": "Verify that state filings have been successfully submitted for the previous quarter", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#review-state-employment-tax-filings-for-the-previous-quarter", + "dri": "ireedy" + }, + { + "task": "Investor reporting", + "startedOn": "2024-03-31", + "frequency": "Quarterly", + "description": "Provide updated metrics for CRV in Chronograph.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#report-quarterly-numbers-in-chronograph", + "dri": "ireedy" + }, + { + "task": "Quartlery finance check", + "startedOn": "2024-03-31", + "frequency": "Quarterly", + "description": "Every quarter, we check Quickbooks Online (QBO) for discrepancies and follow up with accounting providers for any quirks found.", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#check-finances-for-quirks", + "dri": "ireedy" + }, + { + "task": "Deliver annual report for venture line", + "startedOn": "2024-12-01", + "frequency": "Annually", + "description": "Within 60 days of the new year, provide financial statements to SVB, along with board-approved projections for the new year", + "moreInfoUrl": "https://fleetdm.com/handbook/finance#deliver-annual-report-for-venture-line", + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + }, + { + "task": "Tax preparation", + "startedOn": "2024-02-01", + "frequency": "Annually", + "description": "Provide information to tax team with Deloitte and assist with filing and paying state and federal returns", + "moreInfoUrl": null, + "dri": "ireedy", + "autoIssue": { + "labels": [ + "#g-finance" + ], + "repo": "confidential" + } + } + ], + "handbook/sales/sales.rituals.yml": [ + { + "task": "Prioritize for next sprint", + "startedOn": "2023-09-04", + "frequency": "Triweekly", + "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible", + "dri": "alexmitchelliii", + "autoIssue": { + "labels": [ + "#g-sales" + ], + "repo": "confidential" + } + }, + { + "task": "Review Salesforce opportunities", + "startedOn": "2024-12-02", + "frequency": "Weekly", + "description": "https://fleetdm.com/handbook/sales#review-salesforce-opportunities", + "moreInfoUrl": "https://fleetdm.com/handbook/sales#review-salesforce-opportunities", + "dri": "alexmitchelliii", + "autoIssue": { + "labels": [ + "#g-sales" + ], + "repo": "confidential" + } + } + ], + "handbook/product-design/product-design.rituals.yml": [ + { + "task": "🦢📊 Design sprint review", + "startedOn": "2024-03-07", + "frequency": "Triweekly", + "description": "1. For all stories that are not estimated, add their respective customer requests to the feature fest board. For stories that we're no longer working on, remove them from the drafting board, remove their respective customer requests from the 💝 Customer requests board, and notify stakeholders. 2. Record the number of dropped stories for KPIs (all user stories that did not meet the 3 week drafting timeline). 3. Retro: What went well? What could go better? What to remember for next time?", + "moreInfoUrl": null, + "dri": "noahtalerman" + }, + { + "task": "🎁 Feature fest", + "startedOn": "2024-03-07", + "frequency": "Triweekly", + "description": "We make a decision regarding which feature requests can be prioritized.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/product-groups#feature-fest", + "dri": "noahtalerman" + }, + { + "task": "Design sprint kickoff", + "startedOn": "2024-03-07", + "frequency": "Triweekly", + "description": "Add stories prioritized during Feature fest to Drafting board, assign stories to product designers, create upcoming reference docs release branch, and align on priorities.", + "moreInfoUrl": null, + "dri": "noahtalerman" + }, + { + "task": "Sprint kickoff review", + "startedOn": "2024-03-07", + "frequency": "Triweekly", + "description": "Review stories that made it into this sprint and stories that didn't make it into this sprint. Ensure stories/bugs have been effectively prioritized across teams. After the call, the Head of Product Design @ mentions the API design DRI in #help-design about stories that didn't make it into the sprint so that they can update the reference docs release branches.", + "moreInfoUrl": null, + "dri": "noahtalerman" + }, + { + "task": "🦢🗣 Design review", + "startedOn": "2024-03-07", + "frequency": "Daily", + "description": "On Mondays, contributors present wireframes in 'Feedback' mode and anyone can give feedback. 'Final review' mode during all other days and only Head of Product Design + CTO + Product Designers give feedback.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/product-groups#design-reviews", + "dri": "noahtalerman" + }, + { + "task": "🦢📨 Unpacking the 'why'", + "startedOn": "2024-09-30", + "frequency": "Daily", + "description": "Break down the 'why' for new customer requests in the 'Inbox' column on the drafting board.", + "moreInfoUrl": "https://fleetdm.com/handbook/product-design#unpacking-the-why", + "dri": "noahtalerman" + }, + { + "task": "Quarterly roadmap blog post", + "startedOn": "2024-11-05", + "frequency": "Monthly", + "description": "Every quarter, Head of Product Design (HPD) writes a short blog post with the theme and an embedded YouTube video in which HPD walks through this.", + "moreInfoUrl": "", + "dri": "noahtalerman", + "autoIssue": { + "labels": [ + ":product" + ], + "repo": "fleet" + } + }, + { + "task": "🦢👁️ Product design check-in", + "startedOn": "2023-07-11", + "frequency": "Weekly", + "description": "The Head of Product Design summarizes the current week's design reviews to discuss with the CEO", + "moreInfoUrl": "https://fleetdm.com/handbook/product-design#product-design-check-in", + "dri": "noahtalerman" + }, + { + "task": "🦢🗣 Product office hours", + "startedOn": "2023-07-11", + "frequency": "Weekly", + "description": "Head of Product Design + any other contributors who would like to attend. 30 minutes reserved to talk about any product.", + "moreInfoUrl": "https://docs.google.com/document/d/1Znyp2a9qcM9JdYHrzLudvcPwEdhnCg7RiKi22s8yGWw/edit", + "dri": "noahtalerman" + }, + { + "task": "Maintenance", + "startedOn": "2024-03-01", + "frequency": "Weekly", + "description": "Head of Product Design checks the latest versions of relevant platforms, updates the maintenance tracker, and notifies the #g-mdm and #g-endpoint-ops Slack channel.", + "moreInfoUrl": "https://docs.google.com/spreadsheets/d/1IWfQtSkOQgm_JIQZ0i2y3A8aaK5vQW1ayWRk6-4FOp0/edit?gid=0#gid=0", + "dri": "noahtalerman" + }, + { + "task": "🦢✅🎉Product confirm and celebrate", + "startedOn": "2024-02-27", + "frequency": "Triweekly", + "description": "Review the checkboxes in user stories we shipped but haven't closed. Are they done? If not notify relevant contributor to help get them done.", + "moreInfoUrl": null, + "dri": "noahtalerman" + }, + { + "task": "Pre-sprint prioritization", + "startedOn": "2024-02-27", + "frequency": "Triweekly", + "description": "Align on priorities for upcoming sprint.", + "dri": "noahtalerman" + } + ], + "handbook/customer-success/customer-success.rituals.yml": [ + { + "task": "Prioritize for next sprint", + "startedOn": "2023-09-04", + "frequency": "Triweekly", + "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible", + "dri": "zayhanlon", + "autoIssue": { + "labels": [ + "#g-customer-success" + ], + "repo": "confidential" + } + }, + { + "task": "Process new requests", + "startedOn": "2023-09-04", + "frequency": "Daily", + "description": "Prioritize all new requests including issues and PRs within one business day.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/communications#process-new-requests", + "dri": "zayhanlon" + }, + { + "task": "Overnight customer feedback", + "startedOn": "2024-02-08", + "frequency": "Daily", + "description": "Respond to messages and alerts", + "moreInfoUrl": "https://fleetdm.com/handbook/customer-success#respond-to-messages-and-alerts", + "dri": "ksatter" + }, + { + "task": "Monitor customer Slack channels ", + "startedOn": "2024-02-08", + "frequency": "Daily", + "description": "Continuously monitor Slack for customer feedback, feature requests, reported bugs, etc., and respond in less than an hour.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/communications#customer-support-service-level-agreements-slas", + "dri": "ksatter" + }, + { + "task": "Follow-up on unresolved customer questions and concerns", + "startedOn": "2024-02-08", + "frequency": "Daily", + "description": "Follow-up with and tag appropriate personnel on customer issues and bugs in progress and items that remain unresolved.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/communications#customer-support-service-level-agreements-slas", + "dri": "ksatter" + }, + { + "task": "Prepare for customer voice", + "startedOn": "2024-02-23", + "frequency": "Weekly", + "description": "Prepare and review the health and latest updates from Fleet's key customers and active proof of concepts (POCs).", + "moreInfoUrl": "", + "dri": "patagonia121" + }, + { + "task": "Prepare customer requests for feature fest", + "startedOn": "2024-02-12", + "frequency": "Triweekly", + "description": "Check-in before the 🗣️ Product Feature Requests meeting to make sure that all information necessary has been gathered before presenting customer requests and feedback to the Product team.", + "moreInfoUrl": "", + "dri": "nonpunctual" + }, + { + "task": "Present customer requests at feature fest", + "startedOn": "2024-02-15", + "frequency": "Triweekly", + "description": "Present and advocate for requests and ideas brought to Fleet's attention by customers that are interesting from a product perspective.", + "moreInfoUrl": "", + "dri": "nonpunctual" + }, + { + "task": "Communicate release notes to stakeholders", + "startedOn": "2024-02-21", + "frequency": "Triweekly", + "description": "Update customers on new features and resolved bugs in an upcoming release.", + "moreInfoUrl": "", + "dri": "patagonia121" + }, + { + "task": "Upgrade Managed Cloud", + "startedOn": "2024-02-08", + "frequency": "Weekly", + "description": "Upgrade each Managed Cloud instance to the latest version of Fleet", + "moreInfoUrl": "https://github.com/fleetdm/fleet/releases", + "dri": "rfairburn" + } + ], + "handbook/digital-experience/digital-experience.rituals.yml": [ + { + "task": "Complete Digital Experience KPIs and send weekly update", + "startedOn": "2024-08-30", + "frequency": "Weekly", + "description": "Complete Digital Experience KPIs for this week", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#send-the-weekly-update", + "dri": "SFriendLee", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "fleet" + } + }, + { + "task": "Confirm consultant hours", + "startedOn": "2024-09-30", + "frequency": "Weekly", + "description": "Perform step three in “Inform managers about hours worked” responsibility", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#inform-managers-about-hours-worked", + "dri": "SFriendLee", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "fleet" + } + }, + { + "task": "Prep 1:1s for OKR planning", + "startedOn": "2024-09-09", + "frequency": "Monthly", + "description": "Add ”DISCUSS: Mike: Expectations of OKR planning“ to each e-group member's 1:1 document", + "moreInfoUrl": "https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit", + "dri": "SFriendLee", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "fleet" + } + }, + { + "task": "Check browser compatibility for fleetdm.com", + "startedOn": "2024-03-06", + "frequency": "Monthly", + "description": "Use Browserstack to manually QA pages on fleetdm.com in each of the earliest supported browser versions", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-browser-compatibility-for-fleetdm-com", + "dri": "eashaw", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "fleet" + } + }, + { + "task": "Regenerate messaging framework", + "startedOn": "2024-07-15", + "frequency": "Quarterly", + "description": "Run through the entire website in `?utm_content=clear` mode and build a fresh outline of the headings to make sure they all still make sense.", + "moreInfoUrl": "", + "dri": "mike-j-thomas" + }, + { + "task": "Check brand fronts are up to date", + "startedOn": "2024-08-01", + "frequency": "Quarterly", + "description": "Check all brand fronts for consistancy and update as needed with the current product pitch and graphics.", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#update-a-company-brand-front", + "dri": "mike-j-thomas" + }, + { + "task": "Check production dependencies of fleetdm.com", + "startedOn": "2023-11-10", + "frequency": "Weekly", + "description": "Check for vulnerabilities on the production dependencies of fleetdm.com.", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-production-dependencies-of-fleetdm-com", + "dri": "eashaw", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "fleet" + } + }, + { + "task": "Check osquery Slack invitation", + "startedOn": "2023-11-10", + "frequency": "Monthly", + "description": "Check the osquery Slack invitation that is linked to from Fleet and the Fleet website to make sure it is valid.", + "moreInfoUrl": "https://fleetdm.com/slack", + "dri": "eashaw", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "fleet" + } + }, + { + "task": "Prepare for CEO office minutes", + "startedOn": "2023-12-18", + "frequency": "Daily", + "description": "Prepare the CEO office minutes calendar event and meeting agenda", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#prepare-for-ceo-office-minutes", + "dri": "SFriendLee" + }, + { + "task": "Prioritize for next sprint", + "startedOn": "2023-08-09", + "frequency": "Triweekly", + "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible", + "dri": "sampfluger88", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "confidential" + } + }, + { + "task": "Process the CEO's inbox", + "startedOn": "2023-07-29", + "frequency": "Daily ⏰", + "description": "Process the CEO's inbox", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-the-ceos-email", + "dri": "SFriendLee" + }, + { + "task": "Process all \"New requests\" on the #g-digital-experience kanban board", + "startedOn": "2023-07-29", + "frequency": "Daily ⏰", + "description": "Process and prioritize all new issues and PRs", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-new-requests-from-the-g-ceo-kanban-board", + "dri": "sampfluger88" + }, + { + "task": "Process the CEO's calendar", + "startedOn": "2023-07-29", + "frequency": "Daily ⏰", + "description": "Process the CEO's calendar", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-the-ceos-calendar", + "dri": "SFriendLee" + }, + { + "task": "Process and backup E-group agenda", + "startedOn": "2023-09-20", + "frequency": "Weekly", + "description": "Process and backup E-group agenda", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-and-backup-sid-agenda", + "dri": "SFriendLee", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "confidential" + } + }, + { + "task": "Process and backup Sid agenda", + "startedOn": "2023-09-25", + "frequency": "Monthly", + "description": "Process and backup Sid agenda", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-and-backup-e-group-agenda", + "dri": "SFriendLee", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "confidential" + } + }, + { + "task": "Share recording of all hands meeting", + "startedOn": "2023-07-01", + "frequency": "Monthly", + "description": "Sharing the all hands recording", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#share-recording-of-all-hands-meeting", + "dri": "SFriendLee", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "confidential" + } + }, + { + "task": "Prepare all hands deck", + "startedOn": "2023-07-01", + "frequency": "Monthly", + "description": "Preparing the all hands deck", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#preparing-for-the-all-hands", + "dri": "sampfluger88", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "confidential" + } + }, + { + "task": "Prepare board deck", + "startedOn": "2023-09-25", + "frequency": "Quarterly", + "description": "Prepare slide deck for the next board meeting", + "dri": "sampfluger88" + }, + { + "task": "Process CEO GitHub review requests, mentions, and outstanding PRs", + "startedOn": "2023-07-29", + "frequency": "Daily", + "description": "Filter all action items from CEO's GitHub notifications", + "dri": "SFriendLee" + }, + { + "task": "Check LinkedIn for unread messages", + "startedOn": "2023-09-25", + "frequency": "Daily", + "description": "Prevent connections from slipping through the cracks", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-linkedin-for-unread-messages", + "dri": "SFriendLee" + }, + { + "task": "Downgrade unused license seats", + "startedOn": "2024-03-31", + "frequency": "Quarterly", + "description": "Downgrade unused or questionable license seats on the first Wednesday of every quarter", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#downgrade-an-unused-license-seat", + "dri": "sampfluger88" + }, + { + "task": "Communicate Fleet's potential energy to stakeholders", + "startedOn": "2024-05-01", + "frequency": "Monthly", + "description": "Via hand or automation, send a monthly update email to all investors that hold 4% equity or greater in Fleet who have opted in to receive emails on the company's progress.", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#communicate-fleets-potential-energy-to-stakeholders", + "dri": "SFriendLee", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "confidential" + } + }, + { + "task": "Vanta check", + "startedOn": "2024-04-01", + "frequency": "Monthly", + "description": "Look for any new actions in Vanta due in the upcoming months and create issues to ensure they're done on time.", + "moreInfoUrl": null, + "dri": "sampfluger88", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "confidential" + } + }, + { + "task": "Recognize and benchmark workiversaries", + "startedOn": "2024-07-15", + "frequency": "Monthly", + "description": "Identify workiversaries coming up in the next two months and follow the steps to ensure they're recognized and benchmarked", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#recognize-employee-workiversaries", + "dri": "SFriendLee", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "confidential" + } + }, + { + "task": "Quarterly grants", + "startedOn": "2024-02-01", + "frequency": "Quarterly", + "description": "Create the equity grants GitHub issue and walk through the steps.", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#grant-equity", + "dri": "hollidayn" + }, + { + "task": "Change password of \"Integrations admin\" Salesforce account", + "startedOn": "2024-09-10", + "frequency": "Quarterly", + "description": "Log into the \"Integrations admin\" account in Salesforce and change the password to prevent a password change being required by Salesforce.", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#change-the-integrations-admin-salesforce-account-password", + "dri": "eashaw" + }, + { + "task": "Check GitHub/GitLab terms", + "startedOn": "2023-10-24", + "frequency": "Annually", + "description": "Check GitHub's terms to make sure the “inbound=outbound” clause is unchanged.", + "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-github-terms", + "dri": "hollidayn", + "autoIssue": { + "labels": [ + "#g-digital-experience" + ], + "repo": "confidential" + } + }, + { + "task": "Check that there is sufficient availability for scheduling demos via fleetdm.com/contact", + "startedOn": "2024-10-25", + "frequency": "Weekly", + "description": "Check out the meeting booking flow that you get when you schedule a demo from Fleet's contact form, and make sure there is plenty of availability for the rest of the day in US PT thru ET, with significant spots open in the morning (US time) for folks in EMEA and at least one or two spots open in the evening (US time) for folks in APAC / Hawaii.", + "moreInfoUrl": "", + "dri": "onasismunro" + } + ], + "handbook/demand/demand.rituals.yml": [ + { + "task": "Refresh event calendar", + "startedOn": "2023-12-31", + "frequency": "Quarterly", + "description": "https://fleetdm.com/handbook/demand#refresh-event-calendar", + "moreInfoUrl": "https://fleetdm.com/handbook/demand#refresh-event-calendar", + "dri": "Drew-P-drawers" + }, + { + "task": "Prioritize for next sprint", + "startedOn": "2023-09-04", + "frequency": "Triweekly", + "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.", + "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible", + "dri": "mikermcneil", + "autoIssue": { + "labels": [ + "#g-demand" + ], + "repo": "confidential" + } + }, + { + "task": "Settle event strategy", + "startedOn": "2024-01-02", + "frequency": "Quarterly (first Tuesday)", + "description": "https://fleetdm.com/handbook/demand#settle-event-strategy", + "moreInfoUrl": "https://fleetdm.com/handbook/demand#settle-event-strategy", + "dri": "Drew-P-drawers" + }, + { + "task": "🫧 Pipeline sync", + "startedOn": "2024-08-29", + "frequency": "Weekly", + "description": "Allign with CRO and AEs on pipeline processes and incoming leads", + "moreInfoUrl": "", + "dri": "Drew-P-drawers" + }, + { + "task": "Optimize ads", + "startedOn": "2024-02-26", + "frequency": "Weekly", + "description": "Remove all but the top 5 perfoming ads in each evergreen campaign. Make sure ABM campaigns are using top performing evergreen ads.", + "moreInfoUrl": "https://fleetdm.com/handbook/demand#optimize-ads-through-experimentation", + "dri": "Drew-P-drawers" + }, + { + "task": "Process pending swag requests from the website", + "startedOn": "2023-09-20", + "frequency": "Weekly", + "description": "Complete draft orders.", + "moreInfoUrl": "https://fleetdm.com/handbook/demand#process-pending-swag-requests-from-the-website", + "dri": "Drew-P-drawers" + }, + { + "task": "Engage with the community", + "startedOn": "2023-09-20", + "frequency": "Daily", + "description": "Find relevant conversations with the community and contribute", + "moreInfoUrl": "https://fleetdm.com/handbook/demand#engage-with-the-community", + "dri": "Drew-P-drawers" + }, + { + "task": "Publish ☁️🌈 Sprint demos", + "startedOn": "2023-11-03", + "frequency": "Triweekly", + "description": "Every release cycle, upload the ☁️🌈 Sprint demos video to YouTube", + "moreInfoUrl": "https://fleetdm.com/handbook/demand#upload-to-youtube", + "dri": "Drew-P-drawers" + }, + { + "task": "Measure intent signals", + "startedOn": "2024-08-09", + "frequency": "Daily", + "description": "Measure intent signals and update Salesforce", + "moreInfoUrl": "https://fleetdm.com/handbook/demand#measure-intent-signals", + "dri": "Drew-P-drawers" + }, + { + "task": "Research accounts", + "startedOn": "2024-08-09", + "frequency": "Daily", + "description": "Research any research-ready accounts in this Salesforce report (https://fleetdm.lightning.force.com/lightning/r/Report/00OUG000001PUIT2A4/view) and advance them to 'Ads running'", + "moreInfoUrl": "https://fleetdm.com/handbook/demand#research-an-account", + "dri": "Drew-P-drawers" + }, + { + "task": "Check ongoing events", + "startedOn": "2024-10-21", + "frequency": "Daily", + "description": "Check event issues and complete steps.", + "moreInfoUrl": "https://fleetdm.com/handbook/engineering#book-an-event", + "dri": "Drew-P-drawers" + }, + { + "task": "Propose a Fleet event", + "startedOn": "2023-10-21", + "frequency": "Weekly", + "description": "Populate ideas for future events", + "moreInfoUrl": "https://fleetdm.com/handbook/demand#settle-event-strategy", + "dri": "Drew-P-drawers" + } + ] + }, + "testimonials": [ + { + "quote": "Yes Sir. Great tools for the everyday open-source geeks 💯", + "quoteAuthorName": "Alvaro Gutierrez", + "quoteAuthorProfileImageFilename": "testimonial-authour-alvaro-gutierrez-100x100@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/aantoniogutierrez/", + "quoteAuthorJobTitle": "Technology Evangelist", + "productCategories": [ + "Observability", + "Software management" + ] + }, + { + "quote": "Fleet / osquery are some of my favorite open source detection tooling.", + "quoteAuthorName": "Joe Pistone", + "quoteAuthorProfileImageFilename": "testimonial-author-joe-pistone-100x100@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/josephpistone/", + "quoteAuthorJobTitle": "Manager, Security Operations", + "productCategories": [ + "Observability" + ] + }, + { + "quote": "Fleet's extremely wide and diverse set of data allows us to answer questions that we didn't even know we had. On top of that, the experience is near instantaneous. Seconds to sort through billions of data points and return the exact handful that we need, with complete auditing and transparency. We're able to address reliability and compliance concerns without sacrificing a single point-of-a-percent of performance for our servers. All of this done consistently and continuously.", + "quoteAuthorName": "Charles Zaffery", + "quoteAuthorProfileImageFilename": "testimonial-author-charles-zaffery-48x48@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/charleszaffery/", + "quoteAuthorJobTitle": "Principle Computer Janitor", + "productCategories": [ + "Observability" + ] + }, + { + "quote": "The visibility down into the assets covered by the agent is phenomenal. Fleet has become the central source for a lot of things.", + "quoteAuthorName": "Andre Shields", + "quoteAuthorProfileImageFilename": "testimonial-author-andre-shields-48x48@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/andre-shields/", + "quoteImageFilename": "social-proof-rivian-107x24@2x.png", + "quoteAuthorJobTitle": "Staff Cybersecurity Engineer, Vulnerability Management", + "youtubeVideoUrl": "https://www.youtube.com/watch?v=siXy9aanOu4", + "productCategories": [ + "Observability", + "Software management" + ], + "videoIdForEmbed": "siXy9aanOu4", + "imageHeight": 24 + }, + { + "quote": "I love the steady and consistent delivery of features that help teams work how they want to work, not how your product dictates they work.", + "quoteImageFilename": "social-proof-logo-atlassian-192x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/danielgrzelak/", + "quoteAuthorName": "Dan Grzelak", + "quoteAuthorProfileImageFilename": "testimonial-author-daniel-grzelak-48x48@2x.png", + "quoteAuthorJobTitle": "Security Chief of Staff", + "productCategories": [ + "Observability", + "Software management", + "Device management" + ], + "imageHeight": 32 + }, + { + "quote": "We can build it exactly the way we want it. Which is just not possible on other platforms.", + "quoteAuthorName": "Austin Anderson", + "quoteAuthorProfileImageFilename": "testimonial-author-austin-anderson-48x48@2x.png", + "quoteAuthorJobTitle": "Cybersecurity team senior manager", + "quoteLinkUrl": "https://www.linkedin.com/in/austin-anderson-73172185/", + "youtubeVideoUrl": "https://www.youtube.com/watch?v=G5Ry_vQPaYc", + "productCategories": [ + "Observability", + "Software management" + ], + "videoIdForEmbed": "G5Ry_vQPaYc" + }, + { + "quote": "Exciting. This is a team that listens to feedback.", + "quoteImageFilename": "social-proof-logo-uber-71x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/eriknicolasgomez/", + "quoteAuthorName": "Erik Gomez", + "quoteAuthorProfileImageFilename": "testimonial-author-erik-gomez-48x48@2x.png", + "quoteAuthorJobTitle": "Staff Client Platform Engineer", + "productCategories": [ + "Observability", + "Device management", + "Software management" + ], + "imageHeight": 32 + }, + { + "quote": "Context is king for device data, and Fleet provides a way to surface that information to our other teams and partners.", + "quoteAuthorName": "Nick Fohs", + "quoteAuthorProfileImageFilename": "testimonial-author-nick-fohs-24x24@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/nickfohs/", + "quoteAuthorJobTitle": "Systems and infrastructure manager", + "youtubeVideoUrl": "https://www.youtube.com/watch?v=fs5ULAR4e4A", + "productCategories": [ + "Observability", + "Device management", + "Software management" + ], + "videoIdForEmbed": "fs5ULAR4e4A" + }, + { + "quote": "Keeping up with the latest issues in endpoint security is a never-ending task, because engineers have to regularly ensure every laptop and server is still sufficiently patched and securely configured. The problem is, software vendors release new versions all the time, and no matter how much you lock it down, end users find ways to change things.", + "quoteImageFilename": "social-proof-logo-lyft-47x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/nwaisman/", + "quoteAuthorName": "Nico Waisman", + "quoteAuthorProfileImageFilename": "testimonial-author-nico-waisman-48x48@2x.png", + "quoteAuthorJobTitle": "CISO of Lyft", + "productCategories": [ + "Observability", + "Software management" + ], + "imageHeight": 32 + }, + { + "quote": "Having the freedom to take full advantage of the product is one of the reasons why I always support open-source products with a commercially-backed company, like Fleet.", + "quoteImageFilename": "social-proof-logo-lyft-47x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/posts/nwaisman_movingtofleet-activity-7156319785981509632-bk_W", + "quoteAuthorName": "Nico Waisman", + "quoteAuthorProfileImageFilename": "testimonial-author-nico-waisman-48x48@2x.png", + "quoteAuthorJobTitle": "CISO of Lyft", + "productCategories": [ + "Device management" + ], + "imageHeight": 32 + }, + { + "quote": "I had to answer some really complex questions for a compliance audit, and I was able to do it in about 15 minutes by munging some data together via a few queries into a csv. It took me longer to remember how to use `xsv` than to actually put together the report. If you aren't using osquery in your environment, you should be.", + "quoteAuthorName": "Charles Zaffery", + "quoteAuthorProfileImageFilename": "testimonial-author-charles-zaffery-48x48@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/charleszaffery/", + "quoteAuthorJobTitle": "Principle Computer Janitor", + "productCategories": [ + "Software management" + ] + }, + { + "quote": "Fleet has been highly effective for our needs. We appreciate your team for always being so open to hearing our feedback.", + "quoteAuthorName": "Kenny Botelho", + "quoteAuthorProfileImageFilename": "testimonial-author-kenny-botelho-48x48@2x.png", + "quoteAuthorJobTitle": "Client Platform IT Engineer / Leader", + "quoteLinkUrl": "https://www.linkedin.com/in/kennybotelho/", + "productCategories": [ + "Observability", + "Device management", + "Software management" + ] + }, + { + "quote": "Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.", + "quoteImageFilename": "social-proof-logo-stripe-67x32@2x.png", + "quoteAuthorName": "Wes Whetstone", + "quoteAuthorProfileImageFilename": "testimonial-author-wes-whetstone-48x48@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/jckwhet/", + "quoteAuthorJobTitle": "Staff CPE at Stripe", + "productCategories": [ + "Observability", + "Device management", + "Software management" + ], + "imageHeight": 32 + }, + { + "quote": "Fleet’s come a long way - to now being the top open-source osquery manager.", + "quoteImageFilename": "social-proof-logo-atlassian-192x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/bshak/", + "quoteAuthorName": "Brendan Shaklovitz", + "quoteAuthorProfileImageFilename": "testimonial-author-brendan-shaklovitz-48x48@2x.png", + "quoteAuthorJobTitle": "Senior SRE", + "productCategories": [ + "Observability" + ], + "imageHeight": 32 + }, + { + "quote": "It’s great to see the new release of Fleet containing some really cool new features that make osquery much more usable in practical environments. I’m really impressed with the work that Zach Wasserman and the crew are doing at Fleet.", + "quoteImageFilename": "social-proof-logo-osquery-124x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/marpaia/", + "quoteAuthorName": "Mike Arpaia", + "quoteAuthorProfileImageFilename": "testimonial-author-mike-arpaia-48x48@2x.png", + "quoteAuthorJobTitle": "Creator of osquery", + "productCategories": [ + "Observability" + ], + "imageHeight": 32 + }, + { + "quote": "Osquery is one of the best tools out there and Fleet makes it even better. Highly recommend it if you want to monitor, detect and investigate threats on a scale and also for infra/sys admin. I have used it on 15k servers and it’s really scalable.", + "quoteImageFilename": "social-proof-logo-salesforce-48x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/anelshaer/", + "quoteAuthorName": "Ahmed Elshaer", + "quoteAuthorProfileImageFilename": "testimonial-author-ahmed-elshaer-48x48@2x.png", + "quoteAuthorJobTitle": "DFIR, Blue Teaming, SecOps", + "productCategories": [ + "Observability" + ], + "imageHeight": 32 + }, + { + "quote": "With the power of osquery, you need a scalable & resilient platform to manage your workloads. Fleet is the \"just right\" open-source, enterprise grade solution.", + "quoteImageFilename": "social-proof-logo-comcast-91x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/abubakar-yousafzai-b7213659/", + "quoteAuthorName": "Abubakar Yousafzai", + "quoteAuthorProfileImageFilename": "testimonial-author-abubakar-yousafzai-48x48@2x.png", + "quoteAuthorJobTitle": "Security Software Development & Engineering", + "productCategories": [ + "Observability" + ], + "imageHeight": 32 + }, + { + "quote": "One of the best teams out there to go work for and help shape security platforms.", + "quoteImageFilename": "social-proof-logo-deloitte-130x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/neondhruv/", + "quoteAuthorName": "Dhruv Majumdar", + "quoteAuthorProfileImageFilename": "testimonial-author-dhruv-majumdar-48x48@2x.png", + "quoteAuthorJobTitle": "Director Of Cyber Risk & Advisory", + "productCategories": [ + "Software management", + "Observability" + ], + "imageHeight": 32 + }, + { + "quote": "Fleet has such a huge amount of use cases. My goal was to get telemetry on endpoints, but then our IR team, our TBM team, and multiple other folks in security started heavily utilizing the system in ways I didn’t expect. It spread so naturally, even our corporate and infrastructure teams want to run it.", + "quoteAuthorName": "charles zaffery", + "quoteLinkUrl": "https://www.linkedin.com/in/charleszaffery/", + "quoteAuthorJobTitle": "Principle computer janitor", + "quoteAuthorProfileImageFilename": "testimonial-author-charles-zaffery-48x48@2x.png", + "youtubeVideoUrl": "https://www.youtube.com/watch?v=nRbZJflWqCo", + "productCategories": [ + "Observability" + ], + "videoIdForEmbed": "nRbZJflWqCo" + }, + { + "quote": "I don't want one bad actor to brick my fleet, I want them to make a pull request first.", + "quoteAuthorName": "Matt Carr", + "quoteAuthorJobTitle": "CPE manager", + "quoteAuthorProfileImageFilename": "testimonial-author-matt-carr-48x48@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/mathewcarr/", + "productCategories": [ + "Device management" + ] + }, + { + "quote": "I wanted an easy way to control osquery configurations, and I wanted to stream data as fast as possible into Snowflake. No other solution jumped out to solve those things except for Fleet.", + "quoteAuthorName": "Tom Larkin", + "quoteAuthorJobTitle": "IT Engineering Manager", + "quoteAuthorProfileImageFilename": "testimonial-author-tom-larkin-48x48@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/thlarkin/", + "youtubeVideoUrl": "https://www.youtube.com/watch?v=nkjg_hNe86Q", + "productCategories": [ + "Observability" + ], + "videoIdForEmbed": "nkjg_hNe86Q" + }, + { + "quote": "Something I really appreciate about working with you guys is that it doesn't feel like I'm talking to a vendor. It actually feels like I'm talking to my team, and I really appreciate it.", + "quoteImageFilename": "social-proof-logo-deloitte-130x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/cmajumdar/", + "quoteAuthorName": "Chandra Majumdar", + "quoteAuthorProfileImageFilename": "testimonial-author-chandra-majumdar-48x48@2x.png", + "quoteAuthorJobTitle": "Partner - Cyber and Strategic Risk", + "productCategories": [ + "Software management", + "Observability", + "Device management" + ], + "imageHeight": 32 + }, + { + "quote": "This is not just production osquery, but actually a way bigger opportunity than even something like Airwatch or Jamf.", + "quoteImageFilename": "logo-flock-safety-907x132@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/mrerictan/", + "quoteAuthorName": "Eric Tan", + "quoteAuthorProfileImageFilename": "testimonial-author-eric-tan-99x99@2x.png", + "quoteAuthorJobTitle": "CIO & CSO at Flock Safety", + "productCategories": [ + "Device management", + "Observability", + "Software management" + ], + "imageHeight": 132 + }, + { + "quote": "We've been using Fleet for a few years at Stripe and we couldn't be happier. The fact that it's also open-source made it easy for us to try it out, customise it to our needs, and seamlessly integrate it into our existing environment.", + "quoteImageFilename": "social-proof-logo-stripe-67x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/posts/scottmacvicar_fleet-expands-its-gitops-focused-device-management-activity-7245288577876566017-vAHG?utm_source=share&utm_medium=member_desktop", + "quoteAuthorName": "Scott MacVicar", + "quoteAuthorProfileImageFilename": "testimonial-author-scott-macvicar-100x100@2x.png", + "quoteAuthorJobTitle": "Head of Developer Infrastructure & Corporate Technology", + "productCategories": [ + "Device management", + "Observability" + ], + "imageHeight": 32 + }, + { + "quote": "Fleet helped us determine that Norton antivirus (pre-installed on some machines) was interfering with Crowdstrike's ability to detect downloaded malware.", + "quoteImageFilename": "social-proof-knowbe4-124x32@2x.png", + "quoteLinkUrl": "https://www.linkedin.com/in/arsenio-figueroa-81a56198/", + "quoteAuthorName": "Arsenio Figueroa", + "quoteAuthorProfileImageFilename": "testimonial-author-arsenio-figueroa-48x48@2x.png", + "quoteAuthorJobTitle": "Senior Systems Security Engineer", + "productCategories": [ + "Observability", + "Software management" + ], + "imageHeight": 32 + } + ], + "openPositions": [ + { + "jobTitle": "🚀 Software Engineer", + "url": "/handbook/company/open-positions/software-engineer" + } + ], + "compiledPagePartialsAppPath": "views/partials/built-from-markdown" } } From 82f1068d31ab67abdf3acce1d32b8553d0941a31 Mon Sep 17 00:00:00 2001 From: Noah Talerman Date: Wed, 18 Dec 2024 10:29:43 -0500 Subject: [PATCH 6/7] Remove changes to sailssrc --- website/.sailsrc | 18260 --------------------------------------------- 1 file changed, 18260 deletions(-) diff --git a/website/.sailsrc b/website/.sailsrc index 678392b5fe9c..391fdf869cce 100644 --- a/website/.sailsrc +++ b/website/.sailsrc @@ -7,18265 +7,5 @@ "_generatedWith": { "sails": "1.2.5", "sails-generate": "2.0.0" - }, - "builtStaticContent": { - "queries": [ - { - "name": "Ensure a password is required to wake the computer from sleep or screen saver is enabled", - "platforms": "macOS", - "platform": "darwin", - "description": "Checks that password is required to wake the computer from sleep or screen saver is enabled.", - "resolution": "Automated method:\nAsk your system administrator to deploy an MDM profile that ensures a password is required to wake the computer from sleep or screen saver is enabled.\nGraphical method:\n Perform the following steps to ensure a password is required to wake the computer from sleep or screen saver is enabled:\n 1. Open System Settings\n 2. Select Lock Screen\n 3. Verify that \"Require password after screensaver begins or display is turned\n off\" is set with \"After 0 seconds\" or \"After 5 seconds\"\n", - "query": "SELECT 1 WHERE \n EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.screensaver' AND \n name='askForPassword' AND \n (value = 1 OR value = 'true') AND \n username = ''\n )\n AND EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.screensaver' AND \n name='askForPasswordDelay' AND \n value <= 5 AND \n username = ''\n )\n AND NOT EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.screensaver' AND \n name='askForPassword' AND \n (value != 1 AND value != 'true')\n )\n AND NOT EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.screensaver' AND \n name='askForPasswordDelay' AND \n value > 5\n ); ", - "purpose": "Informational", - "tags": [ - "compliance", - "cis", - "cis_level1", - "premium" - ], - "contributors": [ - { - "name": "sharon-fdm", - "handle": "sharon-fdm", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/sharon-fdm" - } - ], - "kind": "policy", - "slug": "ensure-a-password-is-required-to-wake-the-computer-from-sleep-or-screen-saver-is-enabled", - "requiresMdm": false - }, - { - "name": "Ensure auto-update is enabled", - "platforms": "macOS", - "platform": "darwin", - "description": "Checks that the system is configured via MDM to automatically install updates.", - "resolution": "Ask your system administrator to deploy an MDM profile that enables automatic updates.", - "query": "SELECT 1 WHERE \n EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.SoftwareUpdate' AND \n name='AutomaticCheckEnabled' AND \n (value = 1 OR value = 'true') AND \n username = ''\n )\n AND NOT EXISTS (\n SELECT 1 FROM managed_policies WHERE \n domain='com.apple.SoftwareUpdate' AND \n name='AutomaticCheckEnabled' AND \n (value != 1 AND value != 'true')\n ); \n", - "purpose": "Informational", - "tags": [ - "compliance", - "cis", - "cis_level1", - "premium" - ], - "contributors": [ - { - "name": "sharon-fdm", - "handle": "sharon-fdm", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/sharon-fdm" - } - ], - "kind": "policy", - "slug": "ensure-auto-update-is-enabled", - "requiresMdm": false - }, - { - "name": "Ensure 'Minimum password length' is set to '14 or more characters'", - "platforms": "win10", - "platform": "windows", - "description": "This policy setting determines the least number of characters that make up a password for a user account.\n", - "resolution": "Automatic method:\nAsk your system administrator to establish the recommended configuration via GP, set the following UI path to 14 or more characters\n'Computer Configuration\\Policies\\Windows Settings\\Security Settings\\Account Policies\\Password Policy\\Minimum password length'\n", - "query": "SELECT 1 FROM security_profile_info WHERE minimum_password_length >= 14;\n", - "purpose": "Informational", - "tags": [ - "compliance", - "cis", - "cis_level1", - "premium" - ], - "contributors": [ - { - "name": "marcosd4h", - "handle": "marcosd4h", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/marcosd4h" - } - ], - "kind": "policy", - "slug": "ensure-minimum-password-length-is-set-to-14-or-more-characters", - "requiresMdm": false - }, - { - "name": "Get OpenSSL versions", - "platform": "linux", - "description": "Retrieves the OpenSSL version.", - "query": "SELECT name AS name, version AS version, 'deb_packages' AS source FROM deb_packages WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'apt_sources' AS source FROM apt_sources WHERE name LIKE 'openssl%' UNION SELECT name AS name, version AS version, 'rpm_packages' AS source FROM rpm_packages WHERE name LIKE 'openssl%';", - "purpose": "Informational", - "tags": [ - "inventory" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-open-ssl-versions", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get authorized SSH keys", - "platform": "darwin, linux", - "description": "Presence of authorized SSH keys may be unusual on laptops. Could be completely normal on servers, but may be worth auditing for unusual keys and/or changes.", - "query": "SELECT username, authorized_keys. * FROM users CROSS JOIN authorized_keys USING (uid);", - "purpose": "Informational", - "remediation": "Check out the linked table (https://github.com/fleetdm/fleet/blob/32b4d53e7f1428ce43b0f9fa52838cbe7b413eed/handbook/queries/detect-hosts-with-high-severity-vulnerable-versions-of-openssl.md#table-of-vulnerable-openssl-versions) to determine if the installed version is a high severity vulnerability and view the corresponding CVE(s)", - "tags": [ - "built-in", - "ssh" - ], - "contributors": [ - { - "name": "mike-j-thomas", - "handle": "mike-j-thomas", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/mike-j-thomas" - } - ], - "kind": "query", - "slug": "get-authorized-ssh-keys", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get authorized keys for Domain Joined Accounts", - "platform": "darwin, linux", - "description": "List authorized_keys for each user on the system.", - "query": "SELECT * FROM users CROSS JOIN authorized_keys USING(uid) WHERE username IN (SELECT distinct(username) FROM last);", - "purpose": "Informational", - "tags": [ - "active directory", - "ssh" - ], - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-authorized-keys-for-domain-joined-accounts", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get crashes", - "platform": "darwin", - "description": "Retrieve application, system, and mobile app crash logs.", - "query": "SELECT uid, datetime, responsible, exception_type, identifier, version, crash_path FROM users CROSS JOIN crashes USING (uid);", - "purpose": "Informational", - "tags": [ - "troubleshooting" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-crashes", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get installed Chrome Extensions", - "platform": "darwin, linux, windows", - "description": "List installed Chrome Extensions for all users.", - "query": "SELECT * FROM users CROSS JOIN chrome_extensions USING (uid);", - "purpose": "Informational", - "tags": [ - "browser", - "built-in", - "inventory" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-chrome-extensions", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get installed Linux software", - "platform": "linux", - "description": "Get all software installed on a Linux computer, including browser plugins and installed packages. Note that this does not include other running processes in the processes table.", - "query": "SELECT name AS name, version AS version, 'Package (APT)' AS type, 'apt_sources' AS source FROM apt_sources UNION SELECT name AS name, version AS version, 'Package (deb)' AS type, 'deb_packages' AS source FROM deb_packages UNION SELECT package AS name, version AS version, 'Package (Portage)' AS type, 'portage_packages' AS source FROM portage_packages UNION SELECT name AS name, version AS version, 'Package (RPM)' AS type, 'rpm_packages' AS source FROM rpm_packages UNION SELECT name AS name, '' AS version, 'Package (YUM)' AS type, 'yum_sources' AS source FROM yum_sources UNION SELECT name AS name, version AS version, 'Package (NPM)' AS type, 'npm_packages' AS source FROM npm_packages UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages;", - "purpose": "Informational", - "tags": [ - "inventory", - "built-in" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-linux-software", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get installed macOS software", - "platform": "darwin", - "description": "Get all software installed on a macOS computer, including apps, browser plugins, and installed packages. Note that this does not include other running processes in the processes table.", - "query": "SELECT name AS name, bundle_short_version AS version, 'Application (macOS)' AS type, 'apps' AS source FROM apps UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name As name, version AS version, 'Browser plugin (Safari)' AS type, 'safari_extensions' AS source FROM safari_extensions UNION SELECT name AS name, version AS version, 'Package (Homebrew)' AS type, 'homebrew_packages' AS source FROM homebrew_packages;", - "purpose": "Informational", - "tags": [ - "inventory", - "built-in" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-mac-os-software", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get installed Safari extensions", - "platform": "darwin", - "description": "Retrieves the list of installed Safari Extensions for all users in the target system.", - "query": "SELECT safari_extensions.* FROM users join safari_extensions USING (uid);", - "purpose": "Informational", - "tags": [ - "browser", - "built-in", - "inventory" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-safari-extensions", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get installed Windows software", - "platform": "windows", - "description": "Get all software installed on a Windows computer, including programs, browser plugins, and installed packages. Note that this does not include other running processes in the processes table.", - "query": "SELECT name AS name, version AS version, 'Program (Windows)' AS type, 'programs' AS source FROM programs UNION SELECT name AS name, version AS version, 'Package (Python)' AS type, 'python_packages' AS source FROM python_packages UNION SELECT name AS name, version AS version, 'Browser plugin (IE)' AS type, 'ie_extensions' AS source FROM ie_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Chrome)' AS type, 'chrome_extensions' AS source FROM chrome_extensions UNION SELECT name AS name, version AS version, 'Browser plugin (Firefox)' AS type, 'firefox_addons' AS source FROM firefox_addons UNION SELECT name AS name, version AS version, 'Package (Chocolatey)' AS type, 'chocolatey_packages' AS source FROM chocolatey_packages;", - "purpose": "Informational", - "tags": [ - "inventory", - "built-in" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-installed-windows-software", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get laptops with failing batteries", - "platform": "darwin", - "description": "Lists all laptops with under-performing or failing batteries.", - "query": "SELECT * FROM battery WHERE health != 'Good' AND condition NOT IN ('', 'Normal');", - "purpose": "Informational", - "tags": [ - "troubleshooting", - "hardware", - "inventory" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-laptops-with-failing-batteries", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get current users with active shell/console on the system", - "platform": "darwin, linux, windows", - "description": "Get current users with active shell/console on the system and associated process", - "query": "SELECT user,host,time, p.name, p.cmdline, p.cwd, p.root FROM logged_in_users liu, processes p WHERE liu.pid = p.pid and liu.type='user' and liu.user <> '' ORDER BY time;", - "purpose": "Informational", - "tags": [ - "hunting", - "built-in" - ], - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-current-users-with-active-shell-console-on-the-system", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get unencrypted SSH keys for local accounts", - "platform": "darwin, linux, windows", - "description": "Identify SSH keys created without a passphrase which can be used in Lateral Movement (MITRE. TA0008)", - "query": "SELECT uid, username, description, path, encrypted FROM users CROSS JOIN user_ssh_keys using (uid) WHERE encrypted=0;", - "purpose": "Informational", - "tags": [ - "inventory", - "compliance", - "ssh", - "built-in" - ], - "remediation": "First, make the user aware about the impact of SSH keys. Then rotate the unencrypted keys detected.", - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-unencrypted-ssh-keys-for-local-accounts", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get unencrypted SSH keys for domain-joined accounts", - "platform": "darwin, linux, windows", - "description": "Identify SSH keys created without a passphrase which can be used in Lateral Movement (MITRE. TA0008)", - "query": "SELECT uid, username, description, path, encrypted FROM users CROSS JOIN user_ssh_keys using (uid) WHERE encrypted=0 and username in (SELECT distinct(username) FROM last);", - "purpose": "Informational", - "tags": [ - "inventory", - "compliance", - "ssh", - "active directory" - ], - "remediation": "First, make the user aware about the impact of SSH keys. Then rotate the unencrypted keys detected.", - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-unencrypted-ssh-keys-for-domain-joined-accounts", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get dynamic linker hijacking on Linux (MITRE. T1574.006)", - "platform": "linux", - "description": "Detect any processes that run with LD_PRELOAD environment variable", - "query": "SELECT env.pid, env.key, env.value, p.name,p.path, p.cmdline, p.cwd FROM process_envs env join processes p USING (pid) WHERE key='LD_PRELOAD';", - "purpose": "Informational", - "tags": [ - "hunting", - "attack", - "t1574" - ], - "remediation": "Identify the process/binary detected and confirm with the system's owner.", - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-dynamic-linker-hijacking-on-linux-mitre-t-1574-006", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get dynamic linker hijacking on macOS (MITRE. T1574.006)", - "platform": "darwin", - "description": "Detect any processes that run with DYLD_INSERT_LIBRARIES environment variable", - "query": "SELECT env.pid, env.key, env.value, p.name,p.path, p.cmdline, p.cwd FROM process_envs env join processes p USING (pid) WHERE key='DYLD_INSERT_LIBRARIES';", - "purpose": "Informational", - "tags": [ - "hunting", - "attack", - "t1574" - ], - "remediation": "Identify the process/binary detected and confirm with the system's owner.", - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-dynamic-linker-hijacking-on-mac-os-mitre-t-1574-006", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get etc hosts entries", - "platform": "darwin, linux", - "description": "Line-parsed /etc/hosts", - "query": "SELECT * FROM etc_hosts WHERE address not in ('127.0.0.1', '::1');", - "purpose": "informational", - "tags": [ - "hunting", - "inventory" - ], - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-etc-hosts-entries", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get network interfaces", - "platform": "darwin, linux, windows", - "description": "Network interfaces MAC address", - "query": "SELECT a.interface, a.address, d.mac FROM interface_addresses a JOIN interface_details d USING (interface) WHERE address not in ('127.0.0.1', '::1');", - "purpose": "informational", - "tags": [ - "hunting", - "inventory" - ], - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-network-interfaces", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get local user accounts", - "platform": "darwin, linux, windows", - "description": "Local user accounts (including domain accounts that have logged on locally (Windows)).", - "query": "SELECT uid, gid, username, description, directory, shell FROM users;", - "purpose": "informational", - "tags": [ - "hunting", - "inventory" - ], - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-local-user-accounts", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get active user accounts on servers", - "platform": "linux", - "description": "Domain Joined environments normally have root or other service only accounts and users are SSH-ing using their Domain Accounts.", - "query": "SELECT * FROM shadow WHERE password_status='active' and username!='root';", - "purpose": "informational", - "tags": [ - "hunting", - "inventory", - "active directory" - ], - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-active-user-accounts-on-servers", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get Nmap scanner", - "platform": "darwin, linux, windows", - "description": "Get Nmap scanner process, as well as its user, parent, and process details.", - "query": "SELECT p.pid, name, p.path, cmdline, cwd, start_time, parent, (SELECT name FROM processes WHERE pid=p.parent) AS parent_name, (SELECT username FROM users WHERE uid=p.uid) AS username FROM processes as p WHERE cmdline like 'nmap%';", - "purpose": "Informational", - "tags": [ - "hunting", - "attack", - "t1046" - ], - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-nmap-scanner", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get Docker contained processes on a system", - "platform": "darwin, linux", - "description": "Docker containers Processes, can be used on normal systems or a kubenode.", - "query": "SELECT c.id, c.name, c.image, c.image_id, c.command, c.created, c.state, c.status, p.cmdline FROM docker_containers c CROSS JOIN docker_container_processes p using(id);", - "purpose": "Informational", - "tags": [ - "built-in", - "containers", - "inventory" - ], - "contributors": [ - { - "name": "anelshaer", - "handle": "anelshaer", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/anelshaer" - } - ], - "kind": "query", - "slug": "get-docker-contained-processes-on-a-system", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get Windows print spooler remote code execution vulnerability", - "platform": "windows", - "description": "Detects devices that are potentially vulnerable to CVE-2021-1675 because the print spooler service is not disabled.", - "query": "SELECT CASE cnt WHEN 2 THEN \"TRUE\" ELSE \"FALSE\" END \"Vulnerable\" FROM (SELECT name start_type, COUNT(name) AS cnt FROM services WHERE name = 'NTDS' or (name = 'Spooler' and start_type <> 'DISABLED')) WHERE cnt = 2;", - "purpose": "Informational", - "tags": [ - "vulnerability" - ], - "contributors": [ - { - "name": "maravedi", - "handle": "maravedi", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/maravedi" - } - ], - "kind": "query", - "slug": "get-windows-print-spooler-remote-code-execution-vulnerability", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get local users and their privileges", - "platform": "darwin, linux, windows", - "description": "Collects the local user accounts and their respective user group.", - "query": "SELECT uid, username, type, groupname FROM users u JOIN groups g ON g.gid = u.gid;", - "purpose": "informational", - "tags": [ - "inventory" - ], - "contributors": [ - { - "name": "noahtalerman", - "handle": "noahtalerman", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/noahtalerman" - } - ], - "kind": "query", - "slug": "get-local-users-and-their-privileges", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get processes that no longer exist on disk", - "platform": "linux, darwin, windows", - "description": "Lists all processes of which the binary which launched them no longer exists on disk. Attackers often delete files from disk after launching a process to mask presence.", - "query": "SELECT name, path, pid FROM processes WHERE on_disk = 0;", - "purpose": "Incident response", - "tags": [ - "hunting", - "built-in" - ], - "contributors": [ - { - "name": "alphabrevity", - "handle": "alphabrevity", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-processes-that-no-longer-exist-on-disk", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get user files matching a specific hash", - "platform": "darwin, linux", - "description": "Looks for specific hash in the Users/ directories for files that are less than 50MB (osquery file size limitation.)", - "query": "SELECT path, sha256 FROM hash WHERE path IN (SELECT path FROM file WHERE size < 50000000 AND path LIKE '/Users/%/Documents/%%') AND sha256 = '16d28cd1d78b823c4f961a6da78d67a8975d66cde68581798778ed1f98a56d75';", - "purpose": "Informational", - "tags": [ - "hunting", - "built-in" - ], - "contributors": [ - { - "name": "alphabrevity", - "handle": "alphabrevity", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-user-files-matching-a-specific-hash", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get local administrator accounts on macOS", - "platform": "darwin", - "description": "The query allows you to check macOS systems for local administrator accounts.", - "query": "SELECT uid, username, type FROM users u JOIN groups g ON g.gid = u.gid;", - "purpose": "Informational", - "tags": [ - "hunting", - "inventory" - ], - "contributors": [ - { - "name": "alphabrevity", - "handle": "alphabrevity", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-local-administrator-accounts-on-mac-os", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get all listening ports, by process", - "platform": "linux, darwin, windows", - "description": "List ports that are listening on all interfaces, along with the process to which they are attached.", - "query": "SELECT lp.address, lp.pid, lp.port, lp.protocol, p.name, p.path, p.cmdline FROM listening_ports lp JOIN processes p ON lp.pid = p.pid WHERE lp.address = \"0.0.0.0\";", - "purpose": "Informational", - "tags": [ - "hunting", - "network" - ], - "contributors": [ - { - "name": "alphabrevity", - "handle": "alphabrevity", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-all-listening-ports-by-process", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get whether TeamViewer is installed/running", - "platform": "windows", - "description": "Looks for the TeamViewer service running on machines. This is often used when attackers gain access to a machine, running TeamViewer to allow them to access a machine.", - "query": "SELECT display_name,status,s.pid,p.path FROM services AS s JOIN processes AS p USING(pid) WHERE s.name LIKE \"%teamviewer%\";", - "purpose": "Informational", - "tags": [ - "hunting", - "inventory" - ], - "contributors": [ - { - "name": "alphabrevity", - "handle": "alphabrevity", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-whether-team-viewer-is-installed-running", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get malicious Python backdoors", - "platform": "darwin, linux, windows", - "description": "Watches for the backdoored Python packages installed on the system. See (http://www.nbu.gov.sk/skcsirt-sa-20170909-pypi/index.html)", - "query": "SELECT CASE cnt WHEN 0 THEN \"NONE_INSTALLED\" ELSE \"INSTALLED\" END AS \"Malicious Python Packages\", package_name, package_version FROM (SELECT COUNT(name) AS cnt, name AS package_name, version AS package_version, path AS package_path FROM python_packages WHERE package_name IN ('acquisition', 'apidev-coop', 'bzip', 'crypt', 'django-server', 'pwd', 'setup-tools', 'telnet', 'urlib3', 'urllib'));", - "purpose": "Informational", - "tags": [ - "hunting", - "inventory", - "malware" - ], - "contributors": [ - { - "name": "alphabrevity", - "handle": "alphabrevity", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/alphabrevity" - } - ], - "kind": "query", - "slug": "get-malicious-python-backdoors", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Check for artifacts of the Floxif trojan", - "platform": "windows", - "description": "Checks for artifacts from the Floxif trojan on Windows machines.", - "query": "SELECT * FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\\\SOFTWARE\\\\Piriform\\\\Agomo%';", - "purpose": "Informational", - "tags": [ - "hunting", - "malware" - ], - "contributors": [ - { - "name": "micheal-o", - "handle": "micheal-o", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/micheal-o" - } - ], - "kind": "query", - "slug": "check-for-artifacts-of-the-floxif-trojan", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get Shimcache table", - "platform": "windows", - "description": "Returns forensic data showing evidence of likely file execution, in addition to the last modified timestamp of the file, order of execution, full file path order of execution, and the order in which files were executed.", - "query": "select * from Shimcache", - "purpose": "Informational", - "tags": [ - "hunting" - ], - "contributors": [ - { - "name": "puffyCid", - "handle": "puffyCid", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/puffyCid" - } - ], - "kind": "query", - "slug": "get-shimcache-table", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get running docker containers", - "platform": "darwin, linux", - "description": "Returns the running Docker containers", - "query": "SELECT id, name, image, image_id, state, status FROM docker_containers WHERE state = \"running\";", - "purpose": "Informational", - "tags": [ - "containers", - "inventory" - ], - "contributors": [ - { - "name": "DominusKelvin", - "handle": "DominusKelvin", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-running-docker-containers", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get applications hogging memory", - "platform": "darwin, linux, windows", - "description": "Returns top 10 applications or processes hogging memory the most.", - "query": "SELECT pid, name, ROUND((total_size * '10e-7'), 2) AS memory_used FROM processes ORDER BY total_size DESC LIMIT 10;", - "purpose": "Informational", - "tags": [ - "troubleshooting" - ], - "contributors": [ - { - "name": "DominusKelvin", - "handle": "DominusKelvin", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-applications-hogging-memory", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get servers with root login in the last 24 hours", - "platform": "darwin, linux, windows", - "description": "Returns servers with root login in the last 24 hours and the time the users were logged in.", - "query": "SELECT * FROM last WHERE username = \"root\" AND time > (( SELECT unix_time FROM time ) - 86400 );", - "purpose": "Informational", - "tags": [ - "hunting" - ], - "contributors": [ - { - "name": "DominusKelvin", - "handle": "DominusKelvin", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-servers-with-root-login-in-the-last-24-hours", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Detect active processes with Log4j running", - "platform": "darwin, linux", - "description": "Returns a list of active processes and the Jar paths which are using Log4j. Version numbers are usually within the Jar filename. Note: This query is resource intensive and has caused problems on systems with limited swap space. Test on some systems before running this widely.", - "query": "WITH target_jars AS (\n SELECT DISTINCT path\n FROM (\n WITH split(word, str) AS(\n SELECT '', cmdline || ' '\n FROM processes\n UNION ALL\n SELECT substr(str, 0, instr(str, ' ')), substr(str, instr(str, ' ') + 1)\n FROM split\n WHERE str != '')\n SELECT word AS path\n FROM split\n WHERE word LIKE '%.jar'\n UNION ALL\n SELECT path\n FROM process_open_files\n WHERE path LIKE '%.jar'\n )\n)\nSELECT path, matches\nFROM yara\nWHERE path IN (SELECT path FROM target_jars)\n AND count > 0\n AND sigrule IN (\n 'rule log4jJndiLookup {\n strings:\n $jndilookup = \"JndiLookup\"\n condition:\n $jndilookup\n }',\n 'rule log4jJavaClass {\n strings:\n $javaclass = \"org/apache/logging/log4j\"\n condition:\n $javaclass\n }'\n );\n", - "purpose": "Detection", - "tags": [ - "vulnerability" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - }, - { - "name": "tgauda", - "handle": "tgauda", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/tgauda" - } - ], - "kind": "query", - "slug": "detect-active-processes-with-log-4-j-running", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get applications that were opened within the last 24 hours", - "platform": "darwin", - "description": "Returns applications that were opened within the last 24 hours starting with the last opened application.", - "query": "SELECT * FROM apps WHERE last_opened_time > (( SELECT unix_time FROM time ) - 86400 ) ORDER BY last_opened_time DESC;", - "purpose": "Informational", - "tags": [ - "inventory" - ], - "contributors": [ - { - "name": "DominusKelvin", - "handle": "DominusKelvin", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-applications-that-were-opened-within-the-last-24-hours", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get applications that are not in the Applications directory", - "platform": "darwin", - "description": "Returns applications that are not in the `/Applications` directory", - "query": "SELECT * FROM apps WHERE path NOT LIKE '/Applications/%';", - "purpose": "Informational", - "tags": [ - "hunting", - "inventory" - ], - "contributors": [ - { - "name": "DominusKelvin", - "handle": "DominusKelvin", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-applications-that-are-not-in-the-applications-directory", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get subscription-based applications that have not been opened for the last 30 days", - "platform": "darwin", - "description": "Returns applications that are subscription-based and have not been opened for the last 30 days. You can replace the list of applications with those specific to your use case.", - "query": "SELECT * FROM apps WHERE path LIKE '/Applications/%' AND name IN (\"Photoshop.app\", \"Adobe XD.app\", \"Sketch.app\", \"Illustrator.app\") AND last_opened_time < (( SELECT unix_time FROM time ) - 2592000000000 );", - "purpose": "Informational", - "tags": [ - "inventory" - ], - "contributors": [ - { - "name": "DominusKelvin", - "handle": "DominusKelvin", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/DominusKelvin" - } - ], - "kind": "query", - "slug": "get-subscription-based-applications-that-have-not-been-opened-for-the-last-30-days", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get operating system information", - "platform": "darwin, windows, linux", - "description": "Returns the operating system name and version on the device.", - "query": "SELECT name, version FROM os_version;", - "purpose": "Informational", - "tags": [ - "inventory", - "built-in" - ], - "contributors": [ - { - "name": "noahtalerman", - "handle": "noahtalerman", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/noahtalerman" - } - ], - "kind": "query", - "slug": "get-operating-system-information", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Gatekeeper enabled", - "query": "SELECT 1 FROM gatekeeper WHERE assessments_enabled = 1;", - "description": "Checks to make sure that the Gatekeeper feature is enabled on macOS devices. Gatekeeper tries to ensure only trusted software is run on a mac machine.", - "resolution": "To enable Gatekeeper, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable.", - "tags": [ - "compliance", - "hardening", - "built-in", - "cis", - "cis2.5.2.1" - ], - "platform": "darwin", - "contributors": [ - { - "name": "groob", - "handle": "groob", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "gatekeeper-enabled-mac-os", - "requiresMdm": false, - "critical": true - }, - { - "name": "Full disk encryption enabled ", - "query": "SELECT 1 FROM bitlocker_info WHERE drive_letter='C:' AND protection_status=1;", - "description": "Checks to make sure that full disk encryption is enabled on Windows devices.", - "resolution": "To get additional information, run the following osquery query on the failing device: SELECT * FROM bitlocker_info. In the query results, if protection_status is 2, then the status cannot be determined. If it is 0, it is considered unprotected. Use the additional results (percent_encrypted, conversion_status, etc.) to help narrow down the specific reason why Windows considers the volume unprotected.", - "platform": "windows", - "tags": [ - "compliance", - "hardening", - "built-in" - ], - "contributors": [ - { - "name": "defensivedepth", - "handle": "defensivedepth", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/defensivedepth" - } - ], - "kind": "policy", - "slug": "full-disk-encryption-enabled-windows", - "requiresMdm": false, - "critical": true - }, - { - "name": "Full disk encryption enabled", - "query": "SELECT 1 FROM disk_encryption WHERE user_uuid IS NOT \"\" AND filevault_status = 'on' LIMIT 1;", - "description": "Checks to make sure that full disk encryption (FileVault) is enabled on macOS devices.", - "resolution": "To enable full disk encryption, on the failing device, select System Preferences > Security & Privacy > FileVault > Turn On FileVault.", - "tags": [ - "compliance", - "hardening", - "built-in", - "cis", - "cis2.5.1.1" - ], - "platform": "darwin", - "contributors": [ - { - "name": "groob", - "handle": "groob", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "full-disk-encryption-enabled-mac-os", - "requiresMdm": false, - "critical": true - }, - { - "name": "Full disk encryption enabled ", - "query": "SELECT 1 FROM mounts m, disk_encryption d WHERE m.device_alias = d.name AND d.encrypted = 1 AND m.path = '/';", - "description": "Checks if the root drive is encrypted. There are many ways to encrypt Linux systems. This is the default on distributions such as Ubuntu.", - "resolution": "Ensure the image deployed to your Linux workstation includes full disk encryption.", - "platform": "linux", - "tags": [ - "compliance", - "hardening", - "built-in" - ], - "contributors": [ - { - "name": "jbilling", - "handle": "jbilling", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/jbilling" - }, - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "full-disk-encryption-enabled-linux", - "requiresMdm": false, - "critical": true - }, - { - "name": "System Integrity Protection enabled", - "query": "SELECT 1 FROM sip_config WHERE config_flag = 'sip' AND enabled = 1;", - "description": "Checks to make sure that the System Integrity Protection feature is enabled.", - "resolution": "To enable System Integrity Protection, on the failing device, run the following command in the Terminal app: /usr/sbin/spctl --master-enable.", - "tags": [ - "compliance", - "malware", - "hardening", - "built-in", - "cis", - "cis5.1.2" - ], - "platform": "darwin", - "contributors": [ - { - "name": "groob", - "handle": "groob", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "system-integrity-protection-enabled-mac-os", - "requiresMdm": false - }, - { - "name": "Automatic login disabled", - "query": "SELECT 1 FROM managed_policies WHERE domain = 'com.apple.loginwindow' AND name = 'com.apple.login.mcx.DisableAutoLoginClient' AND value = 1 LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent login in without a password.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables automatic login.", - "tags": [ - "compliance", - "hardening", - "built-in" - ], - "platform": "darwin", - "contributors": [ - { - "name": "groob", - "handle": "groob", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "automatic-login-disabled-mac-os", - "requiresMdm": true, - "critical": true - }, - { - "name": "Secure keyboard entry for Terminal application enabled", - "query": "SELECT 1 FROM managed_policies WHERE domain = 'com.apple.Terminal' AND name = 'SecureKeyboardEntry' AND value = 1 LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to enabled secure keyboard entry for the Terminal application.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables secure keyboard entry for the Terminal application.", - "tags": [ - "compliance", - "hardening", - "built-in" - ], - "platform": "darwin", - "contributors": [ - { - "name": "groob", - "handle": "groob", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/groob" - } - ], - "kind": "policy", - "slug": "secure-keyboard-entry-for-terminal-application-enabled-mac-os", - "requiresMdm": true - }, - { - "name": "Get built-in antivirus status on macOS", - "platform": "darwin", - "query": "SELECT path, value AS version FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist') OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist');", - "description": "Reads the version numbers from the Malware Removal Tool (MRT) and built-in antivirus (XProtect) plists", - "purpose": "Informational", - "tags": [ - "compliance", - "malware", - "hardening", - "built-in" - ], - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "query", - "slug": "get-built-in-antivirus-status-on-mac-os", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get antivirus status from the Windows Security Center", - "platform": "windows", - "query": "SELECT antivirus, signatures_up_to_date from windows_security_center CROSS JOIN windows_security_products WHERE type = 'Antivirus';", - "description": "Selects the antivirus and signatures status from Windows Security Center.", - "purpose": "Informational", - "tags": [ - "compliance", - "malware", - "hardening", - "built-in" - ], - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "query", - "slug": "get-antivirus-status-from-the-windows-security-center", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get antivirus (ClamAV/clamd) and updater (freshclam) process status", - "platform": "linux", - "query": "SELECT pid, state, cmdline, name FROM processes WHERE name='clamd' OR name='freshclam';", - "description": "Selects the clamd and freshclam processes to ensure AV and its updater are running", - "purpose": "Informational", - "tags": [ - "compliance", - "malware", - "hardening", - "built-in" - ], - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "query", - "slug": "get-antivirus-clam-av-clamd-and-updater-freshclam-process-status", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Antivirus healthy", - "query": "SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM plist WHERE (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/XProtect.bundle/Contents/Info.plist' AND value>=2162) OR (key = 'CFBundleShortVersionString' AND path = '/Library/Apple/System/Library/CoreServices/MRT.app/Contents/Info.plist' and value>=1.93)) WHERE score == 1;", - "description": "Checks the version of Malware Removal Tool (MRT) and the built-in macOS AV (Xprotect). Replace version numbers with the latest version regularly.", - "resolution": "To enable automatic security definition updates, on the failing device, select System Preferences > Software Update > Advanced > Turn on Install system data files and security updates.", - "tags": [ - "compliance", - "malware", - "hardening", - "built-in", - "template" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "antivirus-healthy-mac-os", - "requiresMdm": false - }, - { - "name": "Antivirus healthy ", - "query": "SELECT 1 from windows_security_center wsc CROSS JOIN windows_security_products wsp WHERE antivirus = 'Good' AND type = 'Antivirus' AND signatures_up_to_date=1;", - "description": "Checks the status of antivirus and signature updates from the Windows Security Center.", - "resolution": "Ensure Windows Defender or your third-party antivirus is running, up to date, and visible in the Windows Security Center.", - "tags": [ - "compliance", - "malware", - "hardening", - "built-in" - ], - "platform": "windows", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "antivirus-healthy-windows", - "requiresMdm": false - }, - { - "name": "Antivirus healthy ", - "query": "SELECT score FROM (SELECT case when COUNT(*) = 2 then 1 ELSE 0 END AS score FROM processes WHERE (name = 'clamd') OR (name = 'freshclam')) WHERE score == 1;", - "description": "Checks that both ClamAV's daemon and its updater service (freshclam) are running.", - "resolution": "Ensure ClamAV and Freshclam are installed and running.", - "tags": [ - "compliance", - "malware", - "hardening", - "built-in" - ], - "platform": "linux", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "antivirus-healthy-linux", - "requiresMdm": false - }, - { - "name": "MDM enrolled", - "query": "SELECT 1 from mdm WHERE enrolled='true';", - "description": "Required: osquery deployed with Orbit, or manual installation of macadmins/osquery-extension. Checks that a mac is enrolled to MDM. Add a AND on identity_certificate_uuid to check for a specific MDM.", - "resolution": "Enroll device to MDM", - "tags": [ - "compliance", - "hardening", - "built-in" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "mdm-enrolled-mac-os", - "requiresMdm": false, - "critical": true - }, - { - "name": "Docker application is up to date or not present", - "query": "SELECT 1 WHERE EXISTS (SELECT 1 FROM apps a1 WHERE a1.bundle_identifier = 'com.electron.dockerdesktop' AND a1.bundle_short_version>='4.6.1') OR NOT EXISTS (SELECT 1 FROM apps a2 WHERE a2.bundle_identifier = 'com.electron.dockerdesktop');", - "description": "Checks if the application (Docker Desktop example) is installed and up to date, or not installed. Fails if the application is installed and on a lower version. You can copy this query and replace the bundle_identifier and bundle_version values to apply the same type of policy to other applications.", - "resolution": "Update Docker or remove it if not used.", - "tags": [ - "inventory", - "vulnerability", - "built-in" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "docker-application-is-up-to-date-or-not-present-mac-os", - "requiresMdm": false - }, - { - "name": "SSH keys encrypted", - "query": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM users CROSS JOIN user_ssh_keys USING (uid) WHERE encrypted='0');", - "description": "Required: osquery must have Full Disk Access. Policy passes if all keys are encrypted, including if no keys are present.", - "resolution": "Use this command to encrypt existing SSH keys by providing the path to the file: ssh-keygen -o -p -f /path/to/file", - "tags": [ - "compliance", - "ssh", - "built-in" - ], - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "platform": "darwin,linux,windows", - "kind": "policy", - "slug": "ssh-keys-encrypted", - "requiresMdm": false - }, - { - "name": "Suspicious autostart ", - "query": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM startup_items WHERE path = \"regsvr32\" AND args LIKE \"%http%\");", - "description": "Checks for an autostart that is attempting to load a dynamic link library (DLL) from the internet.", - "resolution": "Remove the suspicious startup entry.", - "tags": [ - "malware", - "hunting" - ], - "platform": "windows", - "contributors": [ - { - "name": "kswagler-rh", - "handle": "kswagler-rh", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/kswagler-rh" - } - ], - "kind": "policy", - "slug": "suspicious-autostart-windows", - "requiresMdm": false - }, - { - "name": "Firewall enabled", - "query": "SELECT 1 FROM alf WHERE global_state >= 1;", - "description": "Checks if the firewall is enabled.", - "resolution": "In System Preferences, open Security & Privacy, navigate to the Firewall tab and click Turn On Firewall.", - "tags": [ - "hardening", - "compliance", - "built-in", - "cis", - "cis2.5.2.2" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "firewall-enabled-mac-os", - "requiresMdm": false - }, - { - "name": "Screen lock enabled", - "query": "SELECT 1 FROM managed_policies WHERE name='askForPassword' AND value='1';", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to enable screen lock.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables screen lock.", - "tags": [ - "compliance", - "hardening", - "built-in" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "screen-lock-enabled-mac-os", - "requiresMdm": true - }, - { - "name": "Screen lock enabled ", - "query": "SELECT 1 FROM registry WHERE path = 'HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\InactivityTimeoutSecs' AND CAST(data as INTEGER) <= 1800;", - "description": "Checks if the screen lock is enabled and configured to lock the system within 30 minutes or less.", - "resolution": "Contact your IT administrator to enable the Interactive Logon: Machine inactivity limit setting with a value of 1800 seconds or lower.", - "tags": [ - "compliance", - "hardening", - "built-in" - ], - "platform": "windows", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "screen-lock-enabled-windows", - "requiresMdm": false - }, - { - "name": "Password requires 10 or more characters", - "query": "SELECT 1 FROM (SELECT cast(lengthtxt as integer(2)) minlength FROM (SELECT SUBSTRING(length, 1, 2) AS lengthtxt FROM (SELECT policy_description, policy_identifier, split(policy_content, '{', 1) AS length FROM password_policy WHERE policy_identifier LIKE '%minLength')) WHERE minlength >= 10);", - "description": "Checks that the password policy requires at least 10 characters. Requires osquery 5.4.0 or newer.", - "resolution": "Contact your IT administrator to make sure your Mac is receiving configuration profiles for password length.", - "platform": "darwin", - "tags": [ - "compliance", - "hardening", - "built-in", - "cis", - "cis5.2.2" - ], - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "password-requires-10-or-more-characters-mac-os", - "requiresMdm": false - }, - { - "name": "Operating system up to date", - "query": "SELECT 1 FROM os_version WHERE version >= '14.1.1';", - "description": "Checks that the operating system is up to date.", - "resolution": "From the Apple menu () in the corner of your screen choose System Preferences. Then select Software Update and select Upgrade Now. You might be asked to restart or enter your password.", - "tags": [ - "compliance", - "cis", - "template", - "cis1.1" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "operating-system-up-to-date-mac-os", - "requiresMdm": false, - "critical": true - }, - { - "name": "Automatic updates enabled", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticCheckEnabled' AND value=1 LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically check for updates.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic updates.", - "tags": [ - "compliance", - "cis", - "cis1.2" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "automatic-updates-enabled-mac-os", - "requiresMdm": true - }, - { - "name": "Automatic update downloads enabled", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticDownload' AND value=1 LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically download updates.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic update downloads.", - "tags": [ - "compliance", - "cis", - "cis1.3" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "automatic-update-downloads-enabled-mac-os", - "requiresMdm": true - }, - { - "name": "Automatic installation of application updates is enabled", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticallyInstallAppUpdates' AND value=1 LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically install updates to App Store applications.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic installation of application updates.", - "tags": [ - "compliance", - "cis", - "cis1.4" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "automatic-installation-of-application-updates-is-enabled-mac-os", - "requiresMdm": true - }, - { - "name": "Automatic security and data file updates is enabled", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='CriticalUpdateInstall' AND value=1 LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically download updates to built-in macOS security tools such as malware removal tools.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic security and data update installation.", - "tags": [ - "compliance", - "cis", - "cis1.5" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "automatic-security-and-data-file-updates-is-enabled-mac-os", - "requiresMdm": true - }, - { - "name": "Automatic installation of operating system updates is enabled", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.SoftwareUpdate' AND name='AutomaticallyInstallMacOSUpdates' AND value=1 LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically install operating system updates.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic installation of operating system updates.", - "tags": [ - "compliance", - "cis", - "cis1.6" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "automatic-installation-of-operating-system-updates-is-enabled-mac-os", - "requiresMdm": true - }, - { - "name": "Time and date are configured to be updated automatically", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.applicationaccess' AND name='forceAutomaticDateAndTime' AND value=1 LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to automatically update the time and date.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables automatic time and date configuration.", - "tags": [ - "compliance", - "cis", - "cis2.2.1" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "time-and-date-are-configured-to-be-updated-automatically-mac-os", - "requiresMdm": true - }, - { - "name": "Lock screen after inactivity of 20 minutes or less", - "query": "SELECT 1 WHERE EXISTS (SELECT CAST(value as integer(4)) valueint from managed_policies WHERE domain = 'com.apple.screensaver' AND name = 'askForPasswordDelay' AND valueint <= 60 LIMIT 1) AND EXISTS (SELECT CAST(value as integer(4)) valueint from managed_policies WHERE domain = 'com.apple.screensaver' AND name = 'idleTime' AND valueint <= 1140 LIMIT 1) AND EXISTS (SELECT 1 from managed_policies WHERE domain='com.apple.screensaver' AND name='askForPassword' AND value=1 LIMIT 1);", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to lock the screen after 20 minutes or less.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables the screen saver after inactivity of 20 minutes or less.", - "tags": [ - "compliance", - "cis", - "cis2.3.1", - "cis5.8" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "lock-screen-after-inactivity-of-20-minutes-or-less-mac-os", - "requiresMdm": true - }, - { - "name": "Internet sharing is blocked", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.MCX' AND name='forceInternetSharingOff' AND value='1' LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent Internet sharing.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that prevents Internet sharing.", - "tags": [ - "compliance", - "cis", - "cis2.4.2" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "internet-sharing-is-blocked-mac-os", - "requiresMdm": true - }, - { - "name": "Content caching is disabled", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.applicationaccess' AND name='allowContentCaching' AND value='0' LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to disable content caching.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables content caching.", - "tags": [ - "compliance", - "cis", - "cis2.4.10" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "content-caching-is-disabled-mac-os", - "requiresMdm": true - }, - { - "name": "Ad tracking is limited", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.AdLib' AND name='forceLimitAdTracking' AND value='1' LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to limit advertisement tracking.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables advertisement tracking.", - "tags": [ - "compliance", - "cis", - "cis2.5.6" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "ad-tracking-is-limited-mac-os", - "requiresMdm": true - }, - { - "name": "iCloud Desktop and Document sync is disabled", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.icloud.managed' AND name='DisableCloudSync' AND value='1' LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent iCloud Desktop and Documents sync.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile to prevent iCloud Desktop and Documents sync.", - "tags": [ - "compliance", - "cis", - "cis2.6.1.4" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "i-cloud-desktop-and-document-sync-is-disabled-mac-os", - "requiresMdm": true - }, - { - "name": "Firewall logging is enabled", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.security.firewall' AND name='EnableLogging' AND value='1' LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to log firewall activity.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that enables firewall logging.", - "tags": [ - "compliance", - "cis", - "cis3.6" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "firewall-logging-is-enabled-mac-os", - "requiresMdm": true - }, - { - "name": "Guest account disabled", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.loginwindow' AND name='DisableGuestAccount' AND value='1' LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent the use of a guest account.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that disables the guest account.", - "tags": [ - "compliance", - "cis", - "cis6.1.3" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "guest-account-disabled-mac-os", - "requiresMdm": true - }, - { - "name": "Guest access to shared folders is disabled", - "query": "SELECT 1 FROM managed_policies WHERE domain='com.apple.AppleFileServer' AND name='guestAccess' AND value='0' LIMIT 1;", - "description": "Checks that a mobile device management (MDM) solution configures the Mac to prevent guest access to shared folders.", - "resolution": "Contact your IT administrator to ensure your Mac is receiving a profile that prevents guest access to shared folders.", - "tags": [ - "compliance", - "cis", - "cis6.1.4" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "policy", - "slug": "guest-access-to-shared-folders-is-disabled-mac-os", - "requiresMdm": true - }, - { - "name": "No 1Password emergency kit stored in desktop, documents, or downloads folders", - "query": "SELECT 1 WHERE NOT EXISTS (SELECT 1 FROM file WHERE filename LIKE '%Emergency Kit%.pdf' AND (path LIKE '/Users/%/Desktop/%' OR path LIKE '/Users/%/Documents/%' OR path LIKE '/Users/%/Downloads/%' OR path LIKE '/Users/Shared/%'));", - "description": "Looks for PDF files with file names typically used by 1Password for emergency recovery kits. To protect the performance of your devices, the search is one level deep and limited to the Desktop, Documents, Downloads, and Shared folders.", - "resolution": "Delete 1Password emergency kits from your computer, and empty the trash. 1Password emergency kits should only be printed and stored in a physically secure location.", - "platform": "darwin", - "tags": [ - "compliance", - "built-in" - ], - "contributors": [ - { - "name": "nonpunctual", - "handle": "nonpunctual", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/nonpunctual" - } - ], - "kind": "policy", - "slug": "no-1-password-emergency-kit-stored-in-desktop-documents-or-downloads-folders-mac-os", - "requiresMdm": false - }, - { - "name": "Discover TLS certificates", - "platform": "linux, windows, darwin", - "description": "Retrieves metadata about TLS certificates for servers listening on the local machine. Enables mTLS adoption analysis and cert expiration notifications.", - "query": "SELECT * FROM curl_certificate WHERE hostname IN (SELECT DISTINCT 'localhost:'||port FROM listening_ports WHERE protocol=6 AND address!='127.0.0.1' AND address!='::1');", - "purpose": "Informational", - "tags": [ - "network", - "tls" - ], - "contributors": [ - { - "name": "nabilschear", - "handle": "nabilschear", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/nabilschear" - } - ], - "kind": "query", - "slug": "discover-tls-certificates", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Discover Python Packages from Running Python Interpreters", - "platform": "linux, darwin", - "description": "Attempt to discover Python environments (in cwd, path to the python binary, and process command line) from running python interpreters and collect Python packages from those environments.", - "query": "SELECT * FROM python_packages WHERE directory IN (SELECT DISTINCT directory FROM (SELECT SUBSTR(path,0,INSTR(path,'/bin/'))||'/lib' AS directory FROM processes WHERE path LIKE '%/bin/%' AND path LIKE '%python%' UNION SELECT SUBSTR(cmdline,0,INSTR(cmdline,'/bin/'))||'/lib' AS directory FROM processes WHERE cmdline LIKE '%python%' AND cmdline LIKE '%/bin/%' AND path LIKE '%python%' UNION SELECT cwd||'/lib' AS directory FROM processes WHERE path LIKE '%python%'));", - "purpose": "Informational", - "tags": [ - "compliance", - "hunting" - ], - "contributors": [ - { - "name": "nabilschear", - "handle": "nabilschear", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/nabilschear" - } - ], - "kind": "query", - "slug": "discover-python-packages-from-running-python-interpreters", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Identify the default mail, http and ftp applications", - "platforms": "macOS", - "platform": "darwin", - "description": "Lists the currently enabled applications configured to handle mailto, http and ftp schemes.", - "query": "SELECT * FROM app_schemes WHERE (scheme='mailto' OR scheme='http' OR scheme='ftp') AND enabled='1';", - "purpose": "Informational", - "tags": [ - "compliance", - "hunting" - ], - "contributors": [ - { - "name": "brunerd", - "handle": "brunerd", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/brunerd" - } - ], - "kind": "query", - "slug": "identify-the-default-mail-http-and-ftp-applications", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Firewall enabled, domain profile ", - "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\DomainProfile\\EnableFirewall' AND CAST(data as integer) = 1;", - "description": "Checks if a Group Policy configures the computer to enable the domain profile for Windows Firewall. The domain profile applies to networks where the host system can authenticate to a domain controller. Some auditors requires that this setting is configured by a Group Policy.", - "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the domain profile for Windows Firewall.", - "platforms": "Windows", - "tags": [ - "compliance", - "cis", - "cis9.1.1" - ], - "platform": "windows", - "contributors": [ - { - "name": "defensivedepth", - "handle": "defensivedepth", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/defensivedepth" - } - ], - "kind": "policy", - "slug": "firewall-enabled-domain-profile-windows", - "requiresMdm": false - }, - { - "name": "Firewall enabled, private profile ", - "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PrivateProfile\\EnableFirewall' AND CAST(data as integer) = 1;", - "description": "Checks if a Group Policy configures the computer to enable the private profile for Windows Firewall. The private profile applies to networks where the host system is connected to a private or home network. Some auditors requires that this setting is configured by a Group Policy.", - "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the private profile for Windows Firewall.", - "platforms": "Windows", - "tags": [ - "compliance", - "cis", - "cis9.2.1" - ], - "platform": "windows", - "contributors": [ - { - "name": "defensivedepth", - "handle": "defensivedepth", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/defensivedepth" - } - ], - "kind": "policy", - "slug": "firewall-enabled-private-profile-windows", - "requiresMdm": false - }, - { - "name": "Firewall enabled, public profile ", - "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\WindowsFirewall\\PublicProfile\\EnableFirewall' AND CAST(data as integer) = 1;", - "description": "Checks if a Group Policy configures the computer to enable the public profile for Windows Firewall. The public profile applies to networks where the host system is connected to public networks such as Wi-Fi hotspots at coffee shops and airports. Some auditors requires that this setting is configured by a Group Policy.", - "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that enables the public profile for Windows Firewall.", - "platforms": "Windows", - "tags": [ - "compliance", - "cis", - "cis9.3.1" - ], - "platform": "windows", - "contributors": [ - { - "name": "defensivedepth", - "handle": "defensivedepth", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/defensivedepth" - } - ], - "kind": "policy", - "slug": "firewall-enabled-public-profile-windows", - "requiresMdm": false - }, - { - "name": "SMBv1 client driver disabled ", - "query": "SELECT 1 FROM windows_optional_features WHERE name = 'SMB1Protocol-Client' AND state != 1;", - "description": "Checks that the SMBv1 client is disabled.", - "resolution": "Contact your IT administrator to discuss disabling SMBv1 on your system.", - "platforms": "Windows", - "tags": [ - "compliance", - "cis", - "cis18.3.2", - "built-in" - ], - "platform": "windows", - "contributors": [ - { - "name": "defensivedepth", - "handle": "defensivedepth", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/defensivedepth" - } - ], - "kind": "policy", - "slug": "sm-bv-1-client-driver-disabled-windows", - "requiresMdm": false - }, - { - "name": "SMBv1 server disabled ", - "query": "SELECT 1 FROM windows_optional_features WHERE name = 'SMB1Protocol-Server' AND state != 1", - "description": "Checks that the SMBv1 server is disabled.", - "resolution": "Contact your IT administrator to discuss disabling SMBv1 on your system.", - "platforms": "Windows", - "tags": [ - "compliance", - "cis", - "cis18.3.3", - "built-in" - ], - "platform": "windows", - "contributors": [ - { - "name": "defensivedepth", - "handle": "defensivedepth", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/defensivedepth" - } - ], - "kind": "policy", - "slug": "sm-bv-1-server-disabled-windows", - "requiresMdm": false - }, - { - "name": "Link-Local Multicast Name Resolution (LLMNR) disabled ", - "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows NT\\DNSClient\\EnableMulticast' AND CAST(data as integer) = 0;", - "description": "Checks if a Group Policy configures the computer to disable LLMNR. Disabling LLMNR can prevent malicious actors from gaining access to the computer's credentials. Some auditors require that this setting is configured by a Group Policy.", - "resolution": "Contact your IT administrator to ensure your computer is receiving a Group Policy that disables LLMNR on your system.", - "platforms": "Windows", - "tags": [ - "compliance", - "cis", - "cis18.5.4.2" - ], - "platform": "windows", - "contributors": [ - { - "name": "defensivedepth", - "handle": "defensivedepth", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/defensivedepth" - } - ], - "kind": "policy", - "slug": "link-local-multicast-name-resolution-llmnr-disabled-windows", - "requiresMdm": false - }, - { - "name": "Automatic updates enabled ", - "query": "SELECT 1 FROM registry WHERE path LIKE 'HKEY_LOCAL_MACHINE\\Software\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\\NoAutoUpdate' AND CAST(data as integer) = 0;", - "description": "Checks if a Group Policy configures the computer to enable Automatic Updates. When enabled, the computer downloads and installs security and other important updates automatically. Some auditors require that this setting is configured by a Group Policy.", - "resolution": "Contact your IT administrator to ensure your computer is receiving a Group policy that enables Automatic Updates.", - "platforms": "Windows", - "tags": [ - "compliance", - "cis", - "cis18.9.108.2.1" - ], - "platform": "windows", - "contributors": [ - { - "name": "defensivedepth", - "handle": "defensivedepth", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/defensivedepth" - } - ], - "kind": "policy", - "slug": "automatic-updates-enabled-windows", - "requiresMdm": false - }, - { - "name": "Identify Apple development secrets", - "query": "SELECT * FROM keychain_items WHERE label LIKE '%ABCDEFG%';", - "description": "Identifies certificates associated with Apple development signing and notarization. Replace ABCDEFG with your company's identifier.", - "tags": [ - "compliance", - "inventory", - "built-in" - ], - "platform": "darwin", - "contributors": [ - { - "name": "GuillaumeRoss", - "handle": "GuillaumeRoss", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/GuillaumeRoss" - } - ], - "kind": "query", - "slug": "identify-apple-development-secrets-mac-os", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Geolocate via ipapi.co", - "platform": "darwin, linux, windows", - "description": "Geolocate a host using the [ipapi.co](https://ipapi.co) in an emergency. Requires the curl table. [Learn more](https://fleetdm.com/guides/locate-assets-with-osquery).", - "query": "SELECT JSON_EXTRACT(result, '$.ip') AS ip, JSON_EXTRACT(result, '$.city') AS city, JSON_EXTRACT(result, '$.region') AS region, JSON_EXTRACT(result, '$.country') AS country, JSON_EXTRACT(result, '$.latitude') AS latitude, JSON_EXTRACT(result, '$.longitude') AS longitude FROM curl WHERE url = 'http://ipapi.co/json';", - "purpose": "inventory", - "tags": [ - "inventory" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "geolocate-via-ipapi-co", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get Crowdstrike Falcon network content filter status", - "platform": "darwin", - "description": "Get the status of the Crowdstrike Falcon network content filter (as in \"System Settings\" > \"Network > \"Filters\").", - "query": "/* Load up the plist */ WITH extensions_plist AS (SELECT *, rowid FROM plist WHERE path = '/Library/Preferences/com.apple.networkextension.plist') /* Find the first \"Enabled\" key after the key indicating the crowdstrike app */ SELECT value AS enabled FROM extensions_plist WHERE subkey = 'Enabled' AND rowid > (SELECT rowid FROM extensions_plist WHERE value = 'com.crowdstrike.falcon.App') LIMIT 1;", - "purpose": "Informational", - "tags": [ - "crowdstrike", - "plist", - "network", - "content filter" - ], - "contributors": [ - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-crowdstrike-falcon-network-content-filter-status", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "Get a list of Visual Studio Code extensions", - "platform": "darwin, linux, windows", - "description": "Get a list of installed VS Code extensions (requires osquery > 5.11.0).", - "query": "SELECT u.username, vs.* FROM users u CROSS JOIN vscode_extensions vs USING (uid);\n", - "purpose": "Informational", - "tags": [ - "inventory" - ], - "contributors": [ - { - "name": "lucasmrod", - "handle": "lucasmrod", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/lucasmrod" - }, - { - "name": "sharon-fdm", - "handle": "sharon-fdm", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/sharon-fdm" - }, - { - "name": "zwass", - "handle": "zwass", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/zwass" - } - ], - "kind": "query", - "slug": "get-a-list-of-visual-studio-code-extensions", - "resolution": "N/A", - "requiresMdm": false - }, - { - "name": "List osquery table names", - "platform": "darwin, linux, windows", - "description": "List all table names in the schema of the currently installed version of osquery", - "query": "SELECT DISTINCT name FROM osquery_registry;", - "purpose": "Informational", - "tags": [ - "fleet", - "osquery", - "table", - "schema" - ], - "contributors": [ - { - "name": "nonpunctual", - "handle": "nonpunctual", - "avatarUrl": "https://placekitten.com/200/200", - "htmlUrl": "https://github.com/nonpunctual" - } - ], - "kind": "query", - "slug": "list-osquery-table-names", - "resolution": "N/A", - "requiresMdm": false - } - ], - "queryLibraryYmlRepoPath": "docs/01-Using-Fleet/standard-query-library/standard-query-library.yml", - "pricingTable": [ - { - "industryName": "Managed cloud", - "description": "Have Fleet host it for you (currently only available for customers with 300+ hosts. PS. Wish we could host for you? We're working on it! Please let us know if you know of a good partner. In the meantime, join fleetdm.com/support and we're happy to help you deploy Fleet yourself.)", - "pricingTableCategories": [ - "Deployment" - ], - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "name": "Managed cloud" - }, - { - "industryName": "Self-hosted", - "friendlyName": "Host it yourself", - "description": "Deploy Fleet anywhere and host it yourself, even in air-gapped environments except where technologically impossible.", - "pricingTableCategories": [ - "Deployment" - ], - "documentationUrl": "https://fleetdm.com/docs/deploy/introduction", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "buzzwords": [ - "Self-hosted" - ], - "name": "Self-hosted" - }, - { - "industryName": "Multi-tenancy", - "description": "For managed service providers to use a single instance of Fleet for multiple customers.", - "documentationUrl": "https://github.com/fleetdm/fleet/issues/9956", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Deployment" - ], - "usualDepartment": "IT", - "buzzwords": [ - "OEM", - "Private label", - "House brand", - "Clear label", - "Multi-tenancy" - ], - "tier": "Premium", - "name": "Multi-tenancy" - }, - { - "industryName": "Deployment tools", - "description": "Pre-built Terraform modules and Helm charts to help you get up and running.", - "documentationUrl": "https://fleetdm.com/docs/deploy/introduction", - "usualDepartment": "IT", - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Deployment" - ], - "name": "Deployment tools" - }, - { - "industryName": "Private update registry", - "friendlyName": "Update agents from a secret URL", - "description": "Load agent code from a secret URL that you manage.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/update-agents", - "tier": "Premium", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Configuration" - ], - "usualDepartment": "Security", - "name": "Private update registry" - }, - { - "industryName": "Control agent versions", - "description": "Manage agents remotely by setting different versions per-baseline.", - "documentationUrl": "https://fleetdm.com/docs/configuration/agent-configuration#configure-fleetd-update-channels", - "tier": "Premium", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Configuration" - ], - "usualDepartment": "IT", - "waysToUse": [ - { - "description": "Supply-chain Levels for Software Artifacts (SLSA) attestations for the fleetd binary artifacts and server container image to enable verification that the binaries are built and uploaded using GitHub Actions from the Fleet repository at a particular commit SHA coming soon (2024-12-31)." - }, - { - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/20219" - } - ], - "name": "Control agent versions" - }, - { - "industryName": "Command line tool (CLI)", - "friendlyName": "fleetctl", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleetctl-cli", - "productCategories": [ - "Endpoint operations", - "Device management" - ], - "pricingTableCategories": [ - "Configuration" - ], - "usualDepartment": "IT", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "name": "Command line tool (CLI)" - }, - { - "industryName": "GitOps", - "friendlyName": "Manage endpoints in git", - "documentationUrl": "https://github.com/fleetdm/fleet-gitops", - "description": "Fork the best practices GitHub repo and use the included GitHub Actions or GitLab CI/CD pipelines to quickly automate Fleet console and configuration workflow management.", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Configuration" - ], - "usualDepartment": "IT", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "demos": { - "description": "A top savings and investment company wanted workflows and automation so that one bad actor can't brick their fleet. This way, they have to make a pull request first.", - "quote": "I don't want one bad actor to brick my fleet. I want them to make a pull request first.", - "moreInfoUrl": "https://docs.google.com/document/d/1hAQL6P--Tt3syq1MTRONAxhQA_2Vjt3oOJJt_O4xbiE/edit?disco=AAABAVnYvns&usp_dm=true#heading=h.7en766pueek4" - }, - "name": "GitOps" - }, - { - "industryName": "Two-factor authentication", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/5478", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Configuration" - ], - "usualDepartment": "IT", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "waysToUse": [ - { - "description": "Enforce two-factor authentication when logging in to Fleet for added security." - } - ], - "comingSoonOn": "2024-12-31", - "name": "Two-factor authentication", - "comingSoon": true - }, - { - "industryName": "Role-based access control", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/manage-access#manage-access", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Configuration" - ], - "usualDepartment": "IT", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "name": "Role-based access control" - }, - { - "industryName": "Audit logging", - "description": "Log all activity, including queries, scripts, access, etc.", - "demos": [ - { - "description": "See activities for enabling/disabling the activities webhook and editing the destination URL so that I can know when the activities webhook was modified and by who.", - "moreInfoUrl": "https://youtu.be/3Fndgrsk-Ss" - } - ], - "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#list-activities", - "productCategories": [ - "Endpoint operations", - "Device management" - ], - "pricingTableCategories": [ - "Configuration" - ], - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "usualDepartment": "Security", - "waysToUse": [ - { - "description": "Export activity of Fleet admins to your SIEM or data lake" - } - ], - "name": "Audit logging" - }, - { - "industryName": "Scope transparency", - "description": "Let end users see the source code for exactly how they are being monitored, and set clear expectations about what is and isn’t acceptable use of work computers.", - "tier": "Free", - "documentationUrl": "https://fleetdm.com/transparency", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Configuration" - ], - "name": "Scope transparency" - }, - { - "industryName": "Cross-platform MDM support", - "description": "Apple, Windows, and Linux.", - "documentationUrl": "https://fleetdm.com/announcements/debunk-the-cross-platform-myth", - "tier": "Premium", - "jamfProHasFeature": "appleOnly", - "jamfProtectHasFeature": "no", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "name": "Cross-platform MDM support" - }, - { - "industryName": "MDM migration", - "description": "Easily move your devices from your current MDM solution to Fleet.", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-migration-guide", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "name": "MDM migration" - }, - { - "industryName": "Zero-touch setup", - "description": "Zero-touch setup for macOS, iOS/iPadOS, and Windows.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience", - "tier": "Premium", - "jamfProHasFeature": "appleOnly", - "jamfProtectHasFeature": "no", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "waysToUse": [ - { - "description": "Ship a macOS, iOS, or iPadOS device to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup." - }, - { - "description": "Ship a Windows workstation to the end user's home and have them automatically enroll to Fleet during out-of-the-box setup." - }, - { - "description": "Customize the out-of-the-box setup experience for your end users." - }, - { - "description": "Install a bootstrap package to run custom scripts during the setup experience." - }, - { - "description": "Require end users to authenticate with your identity provider (IdP) and agree to an end user license agreement (EULA) before they can use their new workstation" - } - ], - "demos": [ - { - "description": "Install a bootstrap package to run custom scripts during the setup experience to enforce required configurations.", - "moreInfoUrl": "https://youtu.be/gt7_dAU0VMY" - }, - { - "description": "Connect end users to Wi-Fi by adding your SCEP server.", - "moreInfoUrl": "https://youtu.be/secV4NCGYPg" - } - ], - "name": "Zero-touch setup" - }, - { - "industryName": "Bring your own device (BYOD) enrollment", - "description": "BYOD enrollment for macOS, iOS/iPadOS, Windows, and Android (coming soon) devices.", - "documentationUrl": "https://fleetdm.com/guides/sysadmin-diaries-device-enrollment#byod-enrollment", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "waysToUse": [ - { - "description": "Support ACME as a protocol for MDM certificate generation. Coming soon (2025-03-31)", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/15611" - } - ], - "name": "Bring your own device (BYOD) enrollment" - }, - { - "industryName": "User account sync", - "description": "Sync user accounts via Okta, AD, or any IDP.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-macos-setup-experience", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "IT", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "waysToUse": [ - { - "description": "Automatically set admin access to Fleet based on your IDP" - } - ], - "name": "User account sync" - }, - { - "industryName": "Human-endpoint mapping", - "friendlyName": "See who logs in on every computer", - "description": "Identify who logs in to any system, including login history and current sessions. Look up any host by the email address of the person using it.", - "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#get-hosts-google-chrome-profiles", - "screenshotSrc": null, - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "IT", - "buzzwords": [ - "Device users", - "human-to-device mapping" - ], - "dri": "mikermcneil", - "demos": [ - { - "description": "Security engineers at a top gaming company wanted to get demographics off their macOS, Windows, and Linux machines about who the user is and who's logged in.", - "moreInfoUrl": "https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit" - }, - { - "description": "Data engineers at a top biotech corporation needed to know who is logged into their devices.", - "quote": "So we don't know exactly what's going on after we deploy the device, we know that they are compliant with the security because we are running these stuff, but we don't know certainly who is running, who is logging in the device?", - "moreInfoUrl": "https://docs.google.com/document/d/17MNI5ykzlFjdVmQ8SPMrT1oR_hY_vkYAJx31F7l7Pv8/edit#heading=h.7en766pueek4" - } - ], - "waysToUse": [ - { - "description": "Look up computer by ActiveDirectory account" - }, - { - "description": "Find device by Google Chrome user" - }, - { - "description": "Identify who logs in to any system, including login history and current sessions." - }, - { - "description": "Look up any host by the email address of the person using it." - }, - { - "description": "Check user login history", - "moreInfoUrl": "https://www.lepide.com/how-to/audit-who-logged-into-a-computer-and-when.html#:~:text=To%20find%20out%20the%20details,logs%20in%20%E2%80%9CWindows%20Logs%E2%80%9D." - }, - { - "description": "See currently logged in users", - "moreInfoUrl": "https://www.top-password.com/blog/see-currently-logged-in-users-in-windows/" - }, - { - "description": "Get demographics off of our machines about who the user is and who's logged in", - "moreInfoUrl": "https://docs.google.com/document/d/1qFYtMoKh3zyERLhbErJOEOo2me6Bc7KOOkjKn482Sqc/edit" - }, - { - "description": "See what servers someone is logged-in on", - "moreInfoUrl": "https://community.spiceworks.com/topic/138171-is-there-a-way-to-see-what-servers-someone-is-logged-in-on" - } - ], - "name": "Human-endpoint mapping" - }, - { - "industryName": "Device inventory", - "description": "Includes a list of all devices and all hardware and software attributes for each device.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/understanding-host-vitals", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14415", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "usualDepartment": "IT", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "waysToUse": [ - { - "description": "Implement software inventory recommendations from the SANS 20 / CIS 18.", - "moreInfoUrl": "https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4" - }, - { - "description": "View a list of all hardware attributes of a device.", - "moreInfoUrl": "https://fleetdm.com/tables/system_info" - }, - { - "description": "View a list of all software and their versions installed on all your hosts.", - "moreInfoUrl": "https://fleetdm.com/docs/get-started/anatomy#software-library" - }, - { - "description": "View a list of software rolled up by title.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14674" - }, - { - "description": "Implement hardware and infrastructure inventory recommendations from the SANS 20 / CIS 18.", - "moreInfoUrl": "https://docs.google.com/document/d/1E6EQMMqrsRc6Z3YsR6Q33OaF9eAa8zLNaz4K2YzFdyo/edit#heading=h.7en766pueek4" - } - ], - "name": "Device inventory" - }, - { - "industryName": "Search inventory", - "description": "Search devices by IP, serial, hostname, and UUID.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/learn-how-to-use-fleet#how-to-ask-questions-about-your-device", - "productCategories": [ - "Endpoint operations", - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "IT", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "name": "Search inventory" - }, - { - "industryName": "Targeted device scoping", - "description": "Organize devices with Teams and Labels.", - "documentationUrl": "https://fleetdm.com/guides/managing-labels-in-fleet", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "name": "Targeted device scoping" - }, - { - "industryName": "Enforce disk encryption", - "description": "Encrypt system drives on macOS, Windows, and Linux, manage escrowed encryption keys, and report on disk encryption status (FileVault, BitLocker, LUKS).", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-disk-encryption", - "friendlyName": "Ensure hard disks are encrypted", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "Security", - "tier": "Premium", - "jamfProHasFeature": "appleOnly", - "jamfProtectHasFeature": "no", - "waysToUse": [ - { - "description": "Report on disk encryption status" - }, - { - "description": "Encrypt hard disks on macOS with FileVault" - }, - { - "description": "Escrow FileVault keys on macOS" - }, - { - "description": "Encrypt hard disks on Windows with BitLocker." - } - ], - "name": "Enforce disk encryption" - }, - { - "industryName": "Enforce operating system (OS) updates", - "description": "Keep operating systems up to date for macOS, iOS/iPadOS, Windows, and Android (coming soon) devices.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-macos-updates", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "usualDepartment": "IT", - "productCategories": [ - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "waysToUse": [ - { - "description": "Enforce macOS updates via Nudge." - }, - { - "description": "Progressively enhance from Nudge to DDM-based OS updates.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/17295" - }, - { - "description": "Automatically update Windows after the end user reaches a deadline." - } - ], - "name": "Enforce operating system (OS) updates" - }, - { - "industryName": "Enforce OS settings", - "description": "MDM support for macOS, iOS/iPadOS, Windows, and Android (coming soon) devices. Management support for Linux.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-custom-os-settings", - "usualDepartment": "IT", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "waysToUse": [ - { - "description": "Deploy configuration profiles on macOS and Windows and verify that they're installed.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/13281" - }, - { - "description": "Deploy custom declaration (DDM) profiles on macOS.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14550" - }, - { - "description": "Target profiles to specific hosts using SQL.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/17315" - }, - { - "description": "Automatically re-deploy configuration profiles when they're not installed." - }, - { - "description": "Deploy configuration profiles on iOS/iPadOS." - }, - { - "description": "See a list of the upcoming MDM commands and scripts in unified queue. Coming soon (2024-07-15)", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/15920" - }, - { - "description": "Send MDM commands to tell end users to update their OS.", - "moreInfoUrl": "https://developer.apple.com/documentation/devicemanagement/schedule_an_os_update" - }, - { - "description": "Configure agent options remotely, over the air. (Includes osquery config, and osquery startup flags.).", - "moreInfoUrl": "https://fleetdm.com/docs/configuration/agent-configuration" - } - ], - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "name": "Enforce OS settings" - }, - { - "industryName": "Declarative Device Management (DDM) support for configuration profiles", - "description": "Full support for Apple DDM configuration profiles.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-os-updates#macos", - "tier": "Free", - "jamfProHasFeature": "cloudOnly", - "jamfProtectHasFeature": "cloudOnly", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "name": "Declarative Device Management (DDM) support for configuration profiles" - }, - { - "industryName": "Device health", - "friendlyName": "Automate device health", - "description": "Automatically report system health issues using webhooks or integrations, to notify or quarantine outdated or misconfigured systems that are at higher risk of vulnerabilities or theft.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/automations#automations", - "screenshotSrc": null, - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "yes", - "productCategories": [ - "Device management", - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "IT", - "dri": "mikermcneil", - "buzzwords": [ - "Device trust", - "Zero trust", - "Layer 7 device trust", - "Beyondcorp", - "Device attestation", - "Conditional access" - ], - "waysToUse": [ - { - "description": "Automatically manage the behavior of endpoints that are at higher risk of vulnerabilities or data loss due to their configuration or patch level." - }, - { - "description": "Block access to corporate apps for users whose devices with unexpected settings, like disabled screen lock, passwords that are too short, unencrypted hard disks, and more" - }, - { - "description": "Quickly implement conditional access based on device health using osquery and a simple device health REST API.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14920" - }, - { - "description": "Control and restore access to applications by automatically restricting access when devices do not meet particular security requirements.", - "moreInfoUrl": "https://duo.com/docs/device-health" - } - ], - "demos": [ - { - "description": "Control which laptop and desktop devices can access corporate apps and websites based on what vulnerabilities it might be exposed to based on how the device is configured, whether it's up to date, its MDM enrollment status, and anything else you can build in a SQL query of Fleet's 300 data tables representing information about enrolled host systems. Coming soon (2024-09-30).", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/16236" - }, - { - "description": "Implement multivariate device trust", - "moreInfoUrl": "https://youtu.be/5sFOdpMLXQg?feature=shared&t=1445" - }, - { - "description": "Implement your own version of Google's zero trust model (BeyondCorp)", - "moreInfoUrl": "https://cloud.google.com/beyondcorp" - }, - { - "description": "Get endpoint data into ServiceNow and make your asset management teams happy", - "moreInfoUrl": "https://www.youtube.com/watch?v=aVbU6_9JoM0" - }, - { - "description": "Monitor devices that don't meet your organization's custom security policies" - }, - { - "description": "Quickly report your posture and vulnerabilities to auditors, showing remediation status and timing." - }, - { - "description": "Keep your devices compliant with customizable baselines, or use common benchmarks like CIS." - }, - { - "description": "Discover security misconfigurations that increase attack surface." - }, - { - "description": "Detect suspcious services listening on open ports that should not be connected to the internet, such as Remote Desktop Protocol (RDP).", - "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20statename%20%3D%20%E2%80%9CEnabled%E2%80%9D-,OPEN%20SOCKETS,-Lastly%2C%20an%20examination" - }, - { - "description": "Discover potentially unwanted programs that increase attack surface.", - "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/" - }, - { - "description": "Detect self-signed certifcates" - }, - { - "description": "Detect legacy protocols with safer versions", - "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WHERE%20self_signed%20%3D%201%3B-,LEGACY%20PROTOCOLS,-This%20section%20will" - }, - { - "description": "Detect exposed secrets on the command line", - "moreInfoUrl": "https://paraflare.com/articles/vulnerability-management-via-osquery/#:~:text=WDigest%20is%20disabled.-,EXPOSED%20SECRETS,-Often%2C%20to%20create" - }, - { - "description": "Detect and surface issues with devices" - }, - { - "description": "Share device health reports" - }, - { - "description": "Align endpoints with your security policies", - "moreInfoUrl": "https://www.axonius.com/use-cases/cmdb-reconciliation" - }, - { - "description": "Maximize security control coverage" - }, - { - "description": "Uncover gaps in security policies, configurations, and hygiene", - "moreInfoUrl": "https://www.axonius.com/use-cases/coverage-gap-discovery" - }, - { - "description": "Automatically apply security policies to protect endpoints against attack." - }, - { - "description": "Surface security issues in all your deployed endpoints even data centers and factories." - }, - { - "description": "Continually validate controls and policies" - }, - { - "description": "Block access to corporate apps if your end users are failing a specific number of critical policies.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/16206" - }, - { - "description": "A large tech company used the Fleet API to block access to corporate apps for outdated operating system versions with certain \"celebrity\" vulnerabilities.", - "moreInfoUrl": "https://play.goconsensus.com/s4e490bb9" - } - ], - "name": "Device health" - }, - { - "industryName": "Application deployment", - "description": "Deploy applications on macOS, iOS/iPadOS, Linux, Windows, and Android (coming soon). Additionally, install macOS and iOS/iPadOS apps from the App Store.", - "documentationUrl": "https://fleetdm.com/guides/deploy-software-packages", - "tier": "Premium", - "jamfProHasFeature": "appleOnly", - "jamfProtectHasFeature": "no", - "isExperimental": "yes", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/18867", - "waysToUse": [ - { - "description": "Easily configure and install SentinelOne, Crowdstrike, and other security tools.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14921" - }, - { - "description": "Offer licenses for Photoshop and other App Sore apps for your end users." - }, - { - "description": "iOS/iPadOS coming soon (2024-08-11).", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/14899" - } - ], - "name": "Application deployment" - }, - { - "industryName": "Self-service application installation", - "description": "Allow end users to install apps through Fleet Desktop for macOS, Linux, and Windows.", - "documentationUrl": "https://fleetdm.com/guides/deploy-software-packages", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "isExperimental": "yes", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/17587", - "waysToUse": [ - { - "description": "Build scripts for Ansible deployments", - "moreInfoUrl": "https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4" - }, - { - "description": "Deploy osquery to macOS via Jamf", - "moreInfoUrl": "https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4" - }, - { - "description": "Package osquery for Linux servers via Workspace One and Windows servers via group policies", - "moreInfoUrl": "https://www.youtube.com/watch?v=qflUfLQCnwY&list=PL6-FgoWOoK2YUR4ADGsxTSL3onb-GzCnM&index=4" - } - ], - "name": "Self-service application installation" - }, - { - "industryName": "Application management", - "description": "Manage updates and apps on macOS, Windows, and Linux computers.", - "tier": "Premium", - "jamfProHasFeature": "appleOnly", - "jamfProtectHasFeature": "no", - "comingSoonOn": "2024-08-25", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/18865", - "name": "Application management", - "comingSoon": true - }, - { - "industryName": "Script execution", - "friendlyName": "Safely execute custom scripts (macOS, Windows, and Linux)", - "description": "Deploy and execute custom scripts using a REST API, and manage your library of scripts in the UI or a git repo.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/scripts", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "dri": "mikermcneil", - "usualDepartment": "IT", - "productCategories": [ - "Endpoint operations", - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "demos": [ - { - "description": "A large tech company used scripts to fix issues with their security and compliance agents on workstations.", - "moreInfoUrl": "https://youtu.be/o1G0YZAsWzI" - } - ], - "buzzwords": [ - "Remote script execution", - "PowerShell scripts", - "Bash scripts" - ], - "waysToUse": [ - { - "description": "Execute custom macOS scripts (client platform engineering)", - "moreInfoUrl": "https://www.hexnode.com/blogs/executing-custom-mac-scripts-via-mdm/" - }, - { - "description": "Execute custom Windows scripts (client platform engineering)", - "moreInfoUrl": "https://www.hexnode.com/blogs/executing-custom-windows-scripts-via-mdm/" - }, - { - "description": "Use PowerShell scripts on Windows devices", - "moreInfoUrl": "https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension" - }, - { - "description": "Run PowerShell scripts for remediations (security engineering)", - "moreInfoUrl": "https://learn.microsoft.com/en-us/mem/intune/fundamentals/powershell-scripts-remediation" - }, - { - "description": "Download and run remediation scripts", - "moreInfoUrl": "https://help.zscaler.com/deception/downloading-and-running-remediation-script" - }, - { - "description": "Deploy custom scripts", - "moreInfoUrl": "https://scalefusion.com/custom-scripting" - }, - { - "description": "Run scripts on online/offline hosts", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/15529" - }, - { - "description": "Only maintainers and admins can run scripts.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/19055" - } - ], - "name": "Script execution" - }, - { - "industryName": "Device remediation", - "description": "Use Fleet Policies to detect the device state. Automate remediations for issues or allow users to remediate problems in self-service (Fleet Desktop > My device page).", - "documentationUrl": "https://fleetdm.com/securing/end-user-self-remediation", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "usualDepartment": "IT", - "productCategories": [ - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "waysToUse": [ - { - "description": "Send software vulnerability emails to end users to encourage self-remediation." - } - ], - "name": "Device remediation" - }, - { - "industryName": "Maintenance windows", - "friendlyName": "Fleet in your calendar", - "description": "Create a calendar event to auto-remediate failing policies when your end users are free.", - "documentationUrl": "https://github.com/fleetdm/fleet/issues/17230", - "tier": "Premium", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "isExperimental": "yes", - "productCategories": [ - "Device management", - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "name": "Maintenance windows" - }, - { - "industryName": "Send lock and wipe commands", - "description": "Secure your devices with remote lock and wipe commands if lost or stolen.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/mdm-commands", - "waysToUse": [ - { - "description": "High-level remote lock for macOS, Windows, and Linux.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/9949" - }, - { - "description": "High-level remote wipe for macOS, Windows, and Linux.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/9951" - } - ], - "tier": "Premium", - "jamfProHasFeature": "appleOnly", - "jamfProtectHasFeature": "no", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Devices" - ], - "name": "Send lock and wipe commands" - }, - { - "industryName": "Queries", - "description": "Scheduled or saved queries with optional AI-generated descriptions, and, live queries for real-time data collection.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleet-ui", - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "IT", - "demos": [ - { - "description": "A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.", - "moreInfoUrl": "https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6" - } - ], - "name": "Queries" - }, - { - "industryName": "Query performance monitoring", - "documentationUrl": "https://fleetdm.com/docs/get-started/faq#will-fleet-slow-down-my-servers-what-about-my-employee-laptops", - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "demos": [ - { - "description": "A top software company needed to understand the performance impact of osquery queries before running them on all of their production Linux servers.", - "moreInfoUrl": "https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg" - }, - { - "description": "A top software company wanted to detect regressions when adding/changing queries and fail builds if queries were too expensive.", - "moreInfoUrl": "https://docs.google.com/document/d/1WzMc8GJCRU6tTBb6gLsSTzFysqtXO8CtP2sXMPKgYSk/edit?disco=AAAA6xuVxGg" - } - ], - "waysToUse": [ - { - "description": "Monitor performance for automated queries." - }, - { - "description": "Monitor performance for live queries.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/467" - } - ], - "name": "Query performance monitoring" - }, - { - "industryName": "Custom tables", - "friendlyName": "Add tables to osquery with extensions", - "description": "Create your own osquery tables, extensions & automatic table configurations or disable existing tables to maintain PII or privacy.", - "documentationUrl": "https://fleetdm.com/docs/configuration/agent-configuration#extensions", - "moreInfoUrl": "https://github.com/trailofbits/osquery-extensions/blob/3df2b72ad78549e25344c79dbc9bce6808c4d92a/README.md#extensions", - "tier": "Premium", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "IT", - "name": "Custom tables" - }, - { - "industryName": "Remote settings", - "description": "Configure agent options remotely, over the air. (Includes osquery config, and osquery startup flags.).", - "documentationUrl": "https://fleetdm.com/docs/configuration/agent-configuration", - "moreInfoUrl": "https://github.com/fleetdm/fleet/issues/13825", - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "Security", - "name": "Remote settings" - }, - { - "industryName": "Teams", - "friendlyName": "Manage different endpoints differently", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/segment-hosts", - "description": "Teams are what Fleet calls baselines, kinda like security groups or images. Every host in a team matches the same baseline, with minor exceptions. This makes it faster and less risky to maintain computers, leading to faster timelines and fewer tickets.", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "waysToUse": [ - { - "description": "Automate remediation for different applications with different security postures (cloud security engineering)" - } - ], - "name": "Teams" - }, - { - "industryName": "Labels", - "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#add-label", - "friendlyName": "Filter hosts using SQL", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "IT", - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "name": "Labels" - }, - { - "industryName": "Policies", - "description": "A policy is a specific “yes” or “no” query. Use policies to manage security compliance in your organization.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleet-ui", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "IT", - "demos": [ - { - "description": "Policy failure in Fleet to trigger a script run on a host so that I can run scripts on many hosts w/o using a third-party automation tool (ex. Tines).", - "moreInfoUrl": "https://youtu.be/o1G0YZAsWzI" - }, - { - "description": "A top financial services company needed to set up rolling deployments for changes to osquery agents running on their production servers.", - "moreInfoUrl": "https://docs.google.com/document/d/1UdzZMyBLbs9SUXfSXN2x2wZQCbjZZUetYlNWH6-ryqQ/edit#heading=h.2lh6ehprpvl6" - } - ], - "waysToUse": [ - { - "description": "Trigger a workflow based on a failing policy", - "moreInfoUrl": "https://fleetdm.com/docs/using-fleet/automations#policy-automations" - } - ], - "name": "Policies" - }, - { - "industryName": "File integrity monitoring (FIM)", - "friendlyName": "Detect changes to critical files", - "description": "Specify files to monitor for changes or deletions, then log those events to your SIEM or data lake, including key information such as filepath and checksum.", - "documentationUrl": "https://fleetdm.com/guides/osquery-evented-tables-overview#file-integrity-monitoring-fim", - "screenshotSrc": "", - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "yes", - "usualDepartment": "Security", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "dri": "mikermcneil", - "demos": [ - { - "description": "A top gaming company needed a way to monitor critical files on production Debian servers.", - "quote": "The FIM features are kind of a top priority.", - "moreInfoUrl": "https://docs.google.com/document/d/1pE9U-1E4YDiy6h4TorszrTOiFAauFiORikSUFUqW7Pk/edit" - } - ], - "buzzwords": [ - "File integrity monitoring (FIM)", - "Host-based intrusion detection system (HIDS)", - "Anomaly detection" - ], - "waysToUse": [ - { - "description": "Monitor critical files on production Debian servers" - }, - { - "description": "Detect anomalous filesystem activity", - "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring" - }, - { - "description": "Detect unintended changes", - "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring" - }, - { - "description": "Verify update status and monitor system health", - "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring" - }, - { - "description": "Meet compliance mandates", - "moreInfoUrl": "https://www.beyondtrust.com/resources/glossary/file-integrity-monitoring" - } - ], - "name": "File integrity monitoring (FIM)" - }, - { - "industryName": "File carving", - "description": "Write the results of complex queries to AWS S3.", - "documentationUrl": "https://fleetdm.com/docs/configuration/fleet-server-configuration#s-3-file-carving-backend", - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "usualDepartment": "Security", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "name": "File carving" - }, - { - "industryName": "Binary authorization", - "friendlyName": "Restrict what programs can run, and what files running programs can access.", - "description": null, - "documentationUrl": null, - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "dri": "mikermcneil", - "usualDepartment": "Security", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "comingSoonOn": "2025-06-30", - "buzzwords": [ - "Mandatory Access Control (MAC)", - "Privilege confinement", - "Binary authorization", - "Santa", - "Binary allowlisting", - "Binary whitelisting" - ], - "demos": [ - { - "description": null, - "moreInfoUrl": null - } - ], - "waysToUse": [ - { - "description": "Confine programs to a limited set of resources." - }, - { - "description": "Report on AppArmor events", - "moreInfoUrl": "https://fleetdm.com/tables/apparmor_events" - }, - { - "description": "Confine programs according to a set of rules that specify which files a program can access.", - "moreInfoUrl": "https://wiki.debian.org/AppArmor" - }, - { - "description": "Proactively protect the system against both known and unknown vulnerabilities." - } - ], - "name": "Binary authorization", - "comingSoon": true - }, - { - "industryName": "Reporting", - "description": "Generate reports based on searchable device attributes", - "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api#get-query-report", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "IT", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "name": "Reporting" - }, - { - "industryName": "Incident response", - "friendlyName": "Interrogate hosts in real time", - "description": "Live query, triage, figuring out scope of impact, remediate using scripts or MDM commands (e.g. remote wipe), and quarantine or reimage using other systems and APIs (e.g. remove from network, decommission container)", - "documentationUrl": "https://fleetdm.com/securing/how-osquery-can-help-cyber-responders#simplifying-endpoint-visibility-with-osquery-and-fleet", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "dri": "mikermcneil", - "usualDepartment": "Security", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "buzzwords": [], - "demos": [ - { - "description": null, - "moreInfoUrl": null - } - ], - "waysToUse": [ - { - "description": null - } - ], - "name": "Incident response" - }, - { - "industryName": "Custom logging", - "description": "Flexible, configurable logging destinations (AWS Kinesis, Lambda, GCP, Kafka).", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/log-destinations#log-destinations", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "usualDepartment": "Security", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Devices" - ], - "buzzwords": [ - "Real-time export", - "Ship logs" - ], - "name": "Custom logging" - }, - { - "industryName": "Malware detection (YARA/custom IoCs)", - "friendlyName": "Scan files for zero days and malware signatures", - "description": "Use YARA signatures to report and trigger automations when zero days, malware, or unexpected files are detected on a host.", - "documentationUrl": "https://fleetdm.com/tables/yara", - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "yes", - "dri": "mikermcneil", - "usualDepartment": "Security", - "productCategories": [ - "Endpoint operations", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "buzzwords": [ - "YARA scanning", - "Cyber Threat Intelligence (CTI)", - "Indicators of compromise (IOCs)", - "Antivirus (AV)", - "Endpoint protection platform (EPP)", - "Endpoint detection and response (EDR)", - "Malware detection", - "Signature-based malware detection", - "Malware scanning", - "Malware analysis", - "Anomaly detection" - ], - "demos": [ - { - "description": "A top media company used Fleet policies with YARA rules to continuously scan host filesystems for malware signatures provided by internal and external threat intelligence teams.", - "moreInfoUrl": null - } - ], - "waysToUse": [ - { - "description": "Detect suspicious bytecode in JAR files" - }, - { - "description": "Identify suspicious patterns in binaries using YARA signatures" - }, - { - "description": "Continuously scan host filesystems for malware signatures.", - "moreInfoUrl": "https://yara.readthedocs.io/en/stable/writingrules.html" - }, - { - "description": "Monitor for relevent filesystem changes (YARA events) and on-demand YARA signature scans.", - "moreInfoUrl": "https://osquery.readthedocs.io/en/stable/deployment/yara/" - }, - { - "description": "Use YARA for malware detection", - "moreInfoUrl": "https://www.cisa.gov/sites/default/files/FactSheets/NCCIC%20ICS_FactSheet_YARA_S508C.pdf" - }, - { - "description": "Scan for indicators of compromise (IoC) for common malware.", - "moreInfoUrl": "https://github.com/Cisco-Talos/osquery_queries" - }, - { - "description": "Analyze malware using data from osquery, such as endpoint certificates and launch daemons (launchd).", - "moreInfoUrl": "https://medium.com/hackernoon/malware-analysis-using-osquery-part-3-9dc805b67d16" - }, - { - "description": "Detect persistent malware (e.g. WireLurker) in endpoints by generating simple policies that search for their static indicators of compromise (IoCs).", - "moreInfoUrl": "https://osquery.readthedocs.io/en/stable/deployment/anomaly-detection/" - }, - { - "description": "Run a targeted YARA scan with osquery as a lightweight approach to scan anything on a host filesystem, with minimal performance impact. Unlike full system YARA scans which consume considerable CPU resources, an equivalent YARA scan targeted in Fleet can be 8x cheaper (CPU %).", - "moreInfoUrl": "https://www.tripwire.com/state-of-security/signature-socket-based-malware-detection-osquery-yara" - } - ], - "name": "Malware detection (YARA/custom IoCs)" - }, - { - "industryName": "Continuous scanning", - "friendlyName": "Detect vulnerable software", - "documentationUrl": "https://fleetdm.com/vulnerability-management", - "productCategories": [ - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "usualDepartment": "Security", - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "yes", - "buzzwords": [ - "Stakeholder-specific vulnerability categorization (SSVC)", - "Continuous scanning", - "Continuous vulnerability scanning", - "Risk-based vulnerability management" - ], - "waysToUse": [ - { - "description": "Use an SSVC decision tree model to prioritize relevant vulnerabilities into four possible decisions: \"Track\", \"Track*\", \"Attend\", and \"Act\".", - "moreInfoUrl": "https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc" - }, - { - "description": "Balint Fazakas: I think what offers a better use of CVSS if you break it down to vectors. You may find that a DoS (High Availability Impact) not as relevant for you, or equally a vulnerability requiring user interaction has a very low likelihood of exploit in another scenario. If you want to fine tune your SSVC, it worth using the vectors you care about instead of the score itself. But ultimately you would want to read the description of the vulnerabilities to determine the risk they are posing to your environment. SSVC can assist you to do that in a more efficient way.", - "moreInfoUrl": "https://www.linkedin.com/feed/update/urn:li:activity:7162614115025215488?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7162614115025215488%2C7162681703918985216%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287162681703918985216%2Curn%3Ali%3Aactivity%3A7162614115025215488%29" - }, - { - "description": "Melissa Bischoping: CVSS is never enough to contextualize the urgency or risk of a vulnerability in your environment. It is one metric that needs to be part of an overall risk calculus, but a CVSS of 6 can be a greater threat in your organization than a CVSS of 10 based on the environmental variables and mitigations. Only two 10.0s here, but several lower severity that are resulting in high-impact breaches. Getting a handle on managing that public facing infrastructure and being able to rapidly patch the apps and devices with such exposure needs to be part of an overall plan, but must go hand in hand with mitigations and layers of a zero trust design. CVSS isn’t the sole determination of risk, it’s only one partial piece of data to understand the impact of a vulnerability if exploited.", - "moreInfoUrl": "https://www.linkedin.com/feed/update/urn:li:activity:7162614115025215488?commentUrn=urn%3Ali%3Acomment%3A%28activity%3A7162614115025215488%2C7162629486344159232%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287162629486344159232%2Curn%3Ali%3Aactivity%3A7162614115025215488%29" - } - ], - "demos": [ - { - "description": "A top gaming company wanted to replace Qualys for infrastructure vulnerability detection.", - "quote": "So we have some stuff today through Qualys, but it's just not very good. A lot of it is...it's just really noisy. I'm trying to find out specifically, actually what packages are installed where, and then the ability to live query them.", - "moreInfoUrl": "https://docs.google.com/document/d/1JWtRsW1FUTCkZEESJj9-CvXjLXK4219by-C6vvVVyBY/edit" - }, - { - "description": "One of the world's largest, top transportation companies uses Fleet's API to email relevant, actually-installed vulnerabilities to responsible teams so they can fix them.", - "moreInfoUrl": "https://docs.google.com/document/d/1oeCmT077o_5nxzLhnxs7kcg_4Qn1Pn1F5zx10nQOAp8/edit" - } - ], - "name": "Continuous scanning" - }, - { - "industryName": "Vulnerability scores", - "friendlyName": "EPSS and CVSS", - "documentationUrl": "https://fleetdm.com/vulnerability-management", - "tier": "Premium", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "yes", - "usualDepartment": "Security", - "productCategories": [ - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "buzzwords": [ - "Risk scores", - "Cyber risk", - "Risk reduction", - "Security operations effectiveness", - "Peer benchmarking", - "Security program effectiveness", - "Risk-based exposure scoring", - "Threat context", - "Cyber exposure", - "Exposure quantification and benchmarking", - "Optimize security investments", - "Vulnerability assessment" - ], - "demos": [ - { - "description": "Fleet enables a more modern, threat-first prioritization approach to vulnerability management.", - "quote": "In reality, across our inventory of devices, it's unlikely to ever be exploited. I'd rather do that legwork on my team and then go and ask and prioritize work on these infrastructure teams that are already busy with things that could or could not be vulnerable. Being able to be more exact allows us to go to these teams less, which saves everybody time.", - "moreInfoUrl": "https://www.youtube.com/watch?v=G5Ry_vQPaYc&t=131s" - } - ], - "waysToUse": [ - { - "description": "By leveraging EPSS (Exploit Prediction Scoring System), security professionals gain insight on the true risk behind rated CVEs." - }, - { - "description": "An Introduction to EPSS, The Exploit Prediction Scoring System" - }, - { - "moreInfoUrl": "https://www.youtube.com/watch?v=vw1RlZCSRcQ" - }, - { - "description": "By extracting metadata from the National Vulnerability Database (NVD) and Microsoft Security Response Center (MSRC), we can determine which version of software is no longer vulnerable." - } - ], - "name": "Vulnerability scores" - }, - { - "industryName": "CISA KEVs", - "description": "Known exploited vulnerabilities", - "documentationUrl": "https://fleetdm.com/vulnerability-management", - "tier": "Premium", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "yes", - "usualDepartment": "Security", - "productCategories": [ - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "demos": [ - { - "description": null, - "moreInfoUrl": null - } - ], - "waysToUse": [ - { - "description": "Help teams work on vulnerabilities that have actually been exploited (CISA KEVs) or have a high probability of being exploited (EPSS), or whatever is important in your environment." - }, - { - "description": "Use CISA KEVs for vulnerability management" - }, - { - "moreInfoUrl": "https://www.youtube.com/watch?v=Z3mw2oxssYk" - } - ], - "name": "CISA KEVs" - }, - { - "industryName": "Asset discovery", - "documentationUrl": null, - "tier": "Premium", - "comingSoonOn": "2025-06-30", - "usualDepartment": "Security", - "productCategories": [ - "Vulnerability management" - ], - "pricingTableCategories": [ - "Devices" - ], - "name": "Asset discovery", - "comingSoon": true - }, - { - "industryName": "REST API", - "friendlyName": "Automate any feature", - "description": null, - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Integrations" - ], - "usualDepartment": "IT", - "documentationUrl": "https://fleetdm.com/docs/rest-api/rest-api", - "screenshotSrc": null, - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "dri": "rachaelshaw", - "name": "REST API" - }, - { - "industryName": "Webhooks", - "friendlyName": "Automations", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/automations#automations", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Integrations" - ], - "usualDepartment": "IT", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "name": "Webhooks" - }, - { - "industryName": "Grant API-only access", - "description": "Grant API-only access to accounts exclusively for automation.", - "documentationUrl": "https://fleetdm.com/docs/using-fleet/fleetctl-cli#using-fleetctl-with-an-api-only-user", - "productCategories": [ - "Endpoint operations" - ], - "pricingTableCategories": [ - "Integrations" - ], - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "name": "Grant API-only access" - }, - { - "industryName": "Single sign on", - "description": "SSO, SAML", - "documentationUrl": "https://fleetdm.com/docs/deploy/single-sign-on-sso#single-sign-on-sso", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Integrations" - ], - "usualDepartment": "IT", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "name": "Single sign on" - }, - { - "industryName": "Automatic user creation (JIT, SCIM)", - "description": "Auto-create and manipulate Fleet users from Okta, etc with just-in-time (JIT) provisioning.", - "documentationUrl": "https://fleetdm.com/docs/deploy/single-sign-on-sso#just-in-time-jit-user-provisioning", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Integrations" - ], - "usualDepartment": "IT", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "name": "Automatic user creation (JIT, SCIM)" - }, - { - "industryName": "Grant Wi-Fi access", - "description": "Help your end users connect to Wi-Fi by adding your Simple Certificate Enrollment Protocol (SCEP) server.", - "documentationUrl": "https://fleetdm.com/guides/ndes-scep-proxy", - "isExperimental": "yes", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Integrations" - ], - "usualDepartment": "IT", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "no", - "name": "Grant Wi-Fi access" - }, - { - "industryName": "Third-party automation", - "friendlyName": "Borrow off-the-shelf tactics from the community", - "documentationUrl": "https://fleetdm.com/integrations", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Integrations" - ], - "usualDepartment": "IT", - "description": "Plug Fleet into other frameworks and tools like Tines, Snowflake, Terraform, Chronicle, Jira, Zendesk, etc", - "moreInfoUrl": "https://fleetdm.com/integrations", - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "waysToUse": [ - { - "description": "(ActiveDirectory) Know who opened your computer and check their device posture before you let them log into anything." - }, - { - "description": "(Ansible) Easily issue MDM commands and standardize data across operating systems." - }, - { - "description": "(AWS) Deploy your own self-managed Fleet in any AWS environment in minutes." - }, - { - "description": "(Azure) Deploy your own self-managed Fleet in the Microsoft Cloud in minutes." - }, - { - "description": "(Chef) Easily issue MDM commands and standardize data across operating systems." - }, - { - "description": "(Elastic) Ingest osquery data and monitor for important changes or events." - }, - { - "description": "(GitHub) Version control using git, enabling collaboration and a GitOps workflow." - }, - { - "description": "(GitLab) Version control using git, enabling collaboration and a GitOps workflow." - }, - { - "description": "(Chronicle) Ingest osquery data and monitor for important changes or events." - }, - { - "description": "(Google Cloud) Deploy your own self-managed Fleet in any GCP environment in minutes." - }, - { - "description": "(Munki) Easily issue MDM commands and standardize data across operating systems." - }, - { - "description": "(Okta) Know who opened your computer and check their device posture before you let them log into anything." - }, - { - "description": "(Snowflake) Ingest osquery data and monitor for important changes or events." - }, - { - "description": "(Splunk) Ingest osquery data and monitor for important changes or events." - }, - { - "description": "(Tines) Build custom workflows that trigger in various situations." - }, - { - "description": "(Webhooks) Configure automations that send webhooks to specific URLs when Fleet detects changes to host, policy, and CVE statuses." - }, - { - "description": "(Zendesk) Automatically create Zendesk tickets in various situations." - }, - { - "description": "(Jira) Automatically create Jira tickets in various situations, including exporting vulnerabilities to Jira and syncing tickets." - } - ], - "buzzwords": [ - "Snowflake", - "Okta", - "Tines", - "Splunk", - "Elastic", - "AWS", - "ActiveDirectory", - "Ansible", - "GitHub", - "GitLab", - "Chronicle", - "Google Cloud", - "Munki", - "Vanta", - "Chef", - "Zendesk", - "Jira" - ], - "name": "Third-party automation" - }, - { - "industryName": "Third-party orchestration", - "friendlyName": "Borrow off-the-shelf tactics from legendary brands", - "documentationUrl": "https://fleetdm.com/integrations", - "description": "Plug Fleet into other frameworks and tools like Puppet, Vanta, etc.", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Integrations" - ], - "usualDepartment": "IT", - "moreInfoUrl": "https://fleetdm.com/integrations", - "tier": "Premium", - "waysToUse": [ - { - "description": "(Vanta) Trigger a workflow based on a failing policy." - }, - { - "description": "(Puppet) Easily issue MDM commands, standardize data across operating systems, and map macOS+Windows settings to computers with the Puppet module." - }, - { - "description": "(Torq) Build custom workflows that trigger in various situations." - }, - { - "description": "(Custom IdP) Manage access to Fleet single sign-on (SSO) through any IdP (using SAML)." - } - ], - "buzzwords": [ - "Vanta", - "Puppet", - "Custom IdP" - ], - "name": "Third-party orchestration" - }, - { - "industryName": "Munki compatibility + visibility", - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "usualDepartment": "IT", - "productCategories": [ - "Device management" - ], - "pricingTableCategories": [ - "Integrations" - ], - "name": "Munki compatibility + visibility" - }, - { - "industryName": "Open-source issue tracker (GitHub)", - "documentationUrl": "https://fleetdm.com/support", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Support" - ], - "tier": "Free", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "name": "Open-source issue tracker (GitHub)" - }, - { - "industryName": "Community Slack channel", - "documentationUrl": "https://fleetdm.com/support", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Support" - ], - "tier": "Free", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "name": "Community Slack channel" - }, - { - "industryName": "Unlimited email support (confidential)", - "documentationUrl": "https://fleetdm.com/support", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Support" - ], - "tier": "Premium", - "jamfProHasFeature": "yes", - "jamfProtectHasFeature": "yes", - "name": "Unlimited email support (confidential)" - }, - { - "industryName": "Phone and video call support", - "documentationUrl": "https://fleetdm.com/support", - "productCategories": [ - "Endpoint operations", - "Device management", - "Vulnerability management" - ], - "pricingTableCategories": [ - "Support" - ], - "tier": "Premium", - "jamfProHasFeature": "no", - "jamfProtectHasFeature": "no", - "name": "Phone and video call support" - } - ], - "markdownPages": [ - { - "url": "/docs", - "title": "Readme.md", - "lastModifiedAt": 1734534697136, - "htmlId": "docs--readme--d133ffb011", - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "README.md", - "meta": {} - }, - { - "url": "/docs/configuration", - "title": "Configuration", - "lastModifiedAt": 1734534697143, - "htmlId": "docs--readme--ddf1e60450", - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Configuration/README.md", - "meta": {} - }, - { - "url": "/docs/configuration/agent-configuration", - "title": "Agent configuration", - "lastModifiedAt": 1734534697150, - "htmlId": "docs--agent-configuration--28ccc33560", - "pageOrderInSectionPath": 300, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Configuration/agent-configuration.md", - "meta": { - "description": "Learn how to use configuration files and the fleetctl command line tool to configure agent options." - } - }, - { - "url": "/docs/configuration/fleet-server-configuration", - "title": "Fleet server configuration", - "lastModifiedAt": 1734534697171, - "htmlId": "docs--fleet-server-configu--5509d828bb", - "pageOrderInSectionPath": 100, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Configuration/fleet-server-configuration.md", - "meta": { - "description": "This page includes resources for configuring the Fleet binary, managing osquery configurations, and running with systemd." - } - }, - { - "url": "/docs/configuration/yaml-files", - "title": "YAML files", - "lastModifiedAt": 1734534697179, - "htmlId": "docs--yaml-files--961f0eb479", - "pageOrderInSectionPath": 1500, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Configuration/yaml-files.md", - "meta": { - "description": "Reference documentation for Fleet's GitOps workflow. See examples and configuration options." - } - }, - { - "url": "/docs/get-started/anatomy", - "title": "Anatomy", - "lastModifiedAt": 1734534697181, - "htmlId": "docs--anatomy--0b7973aa43", - "pageOrderInSectionPath": 200, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Get started/anatomy.md", - "meta": {} - }, - { - "url": "/docs/get-started/faq", - "title": "FAQ", - "lastModifiedAt": 1734534697186, - "htmlId": "docs--faq--33c429aedb", - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Get started/FAQ.md", - "meta": { - "description": "Commonly asked questions and answers about deployment from the Fleet community." - } - }, - { - "url": "/docs/get-started/tutorials-and-guides", - "title": "Tutorials and guides", - "lastModifiedAt": 1734534697187, - "htmlId": "docs--tutorials-and-guides--d7d293cf2a", - "pageOrderInSectionPath": 300, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Get started/tutorials-and-guides.md", - "meta": { - "description": "Links to deployment tutorials and guides for using Fleet." - } - }, - { - "url": "/docs/get-started", - "title": "Get started", - "lastModifiedAt": 1734534697188, - "htmlId": "docs--readme--c02033f051", - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Get started/README.md", - "meta": {} - }, - { - "url": "/docs/get-started/why-fleet", - "title": "Why Fleet", - "lastModifiedAt": 1734534697189, - "htmlId": "docs--why-fleet--6a246a126f", - "pageOrderInSectionPath": 100, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Get started/why-fleet.md", - "meta": {} - }, - { - "url": "/docs/deploy", - "title": "Deploy", - "lastModifiedAt": 1734534697190, - "htmlId": "docs--readme--62a515b41e", - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Deploy/README.md", - "meta": { - "description": "An overview of the deployment documentation for Fleet." - } - }, - { - "url": "/docs/deploy/reference-architectures", - "title": "Reference architectures", - "lastModifiedAt": 1734534697193, - "htmlId": "docs--reference-architectu--3b4bd5bb7d", - "pageOrderInSectionPath": 400, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Deploy/Reference-Architectures.md", - "meta": { - "description": "An opinionated view of running Fleet in a production environment, and configuration strategies to enable high availability." - } - }, - { - "url": "/docs/deploy/upgrading-fleet", - "title": "Upgrading Fleet", - "lastModifiedAt": 1734534697195, - "htmlId": "docs--upgrading-fleet--6e6fc4f536", - "pageOrderInSectionPath": 300, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Deploy/Upgrading-Fleet.md", - "meta": { - "description": "Learn how to upgrade your Fleet instance to the latest version." - } - }, - { - "url": "/docs/rest-api", - "title": "REST API", - "lastModifiedAt": 1734534697196, - "htmlId": "docs--readme--1bffac2a59", - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "REST API/README.md", - "meta": {} - }, - { - "url": "/docs/deploy/deploy-fleet", - "title": "Hosting Fleet", - "lastModifiedAt": 1734534697198, - "htmlId": "docs--deploy-fleet--fa48d6e20d", - "pageOrderInSectionPath": 100, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Deploy/deploy-fleet.md", - "meta": { - "description": "Learn how to easily deploy Fleet on Render or AWS with Terraform." - } - }, - { - "url": "/docs/deploy/single-sign-on-sso", - "title": "Single sign-on (SSO)", - "lastModifiedAt": 1734534697200, - "htmlId": "docs--single-sign-on-sso--16a1231e46", - "pageOrderInSectionPath": 200, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Deploy/single-sign-on-sso.md", - "meta": { - "description": "Learn how to configure single sign-on (SSO)" - } - }, - { - "url": "/docs/rest-api/rest-api", - "title": "REST API", - "lastModifiedAt": 1734534698922, - "htmlId": "docs--rest-api--8d1b37a5fd", - "pageOrderInSectionPath": 30, - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "REST API/rest-api.md", - "meta": { - "description": "Documentation for Fleet's REST API. See example requests and responses for each API endpoint." - } - }, - { - "url": "/docs/using-fleet", - "title": "Using Fleet", - "lastModifiedAt": 1734534698925, - "htmlId": "docs--readme--6c54a58964", - "docNavCategory": "Uncategorized", - "sectionRelativeRepoPath": "Using Fleet/README.md", - "meta": {} - }, - { - "url": "/handbook", - "title": "Readme.md", - "lastModifiedAt": 1734534698932, - "htmlId": "handbook--readme--bc2d5750a9", - "sectionRelativeRepoPath": "README.md", - "meta": { - "maintainedBy": "mikermcneil" - }, - "linksForHandbookIndex": [ - { - "headingText": "Introduction", - "hashLink": "/handbook#introduction" - } - ] - }, - { - "url": "/handbook/company", - "title": "🔭 Company", - "lastModifiedAt": 1734534698935, - "htmlId": "handbook--readme--d66c6b87ff", - "sectionRelativeRepoPath": "company/README.md", - "meta": { - "maintainedBy": "mikermcneil" - }, - "linksForHandbookIndex": [ - { - "headingText": "Purpose", - "hashLink": "/handbook/company#purpose" - }, - { - "headingText": "Culture", - "hashLink": "/handbook/company#culture" - }, - { - "headingText": "Open positions", - "hashLink": "/handbook/company#open-positions" - }, - { - "headingText": "Values", - "hashLink": "/handbook/company#values" - }, - { - "headingText": "History", - "hashLink": "/handbook/company#history" - }, - { - "headingText": "Org chart", - "hashLink": "/handbook/company#org-chart" - }, - { - "headingText": "Advisors", - "hashLink": "/handbook/company#advisors" - } - ] - }, - { - "url": "/handbook/company/communications", - "title": "🛰️ Communications", - "lastModifiedAt": 1734534698948, - "htmlId": "handbook--communications--6a843af48e", - "sectionRelativeRepoPath": "company/communications.md", - "meta": { - "maintainedBy": "mikermcneil" - }, - "linksForHandbookIndex": [ - { - "headingText": "All hands", - "hashLink": "/handbook/company/communications#all-hands" - }, - { - "headingText": "Strategy", - "hashLink": "/handbook/company/communications#strategy" - }, - { - "headingText": "Customer support service level agreements (SLAs)", - "hashLink": "/handbook/company/communications#customer-support-service-level-agreements-sl-as" - }, - { - "headingText": "Directly responsible individuals (DRIs)", - "hashLink": "/handbook/company/communications#directly-responsible-individuals-dr-is" - }, - { - "headingText": "Tech stack admins", - "hashLink": "/handbook/company/communications#tech-stack-admins" - }, - { - "headingText": "Fleetdm.com", - "hashLink": "/handbook/company/communications#fleetdm-com" - }, - { - "headingText": "Marketing programs", - "hashLink": "/handbook/company/communications#marketing-programs" - }, - { - "headingText": "Meetings", - "hashLink": "/handbook/company/communications#meetings" - }, - { - "headingText": "Skip-level 1:1 meetings ", - "hashLink": "/handbook/company/communications#skip-level-1-1-meetings" - }, - { - "headingText": "Zoom", - "hashLink": "/handbook/company/communications#zoom" - }, - { - "headingText": "Levels of confidentiality", - "hashLink": "/handbook/company/communications#levels-of-confidentiality" - }, - { - "headingText": "Google Drive", - "hashLink": "/handbook/company/communications#google-drive" - }, - { - "headingText": "Email relays", - "hashLink": "/handbook/company/communications#email-relays" - }, - { - "headingText": "Slack", - "hashLink": "/handbook/company/communications#slack" - }, - { - "headingText": "GitHub", - "hashLink": "/handbook/company/communications#git-hub" - }, - { - "headingText": "High priority user stories and bugs", - "hashLink": "/handbook/company/communications#high-priority-user-stories-and-bugs" - }, - { - "headingText": "Figma", - "hashLink": "/handbook/company/communications#figma" - }, - { - "headingText": "Spending company money", - "hashLink": "/handbook/company/communications#spending-company-money" - }, - { - "headingText": "Travel", - "hashLink": "/handbook/company/communications#travel" - }, - { - "headingText": "SOC 2", - "hashLink": "/handbook/company/communications#soc-2" - }, - { - "headingText": "Vendor questionnaires ", - "hashLink": "/handbook/company/communications#vendor-questionnaires" - }, - { - "headingText": "Getting a contract reviewed", - "hashLink": "/handbook/company/communications#getting-a-contract-reviewed" - }, - { - "headingText": "Getting a contract signed", - "hashLink": "/handbook/company/communications#getting-a-contract-signed" - }, - { - "headingText": "Trust", - "hashLink": "/handbook/company/communications#trust" - }, - { - "headingText": "Benefits", - "hashLink": "/handbook/company/communications#benefits" - }, - { - "headingText": "Compensation", - "hashLink": "/handbook/company/communications#compensation" - }, - { - "headingText": "Team member onboarding", - "hashLink": "/handbook/company/communications#team-member-onboarding" - }, - { - "headingText": "Feedback", - "hashLink": "/handbook/company/communications#feedback" - }, - { - "headingText": "Equipment", - "hashLink": "/handbook/company/communications#equipment" - }, - { - "headingText": "Writing", - "hashLink": "/handbook/company/communications#writing" - }, - { - "headingText": "Writing in Fleet-flavored Markdown", - "hashLink": "/handbook/company/communications#writing-in-fleet-flavored-markdown" - }, - { - "headingText": "Commonly used terms", - "hashLink": "/handbook/company/communications#commonly-used-terms" - } - ] - }, - { - "url": "/handbook/company/handbook", - "title": "Handbook", - "lastModifiedAt": 1734534698950, - "htmlId": "handbook--handbook--863319719d", - "sectionRelativeRepoPath": "company/handbook.md", - "meta": { - "maintainedBy": "mike-j-thomas" - }, - "linksForHandbookIndex": [ - { - "headingText": "Contributing to the handbook", - "hashLink": "/handbook/company/handbook#contributing-to-the-handbook" - } - ] - }, - { - "url": "/handbook/company/leadership", - "title": "🛠️ Leadership", - "lastModifiedAt": 1734534698955, - "htmlId": "handbook--leadership--fb97554e3a", - "sectionRelativeRepoPath": "company/leadership.md", - "meta": { - "maintainedBy": "mikermcneil" - }, - "linksForHandbookIndex": [ - { - "headingText": "CEO flaws", - "hashLink": "/handbook/company/leadership#ceo-flaws" - }, - { - "headingText": "Contact the CEO", - "hashLink": "/handbook/company/leadership#contact-the-ceo" - }, - { - "headingText": "CEO responsibilities", - "hashLink": "/handbook/company/leadership#ceo-responsibilities" - }, - { - "headingText": "Outline of departmental page structure", - "hashLink": "/handbook/company/leadership#outline-of-departmental-page-structure" - }, - { - "headingText": "Key reviews", - "hashLink": "/handbook/company/leadership#key-reviews" - }, - { - "headingText": "Adding an advisor", - "hashLink": "/handbook/company/leadership#adding-an-advisor" - }, - { - "headingText": "Hiring a consultant", - "hashLink": "/handbook/company/leadership#hiring-a-consultant" - }, - { - "headingText": "Hiring", - "hashLink": "/handbook/company/leadership#hiring" - }, - { - "headingText": "Interviewing", - "hashLink": "/handbook/company/leadership#interviewing" - }, - { - "headingText": "Creating a new position", - "hashLink": "/handbook/company/leadership#creating-a-new-position" - }, - { - "headingText": "Recruiting", - "hashLink": "/handbook/company/leadership#recruiting" - }, - { - "headingText": "Hiring a new team member", - "hashLink": "/handbook/company/leadership#hiring-a-new-team-member" - }, - { - "headingText": "Create a 30-60-90 day plan", - "hashLink": "/handbook/company/leadership#create-a-30-60-90-day-plan" - }, - { - "headingText": "CEO shadow program", - "hashLink": "/handbook/company/leadership#ceo-shadow-program" - }, - { - "headingText": "Tracking hours", - "hashLink": "/handbook/company/leadership#tracking-hours" - }, - { - "headingText": "Communicating departures", - "hashLink": "/handbook/company/leadership#communicating-departures" - }, - { - "headingText": "Request a role change for a Fleetie", - "hashLink": "/handbook/company/leadership#request-a-role-change-for-a-fleetie" - }, - { - "headingText": "Delivering performance feedback", - "hashLink": "/handbook/company/leadership#delivering-performance-feedback" - } - ] - }, - { - "url": "/handbook/company/product-groups", - "title": "🛩️ Product groups", - "lastModifiedAt": 1734534698962, - "htmlId": "handbook--product-groups--9150cdf4bc", - "sectionRelativeRepoPath": "company/product-groups.md", - "meta": { - "maintainedBy": "lukeheath" - }, - "linksForHandbookIndex": [ - { - "headingText": "Product roadmap", - "hashLink": "/handbook/company/product-groups#product-roadmap" - }, - { - "headingText": "What are product groups?", - "hashLink": "/handbook/company/product-groups#what-are-product-groups" - }, - { - "headingText": "Current product groups", - "hashLink": "/handbook/company/product-groups#current-product-groups" - }, - { - "headingText": "Making changes", - "hashLink": "/handbook/company/product-groups#making-changes" - }, - { - "headingText": "Outages", - "hashLink": "/handbook/company/product-groups#outages" - }, - { - "headingText": "Scaling Fleet", - "hashLink": "/handbook/company/product-groups#scaling-fleet" - }, - { - "headingText": "Load testing", - "hashLink": "/handbook/company/product-groups#load-testing" - }, - { - "headingText": "Version support", - "hashLink": "/handbook/company/product-groups#version-support" - }, - { - "headingText": "Release testing", - "hashLink": "/handbook/company/product-groups#release-testing" - }, - { - "headingText": "Feature fest", - "hashLink": "/handbook/company/product-groups#feature-fest" - }, - { - "headingText": "Quality", - "hashLink": "/handbook/company/product-groups#quality" - }, - { - "headingText": "How to reach the developer on-call", - "hashLink": "/handbook/company/product-groups#how-to-reach-the-developer-on-call" - }, - { - "headingText": "Wireframes", - "hashLink": "/handbook/company/product-groups#wireframes" - }, - { - "headingText": "Meetings", - "hashLink": "/handbook/company/product-groups#meetings" - }, - { - "headingText": "Development best practices", - "hashLink": "/handbook/company/product-groups#development-best-practices" - }, - { - "headingText": "Product design conventions", - "hashLink": "/handbook/company/product-groups#product-design-conventions" - }, - { - "headingText": "Scrum at Fleet", - "hashLink": "/handbook/company/product-groups#scrum-at-fleet" - }, - { - "headingText": "Sprints", - "hashLink": "/handbook/company/product-groups#sprints" - }, - { - "headingText": "Outside contributions", - "hashLink": "/handbook/company/product-groups#outside-contributions" - } - ] - }, - { - "url": "/handbook/company/why-this-way", - "title": "💭 Why this way?", - "lastModifiedAt": 1734534698967, - "htmlId": "handbook--why-this-way--e6d06610c1", - "sectionRelativeRepoPath": "company/why-this-way.md", - "meta": { - "maintainedBy": "mikermcneil" - }, - "linksForHandbookIndex": [ - { - "headingText": "Why open source?", - "hashLink": "/handbook/company/why-this-way#why-open-source" - }, - { - "headingText": "Why handbook-first strategy?", - "hashLink": "/handbook/company/why-this-way#why-handbook-first-strategy" - }, - { - "headingText": "Why read documentation?", - "hashLink": "/handbook/company/why-this-way#why-read-documentation" - }, - { - "headingText": "Why the emphasis on training?", - "hashLink": "/handbook/company/why-this-way#why-the-emphasis-on-training" - }, - { - "headingText": "Why direct responsibility?", - "hashLink": "/handbook/company/why-this-way#why-direct-responsibility" - }, - { - "headingText": "Why do we use a wireframe-first approach?", - "hashLink": "/handbook/company/why-this-way#why-do-we-use-a-wireframe-first-approach" - }, - { - "headingText": "Why do we use one repo?", - "hashLink": "/handbook/company/why-this-way#why-do-we-use-one-repo" - }, - { - "headingText": "Why not continuously generate REST API reference docs from javadoc-style code comments?", - "hashLink": "/handbook/company/why-this-way#why-not-continuously-generate-rest-api-reference-docs-from-javadoc-style-code-comments" - }, - { - "headingText": "Why group Slack channels?", - "hashLink": "/handbook/company/why-this-way#why-group-slack-channels" - }, - { - "headingText": "Why make work visible?", - "hashLink": "/handbook/company/why-this-way#why-make-work-visible" - }, - { - "headingText": "Why agile?", - "hashLink": "/handbook/company/why-this-way#why-agile" - }, - { - "headingText": "Why a three-week cadence?", - "hashLink": "/handbook/company/why-this-way#why-a-three-week-cadence" - }, - { - "headingText": "Why spend so much energy responding to every potential production incident?", - "hashLink": "/handbook/company/why-this-way#why-spend-so-much-energy-responding-to-every-potential-production-incident" - }, - { - "headingText": "Why fix small inconsistencies quickly?", - "hashLink": "/handbook/company/why-this-way#why-fix-small-inconsistencies-quickly" - }, - { - "headingText": "Why make it obvious when stuff breaks?", - "hashLink": "/handbook/company/why-this-way#why-make-it-obvious-when-stuff-breaks" - }, - { - "headingText": "Why keep issue templates simple?", - "hashLink": "/handbook/company/why-this-way#why-keep-issue-templates-simple" - }, - { - "headingText": "Why spend less?", - "hashLink": "/handbook/company/why-this-way#why-spend-less" - }, - { - "headingText": "Why don't we sell like everyone else?", - "hashLink": "/handbook/company/why-this-way#why-don-t-we-sell-like-everyone-else" - }, - { - "headingText": "Why does Fleet support query packs?", - "hashLink": "/handbook/company/why-this-way#why-does-fleet-support-query-packs" - }, - { - "headingText": "Why does Fleet use sentence case?", - "hashLink": "/handbook/company/why-this-way#why-does-fleet-use-sentence-case" - }, - { - "headingText": "Why not use superlatives?", - "hashLink": "/handbook/company/why-this-way#why-not-use-superlatives" - }, - { - "headingText": "Why does Fleet use \"MDM on/off\" instead of \"MDM enrolled/unenrolled\"?", - "hashLink": "/handbook/company/why-this-way#why-does-fleet-use-mdm-on-off-instead-of-mdm-enrolled-unenrolled" - }, - { - "headingText": "Why not mention the CEO in Slack threads?", - "hashLink": "/handbook/company/why-this-way#why-not-mention-the-ceo-in-slack-threads" - } - ] - }, - { - "url": "/handbook/customer-success", - "title": "🌦️ Customer Success", - "lastModifiedAt": 1734534698970, - "htmlId": "handbook--readme--2f11809e31", - "sectionRelativeRepoPath": "customer-success/README.md", - "meta": { - "maintainedBy": "zayhanlon" - }, - "linksForHandbookIndex": [ - { - "headingText": "Team", - "hashLink": "/handbook/customer-success#team" - }, - { - "headingText": "Contact us", - "hashLink": "/handbook/customer-success#contact-us" - }, - { - "headingText": "Responsibilities", - "hashLink": "/handbook/customer-success#responsibilities" - }, - { - "headingText": "Rituals", - "hashLink": "/handbook/customer-success#rituals" - } - ] - }, - { - "url": "/handbook/demand", - "title": "🫧 Demand", - "lastModifiedAt": 1734534698974, - "htmlId": "handbook--readme--cd1abd2fbc", - "sectionRelativeRepoPath": "demand/README.md", - "meta": { - "maintainedBy": "Drew-P-Drawers" - }, - "linksForHandbookIndex": [ - { - "headingText": "Team", - "hashLink": "/handbook/demand#team" - }, - { - "headingText": "Contact us", - "hashLink": "/handbook/demand#contact-us" - }, - { - "headingText": "Responsibilities", - "hashLink": "/handbook/demand#responsibilities" - }, - { - "headingText": "Rituals", - "hashLink": "/handbook/demand#rituals" - } - ] - }, - { - "url": "/handbook/digital-experience", - "title": "🌐 Digital Experience", - "lastModifiedAt": 1734534698982, - "htmlId": "handbook--readme--584ce6144f", - "sectionRelativeRepoPath": "digital-experience/README.md", - "meta": { - "maintainedBy": "Sampfluger88" - }, - "linksForHandbookIndex": [ - { - "headingText": "Team", - "hashLink": "/handbook/digital-experience#team" - }, - { - "headingText": "Contact us", - "hashLink": "/handbook/digital-experience#contact-us" - }, - { - "headingText": "Responsibilities", - "hashLink": "/handbook/digital-experience#responsibilities" - }, - { - "headingText": "Rituals", - "hashLink": "/handbook/digital-experience#rituals" - } - ] - }, - { - "url": "/handbook/digital-experience/security", - "title": "Security", - "lastModifiedAt": 1734534698999, - "htmlId": "handbook--security--3e0da72c47", - "sectionRelativeRepoPath": "digital-experience/security.md", - "meta": { - "maintainedBy": "hollidayn" - }, - "linksForHandbookIndex": [ - { - "headingText": "Fleet security", - "hashLink": "/handbook/digital-experience/security#fleet-security" - }, - { - "headingText": "How we protect end-user devices", - "hashLink": "/handbook/digital-experience/security#how-we-protect-end-user-devices" - }, - { - "headingText": "FAQ", - "hashLink": "/handbook/digital-experience/security#faq" - }, - { - "headingText": "GitHub security", - "hashLink": "/handbook/digital-experience/security#git-hub-security" - }, - { - "headingText": "Google Workspace security", - "hashLink": "/handbook/digital-experience/security#google-workspace-security" - }, - { - "headingText": "Vendor questionnaires ", - "hashLink": "/handbook/digital-experience/security#vendor-questionnaires" - }, - { - "headingText": "Scoping", - "hashLink": "/handbook/digital-experience/security#scoping" - }, - { - "headingText": "Service monitoring and logging", - "hashLink": "/handbook/digital-experience/security#service-monitoring-and-logging" - }, - { - "headingText": "Governance and risk management", - "hashLink": "/handbook/digital-experience/security#governance-and-risk-management" - }, - { - "headingText": "Network security", - "hashLink": "/handbook/digital-experience/security#network-security" - }, - { - "headingText": "Privacy", - "hashLink": "/handbook/digital-experience/security#privacy" - }, - { - "headingText": "Sub-processors", - "hashLink": "/handbook/digital-experience/security#sub-processors" - }, - { - "headingText": "Security policies", - "hashLink": "/handbook/digital-experience/security#security-policies" - }, - { - "headingText": "Business continuity plan", - "hashLink": "/handbook/digital-experience/security#business-continuity-plan" - }, - { - "headingText": "Data management policy", - "hashLink": "/handbook/digital-experience/security#data-management-policy" - }, - { - "headingText": "Encryption policy", - "hashLink": "/handbook/digital-experience/security#encryption-policy" - }, - { - "headingText": "Information security roles and responsibilities", - "hashLink": "/handbook/digital-experience/security#information-security-roles-and-responsibilities" - }, - { - "headingText": "Network and system hardening standards", - "hashLink": "/handbook/digital-experience/security#network-and-system-hardening-standards" - }, - { - "headingText": "Application security", - "hashLink": "/handbook/digital-experience/security#application-security" - }, - { - "headingText": "Vulnerability management", - "hashLink": "/handbook/digital-experience/security#vulnerability-management" - }, - { - "headingText": "Trust report", - "hashLink": "/handbook/digital-experience/security#trust-report" - }, - { - "headingText": "Securtiy audits", - "hashLink": "/handbook/digital-experience/security#securtiy-audits" - } - ] - }, - { - "url": "/handbook/engineering/load-testing", - "title": "Load testing", - "lastModifiedAt": 1734534699001, - "htmlId": "handbook--load-testing--a569c0b971", - "sectionRelativeRepoPath": "engineering/Load-testing.md", - "meta": { - "maintainedBy": "lukeheath", - "description": "This page outlines the most recent results of a semi-annual load test of the Fleet server." - }, - "linksForHandbookIndex": [ - { - "headingText": "Test parameters", - "hashLink": "/handbook/engineering/load-testing#test-parameters" - }, - { - "headingText": "Results", - "hashLink": "/handbook/engineering/load-testing#results" - }, - { - "headingText": "How we are simulating osquery", - "hashLink": "/handbook/engineering/load-testing#how-we-are-simulating-osquery" - }, - { - "headingText": "Infrastructure setup", - "hashLink": "/handbook/engineering/load-testing#infrastructure-setup" - }, - { - "headingText": "Limitations", - "hashLink": "/handbook/engineering/load-testing#limitations" - } - ] - }, - { - "url": "/handbook/engineering/debugging", - "title": "Debugging", - "lastModifiedAt": 1734534699002, - "htmlId": "handbook--debugging--3ca4b159dc", - "sectionRelativeRepoPath": "engineering/Debugging.md", - "meta": { - "maintainedBy": "lukeheath", - "description": "A guide to triaging and diagnosing issues in Fleet." - }, - "linksForHandbookIndex": [ - { - "headingText": "Goals of this guide", - "hashLink": "/handbook/engineering/debugging#goals-of-this-guide" - }, - { - "headingText": "Basic data that is needed", - "hashLink": "/handbook/engineering/debugging#basic-data-that-is-needed" - }, - { - "headingText": "Triaging the issue", - "hashLink": "/handbook/engineering/debugging#triaging-the-issue" - } - ] - }, - { - "url": "/handbook/engineering/scaling-fleet", - "title": "Scaling Fleet", - "lastModifiedAt": 1734534699004, - "htmlId": "handbook--scaling-fleet--282b4f1482", - "sectionRelativeRepoPath": "engineering/scaling-fleet.md", - "meta": { - "maintainedBy": "lukeheath" - } - }, - { - "url": "/handbook/engineering", - "title": "🚀 Engineering", - "lastModifiedAt": 1734534699009, - "htmlId": "handbook--readme--84714ade8c", - "sectionRelativeRepoPath": "engineering/README.md", - "meta": { - "maintainedBy": "lukeheath" - }, - "linksForHandbookIndex": [ - { - "headingText": "Team", - "hashLink": "/handbook/engineering#team" - }, - { - "headingText": "Contact us", - "hashLink": "/handbook/engineering#contact-us" - }, - { - "headingText": "Responsibilities", - "hashLink": "/handbook/engineering#responsibilities" - }, - { - "headingText": "Rituals", - "hashLink": "/handbook/engineering#rituals" - } - ] - }, - { - "url": "/handbook/engineering/tuf", - "title": "Tuf", - "lastModifiedAt": 1734534699012, - "htmlId": "handbook--tuf--868750fae1", - "sectionRelativeRepoPath": "engineering/tuf.md", - "meta": { - "maintainedBy": "lukeheath", - "description": "This page outlines our TUF creation and maintenance processes." - }, - "linksForHandbookIndex": [ - { - "headingText": "Create a new TUF repo", - "hashLink": "/handbook/engineering/tuf#create-a-new-tuf-repo" - }, - { - "headingText": "Read and write to TUF repo on Cloudflare R2", - "hashLink": "/handbook/engineering/tuf#read-and-write-to-tuf-repo-on-cloudflare-r-2" - }, - { - "headingText": "Add new TUF keys for authorized team members", - "hashLink": "/handbook/engineering/tuf#add-new-tuf-keys-for-authorized-team-members" - }, - { - "headingText": "Rotate the root keys ", - "hashLink": "/handbook/engineering/tuf#rotate-the-root-keys" - } - ] - }, - { - "url": "/handbook/finance", - "title": "💸 Finance", - "lastModifiedAt": 1734534699021, - "htmlId": "handbook--readme--64288e272c", - "sectionRelativeRepoPath": "finance/README.md", - "meta": { - "maintainedBy": "ireedy" - }, - "linksForHandbookIndex": [ - { - "headingText": "Team", - "hashLink": "/handbook/finance#team" - }, - { - "headingText": "Contact us", - "hashLink": "/handbook/finance#contact-us" - }, - { - "headingText": "Responsibilities", - "hashLink": "/handbook/finance#responsibilities" - }, - { - "headingText": "Rituals", - "hashLink": "/handbook/finance#rituals" - } - ] - }, - { - "url": "/handbook/product-design", - "title": "🦢 Product design", - "lastModifiedAt": 1734534699025, - "htmlId": "handbook--readme--fba8844849", - "sectionRelativeRepoPath": "product-design/README.md", - "meta": { - "maintainedBy": "noahtalerman" - }, - "linksForHandbookIndex": [ - { - "headingText": "Team", - "hashLink": "/handbook/product-design#team" - }, - { - "headingText": "Contact us", - "hashLink": "/handbook/product-design#contact-us" - }, - { - "headingText": "Responsibilities", - "hashLink": "/handbook/product-design#responsibilities" - }, - { - "headingText": "Rituals", - "hashLink": "/handbook/product-design#rituals" - } - ] - }, - { - "url": "/handbook/sales", - "title": "🐋 Sales", - "lastModifiedAt": 1734534699027, - "htmlId": "handbook--readme--67492c880b", - "sectionRelativeRepoPath": "sales/README.md", - "meta": { - "maintainedBy": "alexmitchelliii" - }, - "linksForHandbookIndex": [ - { - "headingText": "Team", - "hashLink": "/handbook/sales#team" - }, - { - "headingText": "Contact us", - "hashLink": "/handbook/sales#contact-us" - }, - { - "headingText": "Responsibilities", - "hashLink": "/handbook/sales#responsibilities" - }, - { - "headingText": "Rituals", - "hashLink": "/handbook/sales#rituals" - } - ] - }, - { - "url": "/engineering/tips-for-github-actions-usability", - "title": "Tips for github actions usability", - "lastModifiedAt": 1734534699031, - "htmlId": "articles--4-tips-for-github-ac--4783b271b1", - "sectionRelativeRepoPath": "4-tips-for-github-actions-usability.md", - "meta": { - "category": "engineering", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2022-01-03", - "articleTitle": "4 tips for GitHub Actions usability (+2 bonus tips for debugging)", - "articleImageUrl": "/images/articles/4-tips-for-github-actions-usability-cover-1600x900@2x.jpg" - } - }, - { - "url": "/announcements/a-new-fleet", - "title": "A new Fleet", - "lastModifiedAt": 1734534699032, - "htmlId": "articles--a-new-fleet--6bfb98461b", - "sectionRelativeRepoPath": "a-new-fleet.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2020-01-05", - "articleTitle": "A new Fleet", - "articleImageUrl": "/images/articles/a-new-fleet-cover-700x340@2x.jpeg" - } - }, - { - "url": "/guides/alternate-apple-mdm-url", - "title": "Alternate apple mdm url", - "lastModifiedAt": 1734534699034, - "htmlId": "articles--alternate-apple-mdm---b8dc76480e", - "sectionRelativeRepoPath": "alternate-apple-mdm-url.md", - "meta": { - "articleTitle": "Configuring an Alternative Apple MDM URL", - "authorFullName": "Tim Lee", - "authorGitHubUsername": "mostlikelee", - "category": "guides", - "publishedOn": "2024-11-01", - "description": "A guide on configuring an alternative Apple MDM URL in Fleet for better traffic management." - } - }, - { - "url": "/guides/apple-developer-certificates-on-linux-for-configuration-profile-signing", - "title": "Apple developer certificates on linux for configuration profile signing", - "lastModifiedAt": 1734534699035, - "htmlId": "articles--apple-developer-cert--da0ffa1bfb", - "sectionRelativeRepoPath": "apple-developer-certificates-on-linux-for-configuration-profile-signing.md", - "meta": { - "articleTitle": "Apple developer certificates on Linux for configuration profile signing", - "authorFullName": "Brock Walters", - "authorGitHubUsername": "nonpunctual", - "category": "guides", - "publishedOn": "2024-03-06", - "articleImageUrl": "/images/articles/apple-developer-certificates-on-linux-for-configuration-profile-signing-1600x900@2x.png", - "description": "This guide walks through the process of adding an Apple signing certificate to a Linux host." - } - }, - { - "url": "/securing/apply-byod-to-soothe-supply-chain-pain", - "title": "Apply byod to soothe supply chain pain", - "lastModifiedAt": 1734534699037, - "htmlId": "articles--apply-byod-to-soothe--37d8a3c6df", - "sectionRelativeRepoPath": "apply-byod-to-soothe-supply-chain-pain.md", - "meta": { - "category": "security", - "authorGitHubUsername": "GuillaumeRoss", - "authorFullName": "Guillaume Ross", - "publishedOn": "2022-02-10", - "articleTitle": "Apply BYOD to soothe supply chain pain", - "articleImageUrl": "/images/articles/apply-byod-to-soothe-supply-chain-pain-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/automatic-software-install-in-fleet", - "title": "Automatic software install in Fleet", - "lastModifiedAt": 1734534699039, - "htmlId": "articles--automatic-software-i--abcbbd3102", - "sectionRelativeRepoPath": "automatic-software-install-in-fleet.md", - "meta": { - "articleTitle": "Automatically install software", - "authorFullName": "Sharon Katz", - "authorGitHubUsername": "sharon-fdm", - "category": "guides", - "publishedOn": "2024-09-23", - "description": "A guide to workflows using automatic software installation in Fleet." - } - }, - { - "url": "/guides/automations", - "title": "Automations", - "lastModifiedAt": 1734534699040, - "htmlId": "articles--automations--64a57338e2", - "sectionRelativeRepoPath": "automations.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-07-03", - "articleTitle": "Automations", - "description": "Configure Fleet automations to trigger webhooks or create tickets in Jira and Zendesk for vulnerability, policy, and host status events." - } - }, - { - "url": "/guides/battery-health", - "title": "Battery health", - "lastModifiedAt": 1734534699041, - "htmlId": "articles--battery-health--563f09cf01", - "sectionRelativeRepoPath": "battery-health.md", - "meta": { - "articleTitle": "Battery health", - "authorFullName": "Tim Lee", - "authorGitHubUsername": "mostlikelee", - "category": "guides", - "publishedOn": "2024-10-16", - "articleImageUrl": "/images/articles/battery-health-1600x900@2x.png", - "description": "Monitor and assess battery health in macOS and Windows devices using Fleet and osquery to maintain optimal device performance." - } - }, - { - "url": "/guides/building-webhook-flows-with-fleet-and-tines", - "title": "Building webhook flows with Fleet and tines", - "lastModifiedAt": 1734534699042, - "htmlId": "articles--building-webhook-flo--5ef9e57435", - "sectionRelativeRepoPath": "building-webhook-flows-with-fleet-and-tines.md", - "meta": { - "articleTitle": "Building webhook flows with Fleet and Tines", - "authorFullName": "Victor Lyuboslavsky", - "authorGitHubUsername": "getvictor", - "category": "guides", - "publishedOn": "2024-05-30", - "articleImageUrl": "/images/articles/building-webhook-flows-with-fleet-and-tines-1600x900@2x.png", - "description": "A guide to workflows using Tines and Fleet via webhook to update outdated OS versions." - } - }, - { - "url": "/guides/catch-missed-authorization-checks-during-software-development", - "title": "Catch missed authorization checks during software development", - "lastModifiedAt": 1734534699043, - "htmlId": "articles--catch-missed-authori--74714253bf", - "sectionRelativeRepoPath": "catch-missed-authorization-checks-during-software-development.md", - "meta": { - "articleTitle": "Catch missed authorization checks during software development", - "authorFullName": "Victor Lyuboslavsky", - "authorGitHubUsername": "getvictor", - "category": "guides", - "publishedOn": "2023-12-04", - "description": "How to perform authorization checks in a golang codebase for cybersecurity" - } - }, - { - "url": "/guides/chrome-os", - "title": "Chrome os", - "lastModifiedAt": 1734534699044, - "htmlId": "articles--chrome-os--2f99363e14", - "sectionRelativeRepoPath": "chrome-os.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "zhumo", - "authorFullName": "Mo Zhu", - "publishedOn": "2023-11-21", - "articleTitle": "ChromeOS", - "description": "Learn about ChromeOS and Fleet." - } - }, - { - "url": "/guides/cis-benchmarks", - "title": "Cis benchmarks", - "lastModifiedAt": 1734534699045, - "htmlId": "articles--cis-benchmarks--bc26d23443", - "sectionRelativeRepoPath": "cis-benchmarks.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "lucasmrod", - "authorFullName": "Lucas Rodriguez", - "publishedOn": "2024-04-02", - "articleTitle": "CIS Benchmarks", - "description": "Read about how Fleet's implementation of CIS Benchmarks offers consensus-based cybersecurity guidance." - } - }, - { - "url": "/guides/certificates-in-fleetd", - "title": "Certificates in fleetd", - "lastModifiedAt": 1734534699046, - "htmlId": "articles--certificates-in-flee--fdcfa77fd4", - "sectionRelativeRepoPath": "certificates-in-fleetd.md", - "meta": { - "articleTitle": "Certificates in fleetd", - "authorFullName": "Lucas Manuel Rodriguez", - "authorGitHubUsername": "lucasmrod", - "category": "guides", - "publishedOn": "2024-07-09", - "articleImageUrl": "/images/articles/apple-developer-certificates-on-linux-for-configuration-profile-signing-1600x900@2x.png", - "description": "TLS certificates in fleetd" - } - }, - { - "url": "/guides/building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly", - "title": "Building an effective dashboard with Fleet REST API flask and plotly", - "lastModifiedAt": 1734534699047, - "htmlId": "articles--building-an-effectiv--2bdb2cc07f", - "sectionRelativeRepoPath": "building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly.md", - "meta": { - "articleTitle": "Building an effective dashboard with Fleet's REST API, Flask, and Plotly: A step-by-step guide", - "authorFullName": "Dave Herder", - "authorGitHubUsername": "dherder", - "category": "guides", - "publishedOn": "2023-05-22", - "articleImageUrl": "/images/articles/building-an-effective-dashboard-with-fleet-rest-api-flask-and-plotly@2x.jpg", - "description": "Step-by-step guide on building a dynamic dashboard with Fleet's REST API, Flask, and Plotly. Master data visualization with open-source tools!" - } - }, - { - "url": "/announcements/comparative-look-at-ws1-and-fleet", - "title": "Comparative look at ws1 and Fleet", - "lastModifiedAt": 1734534699048, - "htmlId": "articles--comparative-look-at---e0d38f9066", - "sectionRelativeRepoPath": "comparative-look-at-ws1-and-fleet.md", - "meta": { - "category": "announcements", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-02-01", - "articleTitle": "A comparative look at VMware Workspace ONE and Fleet Device Management", - "articleImageUrl": "/images/articles/comparative-look-at-ws1-and-fleet-1600x900@2x.png" - } - }, - { - "url": "/guides/config-less-fleetd-agent-deployment", - "title": "Config less fleetd agent deployment", - "lastModifiedAt": 1734534699049, - "htmlId": "articles--config-less-fleetd-a--eeaff811d8", - "sectionRelativeRepoPath": "config-less-fleetd-agent-deployment.md", - "meta": { - "articleTitle": "Config-less fleetd agent deployment", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "category": "guides", - "publishedOn": "2024-01-31", - "articleImageUrl": "/images/articles/config-less-fleetd-agent-deployment-1600x900@2x.png", - "description": "Config-less `fleetd` agent deployment" - } - }, - { - "url": "/guides/configuring-default-teams-for-devices-in-fleet", - "title": "Configuring default teams for devices in Fleet", - "lastModifiedAt": 1734534699050, - "htmlId": "articles--configuring-default---1fb09cd2b7", - "sectionRelativeRepoPath": "configuring-default-teams-for-devices-in-fleet.md", - "meta": { - "articleTitle": "Configuring default teams for macOS, iOS, and iPadOS devices in Fleet", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "category": "guides", - "publishedOn": "2024-09-12", - "description": "This guide will walk you through configuring default teams for devices using the Fleet web UI." - } - }, - { - "url": "/announcements/consolidate-multiple-tools-with-fleet", - "title": "Consolidate multiple tools with Fleet", - "lastModifiedAt": 1734534699051, - "htmlId": "articles--consolidate-multiple--e8aa62a487", - "sectionRelativeRepoPath": "consolidate-multiple-tools-with-fleet.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "Drew-P-drawers", - "authorFullName": "Andrew Baker", - "publishedOn": "2024-12-06", - "articleTitle": "Leading financial company consolidates multiple tools with Fleet", - "description": "Leading financial company consolidates multiple tools with Fleet" - } - }, - { - "url": "/guides/converting-unix-timestamps-with-osquery", - "title": "Converting unix timestamps with osquery", - "lastModifiedAt": 1734534699052, - "htmlId": "articles--converting-unix-time--f364580e65", - "sectionRelativeRepoPath": "converting-unix-timestamps-with-osquery.md", - "meta": { - "category": "guides", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2021-06-15", - "articleTitle": "Converting unix timestamps with osquery", - "articleImageUrl": "/images/articles/converting-unix-timestamps-with-osquery-cover-800x450@2x.jpeg" - } - }, - { - "url": "/guides/correlate-network-connections-with-community-id-in-osquery", - "title": "Correlate network connections with community id in osquery", - "lastModifiedAt": 1734534699053, - "htmlId": "articles--correlate-network-co--9e9f4b2365", - "sectionRelativeRepoPath": "correlate-network-connections-with-community-id-in-osquery.md", - "meta": { - "category": "guides", - "authorFullName": "Zach Wasserman", - "authorGitHubUsername": "zwass", - "publishedOn": "2021-06-02", - "articleTitle": "Correlate network connections with community ID in osquery.", - "articleImageUrl": "/images/articles/correlate-network-connections-with-community-id-in-osquery-cover-800x502@2x.jpeg" - } - }, - { - "url": "/guides/creating-windows-csps", - "title": "Creating windows csps", - "lastModifiedAt": 1734534699054, - "htmlId": "articles--creating-windows-csp--443b09b338", - "sectionRelativeRepoPath": "creating-windows-csps.md", - "meta": { - "articleTitle": "Creating Windows CSPs", - "authorFullName": "Harrison Ravazzolo", - "authorGitHubUsername": "harrisonravazzolo", - "category": "guides", - "publishedOn": "2024-12-12", - "description": "Learn how to create and deploy Windows CSPs with Fleet, leveraging ADMX-backed policies for streamlined and secure device management." - } - }, - { - "url": "/guides/custom-os-settings", - "title": "Custom os settings", - "lastModifiedAt": 1734534699055, - "htmlId": "articles--custom-os-settings--fbce8fa70e", - "sectionRelativeRepoPath": "custom-os-settings.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-07-27", - "articleTitle": "Custom OS settings", - "description": "Learn how to enforce custom settings on macOS and Window hosts using Fleet's configuration profiles." - } - }, - { - "url": "/announcements/debunk-the-cross-platform-myth", - "title": "Debunk the cross platform myth", - "lastModifiedAt": 1734534699056, - "htmlId": "articles--debunk-the-cross-pla--fe27986d52", - "sectionRelativeRepoPath": "debunk-the-cross-platform-myth.md", - "meta": { - "category": "announcements", - "authorFullName": "Mike McNeil", - "authorGitHubUsername": "mikermcneil", - "publishedOn": "2024-08-27", - "articleTitle": "Debunk the cross-platform myth", - "description": "Debunk the cross-platform myth with MDM" - } - }, - { - "url": "/guides/delivering-data-to-snowflake-from-fleet-and-osquery", - "title": "Delivering data to snowflake from Fleet and osquery", - "lastModifiedAt": 1734534699058, - "htmlId": "articles--delivering-data-to-s--0689aa7ec4", - "sectionRelativeRepoPath": "delivering-data-to-snowflake-from-fleet-and-osquery.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "t-lark", - "authorFullName": "Tom Larkin", - "publishedOn": "2022-02-01", - "articleTitle": "Delivering data to Snowflake from Fleet and osquery.", - "articleImageUrl": "/images/articles/delivering-data-to-snowflake-from-fleet-and-osquery-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/deploy-fleet-on-aws-ecs", - "title": "Deploy Fleet on aws ecs", - "lastModifiedAt": 1734534699059, - "htmlId": "articles--deploy-fleet-on-aws---2a8f97e2e6", - "sectionRelativeRepoPath": "deploy-fleet-on-aws-ecs.md", - "meta": { - "articleTitle": "Deploy Fleet on AWS ECS", - "authorGitHubUsername": "edwardsb", - "authorFullName": "Ben Edwards", - "publishedOn": "2021-10-06", - "category": "guides", - "articleImageUrl": "/images/articles/deploy-fleet-on-aws-ecs-800x450@2x.png", - "description": "Information for deploying Fleet on AWS ECS." - } - }, - { - "url": "/guides/deploy-fleet-on-aws-with-terraform", - "title": "Deploy Fleet on aws with terraform", - "lastModifiedAt": 1734534699061, - "htmlId": "articles--deploy-fleet-on-aws---a782bb3610", - "sectionRelativeRepoPath": "deploy-fleet-on-aws-with-terraform.md", - "meta": { - "articleTitle": "Deploy Fleet on AWS with Terraform", - "authorGitHubUsername": "edwardsb", - "authorFullName": "Ben Edwards", - "publishedOn": "2021-11-30", - "category": "guides", - "articleImageUrl": "/images/articles/deploy-fleet-on-aws-with-terraform-800x450@2x.png", - "description": "Learn how to deploy Fleet on AWS." - } - }, - { - "url": "/guides/deploy-fleet-on-centos", - "title": "Deploy Fleet on centos", - "lastModifiedAt": 1734534699062, - "htmlId": "articles--deploy-fleet-on-cent--e7882f4580", - "sectionRelativeRepoPath": "deploy-fleet-on-centos.md", - "meta": { - "articleTitle": "Deploy Fleet on CentOS", - "authorGitHubUsername": "marpaia", - "authorFullName": "Mike Arpaia", - "publishedOn": "2017-09-22", - "category": "guides", - "articleImageUrl": "/images/articles/deploy-fleet-on-centos-800x450@2x.png", - "description": "A guide to deploy Fleet on CentOS." - } - }, - { - "url": "/guides/deploy-fleet-on-cloudgov", - "title": "Deploy Fleet on cloudgov", - "lastModifiedAt": 1734534699063, - "htmlId": "articles--deploy-fleet-on-clou--7a95cf92fe", - "sectionRelativeRepoPath": "deploy-fleet-on-cloudgov.md", - "meta": { - "articleTitle": "Deploy Fleet on Cloud.gov", - "authorGitHubUsername": "JJediny", - "authorFullName": "John Jediny", - "publishedOn": "2022-09-08", - "category": "guides", - "articleImageUrl": "/images/articles/deploy-fleet-on-cloudgov-800x450@2x.png", - "description": "Information for deploying Fleet on Cloud.gov." - } - }, - { - "url": "/guides/deploy-fleet-on-hetzner-cloud", - "title": "Deploy Fleet on hetzner cloud", - "lastModifiedAt": 1734534699065, - "htmlId": "articles--deploy-fleet-on-hetz--671406f870", - "sectionRelativeRepoPath": "deploy-fleet-on-hetzner-cloud.md", - "meta": { - "articleTitle": "Deploy Fleet on Hetzner Cloud", - "authorGitHubUsername": "ksatter", - "authorFullName": "Kathy Satterlee", - "publishedOn": "2022-06-27", - "category": "guides", - "articleImageUrl": "/images/articles/deploy-fleet-on-hetzner-cloud-800x450@2x.png", - "description": "Learn how to deploy Fleet on Hetzner Cloud using cloud-init and Docker." - } - }, - { - "url": "/guides/deploy-fleet-on-kubernetes", - "title": "Deploy Fleet on kubernetes", - "lastModifiedAt": 1734534699066, - "htmlId": "articles--deploy-fleet-on-kube--54be3fbc8f", - "sectionRelativeRepoPath": "deploy-fleet-on-kubernetes.md", - "meta": { - "articleTitle": "Deploy Fleet on Kubernetes", - "authorGitHubUsername": "marpaia", - "authorFullName": "Mike Arpaia", - "publishedOn": "2017-11-18", - "category": "guides", - "articleImageUrl": "/images/articles/deploy-fleet-on-kubernetes-800x450@2x.png", - "description": "Learn how to deploy Fleet on Kubernetes." - } - }, - { - "url": "/guides/deploy-fleet-on-render", - "title": "Deploy Fleet on render", - "lastModifiedAt": 1734534699068, - "htmlId": "articles--deploy-fleet-on-rend--eed014db97", - "sectionRelativeRepoPath": "deploy-fleet-on-render.md", - "meta": { - "articleTitle": "Deploy Fleet on Render", - "authorGitHubUsername": "edwardsb", - "authorFullName": "Ben Edwards", - "publishedOn": "2021-11-21", - "category": "guides", - "articleImageUrl": "/images/articles/deploy-fleet-on-render-800x450@2x.png", - "description": "Learn how to deploy Fleet on Render." - } - }, - { - "url": "/guides/deploy-fleet-on-ubuntu-with-elastic", - "title": "Deploy Fleet on ubuntu with elastic", - "lastModifiedAt": 1734534699070, - "htmlId": "articles--deploy-fleet-on-ubun--12cb3308e3", - "sectionRelativeRepoPath": "deploy-fleet-on-ubuntu-with-elastic.md", - "meta": { - "articleTitle": "Deploy Fleet on Ubuntu", - "authorGitHubUsername": "defensivedepth", - "authorFullName": "Josh Brower", - "publishedOn": "2024-06-12", - "category": "guides", - "description": "A guide to deploy Fleet and Elastic on Ubuntu.", - "articleImageUrl": "/images/articles/deploy-fleet-on-ubuntu-with-elastic-1600x900@2x.png" - } - }, - { - "url": "/guides/deploy-software-packages", - "title": "Deploy software packages", - "lastModifiedAt": 1734534699072, - "htmlId": "articles--deploy-software-pack--4dbf86a87e", - "sectionRelativeRepoPath": "deploy-software-packages.md", - "meta": { - "articleTitle": "Deploy software", - "authorFullName": "Roberto Dip", - "authorGitHubUsername": "roperzh", - "category": "guides", - "publishedOn": "2024-09-23", - "articleImageUrl": "/images/articles/deploy-security-agents-1600x900@2x.png", - "description": "This guide will walk you through adding and editing software packages in Fleet." - } - }, - { - "url": "/securing/detect-log4j-with-osquery-and-fleet", - "title": "Detect log4j with osquery and Fleet", - "lastModifiedAt": 1734534699073, - "htmlId": "articles--detect-log4j-with-os--a3985203cb", - "sectionRelativeRepoPath": "detect-log4j-with-osquery-and-fleet.md", - "meta": { - "category": "security", - "authorFullName": "Zach Wasserman", - "authorGitHubUsername": "zwass", - "publishedOn": "2021-12-15", - "articleTitle": "Detect Log4j with osquery (and Fleet)", - "articleImageUrl": "/images/articles/detect-log4j-with-osquery-and-fleet-1600x900@2x.jpg" - } - }, - { - "url": "/guides/discovering-chrome-ai-using-fleet", - "title": "Discovering chrome ai using Fleet", - "lastModifiedAt": 1734534699074, - "htmlId": "articles--discovering-chrome-a--a0abdbb21d", - "sectionRelativeRepoPath": "discovering-chrome-ai-using-fleet.md", - "meta": { - "articleTitle": "Discovering Chrome AI using Fleet", - "authorFullName": "Brock Walters", - "authorGitHubUsername": "nonpunctual", - "category": "guides", - "publishedOn": "2024-09-06", - "articleImageUrl": "/images/articles/discovering-chrome-ai-using-fleet-1600x900@2x.jpg", - "description": "Use Fleet to detect and monitor settings enabled in Google Chrome by querying Chrome's preferences JSON file." - } - }, - { - "url": "/guides/discovering-geacon-using-fleet", - "title": "Discovering geacon using Fleet", - "lastModifiedAt": 1734534699076, - "htmlId": "articles--discovering-geacon-u--7b4b0cfbc2", - "sectionRelativeRepoPath": "discovering-geacon-using-fleet.md", - "meta": { - "articleTitle": "Discovering Geacon using Fleet", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "category": "guides", - "publishedOn": "2023-05-18", - "articleImageUrl": "/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg", - "description": "Enterprise security teams can use Fleet to identify and locate Geacon payloads and protect their macOS devices from this threat." - } - }, - { - "url": "/guides/discovering-xz-vulnerability-with-fleet", - "title": "Discovering xz vulnerability with Fleet", - "lastModifiedAt": 1734534699077, - "htmlId": "articles--discovering-xz-vulne--995fcf9f38", - "sectionRelativeRepoPath": "discovering-xz-vulnerability-with-fleet.md", - "meta": { - "articleTitle": "Discovering xz vulnerability with Fleet", - "authorFullName": "Brock Walters", - "authorGitHubUsername": "nonpunctual", - "category": "guides", - "publishedOn": "2024-06-03", - "articleImageUrl": "/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg", - "description": "Discover and create a comprehensive end-to-end remediation workflow for the xz vulnerability (CVE-2024-3094) with Fleet." - } - }, - { - "url": "/securing/does-osquery-violate-the-new-york-employee-monitoring-law", - "title": "Does osquery violate the new york employee monitoring law", - "lastModifiedAt": 1734534699078, - "htmlId": "articles--does-osquery-violate--c2fb841f14", - "sectionRelativeRepoPath": "does-osquery-violate-the-new-york-employee-monitoring-law.md", - "meta": { - "category": "security", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-04-18", - "articleTitle": "Does osquery violate the New York employee monitoring law?" - } - }, - { - "url": "/guides/downgrade-fleet", - "title": "Downgrade Fleet", - "lastModifiedAt": 1734534699079, - "htmlId": "articles--downgrade-fleet--9eada3bc15", - "sectionRelativeRepoPath": "downgrade-fleet.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "eashaw", - "authorFullName": "Eric Shaw", - "publishedOn": "2024-01-09", - "articleTitle": "Downgrade from Fleet Premium", - "description": "Learn how to downgrade from Fleet Premium." - } - }, - { - "url": "/guides/driving-company-culture-through-ai-haiku-poetry", - "title": "Driving company culture through ai haiku poetry", - "lastModifiedAt": 1734534699081, - "htmlId": "articles--driving-company-cult--053188a40b", - "sectionRelativeRepoPath": "driving-company-culture-through-ai-haiku-poetry.md", - "meta": { - "articleTitle": "Driving company culture through AI haiku poetry", - "authorFullName": "Luke Heath", - "authorGitHubUsername": "lukeheath", - "category": "guides", - "publishedOn": "2024-04-17", - "articleImageUrl": "/images/articles/driving-company-culture-through-ai-haiku-poetry-1600x900@2x.png", - "description": "Code and verse entwine, Silicon sparks, haikus shine, Art meets design line." - } - }, - { - "url": "/securing/ebpf-the-future-of-osquery-on-linux", - "title": "Ebpf the future of osquery on linux", - "lastModifiedAt": 1734534699081, - "htmlId": "articles--ebpf-the-future-of-o--2a8257e4a5", - "sectionRelativeRepoPath": "ebpf-the-future-of-osquery-on-linux.md", - "meta": { - "category": "security", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2021-01-25", - "articleTitle": "eBPF & the future of osquery on Linux", - "articleImageUrl": "/images/articles/ebpf-the-future-of-osquery-on-linux-cover-700x394@2x.png" - } - }, - { - "url": "/announcements/embracing-the-future-declarative-device-management", - "title": "Embracing the future declarative device management", - "lastModifiedAt": 1734534699082, - "htmlId": "articles--embracing-the-future--cc544292b9", - "sectionRelativeRepoPath": "embracing-the-future-declarative-device-management.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "spokanemac", - "authorFullName": "JD Strong", - "publishedOn": "2023-07-06", - "articleTitle": "Embracing the future: Declarative Device Management", - "articleImageUrl": "/images/articles/embracing-the-future-declarative-device-management@2x.png", - "description": "Explore the transformative impact of Declarative Device Management (DDM), Fleet, and osquery for MacAdmins." - } - }, - { - "url": "/guides/empower-linux-device-management", - "title": "Empower linux device management", - "lastModifiedAt": 1734534699084, - "htmlId": "articles--empower-linux-device--80d85cd174", - "sectionRelativeRepoPath": "empower-linux-device-management.md", - "meta": { - "articleTitle": "How Fleet empowers Linux device management", - "authorFullName": "Allen Houchins", - "authorGitHubUsername": "allenhouchins", - "category": "guides", - "publishedOn": "2024-12-03", - "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", - "description": "This guide explores how Fleet empowers Linux device management." - } - }, - { - "url": "/guides/enable-okta-verify-on-macos-with-configuration-profile", - "title": "Enable okta verify on macos with configuration profile", - "lastModifiedAt": 1734534699085, - "htmlId": "articles--enable-okta-verify-o--c60fc1abdf", - "sectionRelativeRepoPath": "enable-okta-verify-on-macOS-with-configuration-profile.md", - "meta": { - "articleTitle": "Enable Okta Verify on macOS using configuration profile", - "authorFullName": "Roberto Dip", - "authorGitHubUsername": "roperzh", - "category": "guides", - "publishedOn": "2024-09-23", - "articleImageUrl": "/images/articles/deploy-security-agents-1600x900@2x.png", - "description": "This guide will walk you through enabling Okta verify on macOS hosts using a configuration profile." - } - }, - { - "url": "/securing/end-user-self-remediation", - "title": "End user self remediation", - "lastModifiedAt": 1734534699086, - "htmlId": "articles--end-user-self-remedi--9ae34ae695", - "sectionRelativeRepoPath": "end-user-self-remediation.md", - "meta": { - "category": "security", - "authorFullName": "Chris McGillicuddy", - "authorGitHubUsername": "chris-mcgillicuddy", - "publishedOn": "2022-12-15", - "articleTitle": "End-user self remediation: empower your employees to fix security issues with Fleet" - } - }, - { - "url": "/announcements/endpoint-managements-crucial-role-in-healthcare", - "title": "Endpoint managements crucial role in healthcare", - "lastModifiedAt": 1734534699087, - "htmlId": "articles--endpoint-managements--3c2947839c", - "sectionRelativeRepoPath": "endpoint-managements-crucial-role-in-healthcare.md", - "meta": { - "category": "announcements", - "authorFullName": "Alex Mitchell", - "authorGitHubUsername": "alexmitchelliii", - "publishedOn": "2024-05-24", - "articleTitle": "Endpoint management's crucial role in healthcare", - "articleImageUrl": "/images/articles/endpoint-managements-crucial-role-in-healthcare-1600x900@2x.png", - "description": "Discover how robust endpoint management is essential for securing healthcare data, ensuring compliance, and building patient trust." - } - }, - { - "url": "/guides/enforce-disk-encryption", - "title": "Enforce disk encryption", - "lastModifiedAt": 1734534699088, - "htmlId": "articles--enforce-disk-encrypt--9a0b48c9e8", - "sectionRelativeRepoPath": "enforce-disk-encryption.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-08-14", - "articleTitle": "Enforce disk encryption", - "description": "Learn how to enforce disk encryption on macOS, Windows, and Linux hosts and manage encryption keys with Fleet Premium." - } - }, - { - "url": "/guides/enforce-os-updates", - "title": "Enforce os updates", - "lastModifiedAt": 1734534699090, - "htmlId": "articles--enforce-os-updates--c129a99813", - "sectionRelativeRepoPath": "enforce-os-updates.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-08-10", - "articleTitle": "Enforce OS updates", - "description": "Learn how to manage OS updates on macOS, Windows, iOS, and iPadOS devices." - } - }, - { - "url": "/announcements/enhancing-fleets-vulnerability-management-with-vulncheck-integration", - "title": "Enhancing fleets vulnerability management with vulncheck integration", - "lastModifiedAt": 1734534699091, - "htmlId": "articles--enhancing-fleets-vul--820b42326f", - "sectionRelativeRepoPath": "enhancing-fleets-vulnerability-management-with-vulncheck-integration.md", - "meta": { - "category": "announcements", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-04-23", - "articleTitle": "Enhancing Fleet's vulnerability management with VulnCheck integration", - "articleImageUrl": "/images/articles/enhancing-fleets-vulnerability-management-with-vulncheck-integration-1600x900@2x.png" - } - }, - { - "url": "/announcements/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet", - "title": "Enhancing k 12 cybersecurity with fcc funds and Fleet", - "lastModifiedAt": 1734534699092, - "htmlId": "articles--enhancing-k-12-cyber--e51245117d", - "sectionRelativeRepoPath": "enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet.md", - "meta": { - "category": "announcements", - "authorFullName": "Alex Mitchell", - "authorGitHubUsername": "alexmitchelliii", - "publishedOn": "2024-07-25", - "articleTitle": "Enhancing K-12 cybersecurity with FCC funds and Fleet", - "articleImageUrl": "/images/articles/enhancing-k-12-cybersecurity-with-fcc-funds-and-fleet-1600x900@2x.png" - } - }, - { - "url": "/guides/enroll-byod-ios-ipados-hosts", - "title": "Enroll byod ios ipados hosts", - "lastModifiedAt": 1734534699093, - "htmlId": "articles--enroll-byod-ios-ipad--96ea10014e", - "sectionRelativeRepoPath": "enroll-byod-ios-ipados-hosts.md", - "meta": { - "articleTitle": "Enrolling BYOD iPad/iOS devices in Fleet", - "authorFullName": "Roberto Dip", - "authorGitHubUsername": "roperzh", - "category": "guides", - "publishedOn": "2024-09-20", - "description": "This guide will walk you through the process of inviting BYOD iPhones and iPads to enroll in Fleet." - } - }, - { - "url": "/guides/enroll-hosts", - "title": "Enroll hosts", - "lastModifiedAt": 1734534699095, - "htmlId": "articles--enroll-hosts--1805e813ad", - "sectionRelativeRepoPath": "enroll-hosts.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-08-08", - "articleTitle": "Enroll hosts", - "description": "Learn how to enroll hosts to Fleet." - } - }, - { - "url": "/guides/enrolling-a-digital-ocean-droplet-on-a-fleet-instance", - "title": "Enrolling a digital ocean droplet on a Fleet instance", - "lastModifiedAt": 1734534699096, - "htmlId": "articles--enrolling-a-digital---557ea47bcf", - "sectionRelativeRepoPath": "enrolling-a-digital-ocean-droplet-on-a-fleet-instance.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "DominusKelvin", - "authorFullName": "Kelvin Omereshone", - "publishedOn": "2022-05-26", - "articleTitle": "Enrolling a DigitalOcean Droplet on a Fleet instance", - "articleImageUrl": "/images/articles/enrolling-a-digitalocean-droplet-server-on-a-fleet-instance-cover-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/expeditioners-bradley-chambers", - "title": "Expeditioners bradley chambers", - "lastModifiedAt": 1734534699097, - "htmlId": "articles--expeditioners-bradle--2aacdea2f2", - "sectionRelativeRepoPath": "expeditioners-bradley-chambers.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2023-07-20", - "articleTitle": "ExpedITioners podcast with Bradley Chambers", - "articleImageUrl": "/images/articles/expeditioners-podcast-ep1-1600x900@2x.png" - } - }, - { - "url": "/guides/exe-install-scripts", - "title": "Exe install scripts", - "lastModifiedAt": 1734534699098, - "htmlId": "articles--exe-install-scripts--ecfb1adfd0", - "sectionRelativeRepoPath": "exe-install-scripts.md", - "meta": { - "category": "guides", - "authorFullName": "Victor Lyuboslavsky", - "authorGitHubUsername": "getvictor", - "publishedOn": "2024-09-20", - "articleTitle": "Windows EXE install scripts", - "description": "This guide will walk you through adding software to Fleet using EXE installers." - } - }, - { - "url": "/podcasts/expeditioners-charles-edge", - "title": "Expeditioners charles edge", - "lastModifiedAt": 1734534699099, - "htmlId": "articles--expeditioners-charle--107c6b4184", - "sectionRelativeRepoPath": "expeditioners-charles-edge.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2023-10-23", - "articleTitle": "ExpedITioners podcast with Charles Edge", - "articleImageUrl": "/images/articles/expeditioners-podcast-ep5-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/expeditioners-huxley-barbee", - "title": "Expeditioners huxley barbee", - "lastModifiedAt": 1734534699100, - "htmlId": "articles--expeditioners-huxley--c87966e966", - "sectionRelativeRepoPath": "expeditioners-huxley-barbee.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2024-01-30", - "articleTitle": "ExpedITioners podcast with Huxley Barbee", - "articleImageUrl": "/images/articles/expeditioners-podcast-ep8-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/expeditioners-jeff-chao", - "title": "Expeditioners jeff chao", - "lastModifiedAt": 1734534699102, - "htmlId": "articles--expeditioners-jeff-c--7036c1b267", - "sectionRelativeRepoPath": "expeditioners-jeff-chao.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2023-11-15", - "articleTitle": "ExpedITioners podcast with Jeff Chao", - "articleImageUrl": "/images/articles/expeditioners-podcast-ep6-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/expeditioners-john-reynolds", - "title": "Expeditioners john reynolds", - "lastModifiedAt": 1734534699103, - "htmlId": "articles--expeditioners-john-r--099a8c112c", - "sectionRelativeRepoPath": "expeditioners-john-reynolds.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2023-09-21", - "articleTitle": "ExpedITioners podcast with John Reynolds", - "articleImageUrl": "/images/articles/expeditioners-podcast-ep4-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/expeditioners-niels-hofmans", - "title": "Expeditioners niels hofmans", - "lastModifiedAt": 1734534699104, - "htmlId": "articles--expeditioners-niels---39ef4172b5", - "sectionRelativeRepoPath": "expeditioners-niels-hofmans.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2023-08-22", - "articleTitle": "ExpedITioners podcast with Niels Hofmans", - "articleImageUrl": "/images/articles/expeditioners-podcast-ep2-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/expeditioners-podcast-with-marcus-ransom", - "title": "Expeditioners podcast with marcus ransom", - "lastModifiedAt": 1734534699105, - "htmlId": "articles--expeditioners-podcas--8d117a3df7", - "sectionRelativeRepoPath": "expeditioners-podcast-with-marcus-ransom.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2023-12-11", - "articleTitle": "ExpedITioners podcast with Marcus Ransom", - "articleImageUrl": "/images/articles/expeditioners-podcast-ep7-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/expeditioners-rich-trouton", - "title": "Expeditioners rich trouton", - "lastModifiedAt": 1734534699106, - "htmlId": "articles--expeditioners-rich-t--2e92683eec", - "sectionRelativeRepoPath": "expeditioners-rich-trouton.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2023-08-31", - "articleTitle": "ExpedITioners podcast with Rich Trouton", - "articleImageUrl": "/images/articles/expeditioners-podcast-ep3-1600x900@2x.jpg" - } - }, - { - "url": "/guides/filtering-software-by-vulnerability", - "title": "Filtering software by vulnerability", - "lastModifiedAt": 1734534699106, - "htmlId": "articles--filtering-software-b--52ab086601", - "sectionRelativeRepoPath": "filtering-software-by-vulnerability.md", - "meta": { - "articleTitle": "Filtering software by vulnerability in Fleet", - "authorFullName": "Tim Lee", - "authorGitHubUsername": "mostlikelee", - "category": "guides", - "publishedOn": "2024-08-30", - "articleImageUrl": "/images/articles/discovering-geacon-using-fleet-1600x900@2x.jpg", - "description": "Filter software by vulnerability in Fleet to prioritize critical patches and enhance your organization's security posture." - } - }, - { - "url": "/releases/fleet-3.10.0", - "title": "Fleet 3.10.0", - "lastModifiedAt": 1734534699107, - "htmlId": "articles--fleet-3100--b0e3e54494", - "sectionRelativeRepoPath": "fleet-3.10.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-04-01", - "articleTitle": "Fleet 3.10.0 released with agent auto-updates beta", - "articleImageUrl": "/images/articles/fleet-3.10.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-3.11.0", - "title": "Fleet 3.11.0", - "lastModifiedAt": 1734534699108, - "htmlId": "articles--fleet-3110--790c741a50", - "sectionRelativeRepoPath": "fleet-3.11.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-04-29", - "articleTitle": "Fleet 3.11.0 released with software inventory", - "articleImageUrl": "/images/articles/fleet-3.11.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-3.12.0", - "title": "Fleet 3.12.0", - "lastModifiedAt": 1734534699109, - "htmlId": "articles--fleet-3120--2fe5f72c1b", - "sectionRelativeRepoPath": "fleet-3.12.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-05-20", - "articleTitle": "Fleet 3.12.0", - "articleImageUrl": "/images/articles/fleet-3.12.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-3.13.0", - "title": "Fleet 3.13.0", - "lastModifiedAt": 1734534699110, - "htmlId": "articles--fleet-3130--1e9c74e9fe", - "sectionRelativeRepoPath": "fleet-3.13.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-06-04", - "articleTitle": "Fleet 3.13.0", - "articleImageUrl": "/images/articles/fleet-3.13.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-3.5.0", - "title": "Fleet 3.5.0", - "lastModifiedAt": 1734534699111, - "htmlId": "articles--fleet-350--cbc4d45a82", - "sectionRelativeRepoPath": "fleet-3.5.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2020-12-12", - "articleTitle": "Fleet 3.5.0", - "articleImageUrl": "/images/articles/fleet-3.5.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-3.6.0", - "title": "Fleet 3.6.0", - "lastModifiedAt": 1734534699111, - "htmlId": "articles--fleet-360--b25074f833", - "sectionRelativeRepoPath": "fleet-3.6.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-01-09", - "articleTitle": "Fleet 3.6.0", - "articleImageUrl": "/images/articles/fleet-3.6.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-3.7.1", - "title": "Fleet 3.7.1", - "lastModifiedAt": 1734534699112, - "htmlId": "articles--fleet-371--e316e84c63", - "sectionRelativeRepoPath": "fleet-3.7.1.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-02-04", - "articleTitle": "Fleet 3.7.1", - "articleImageUrl": "/images/articles/fleet-3.7.1-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-3.8.0", - "title": "Fleet 3.8.0", - "lastModifiedAt": 1734534699113, - "htmlId": "articles--fleet-380--c8849a5e15", - "sectionRelativeRepoPath": "fleet-3.8.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-02-26", - "articleTitle": "Fleet 3.8.0", - "articleImageUrl": "/images/articles/fleet-3.8.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-3.9.0", - "title": "Fleet 3.9.0", - "lastModifiedAt": 1734534699114, - "htmlId": "articles--fleet-390--275552e651", - "sectionRelativeRepoPath": "fleet-3.9.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-03-10", - "articleTitle": "Fleet 3.9.0", - "articleImageUrl": "/images/articles/fleet-3.9.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.0.0", - "title": "Fleet 4.0.0", - "lastModifiedAt": 1734534699114, - "htmlId": "articles--fleet-400--10db6c0618", - "sectionRelativeRepoPath": "fleet-4.0.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-06-30", - "articleTitle": "Fleet 4.0.0 released with Role-based access control and Teams features", - "articleImageUrl": "/images/articles/fleet-4.0.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.1.0", - "title": "Fleet 4.1.0", - "lastModifiedAt": 1734534699115, - "htmlId": "articles--fleet-410--f2c5bee323", - "sectionRelativeRepoPath": "fleet-4.1.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-07-27", - "articleTitle": "Fleet 4.1.0 released with Schedule and Activity feed features", - "articleImageUrl": "/images/articles/fleet-4.1.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.10.0", - "title": "Fleet 4.10.0", - "lastModifiedAt": 1734534699116, - "htmlId": "articles--fleet-4100--18ddf38cc7", - "sectionRelativeRepoPath": "fleet-4.10.0.md", - "meta": { - "category": "releases", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2022-02-14", - "articleTitle": "Fleet 4.10.0 brings new features and improvements for vulnerability analysts.", - "articleImageUrl": "/images/articles/fleet-4.10.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.11.0", - "title": "Fleet 4.11.0", - "lastModifiedAt": 1734534699117, - "htmlId": "articles--fleet-4110--c9e9d0d603", - "sectionRelativeRepoPath": "fleet-4.11.0.md", - "meta": { - "category": "releases", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2022-03-07", - "articleTitle": "Fleet 4.11.0 brings impact clarity, improvements to vulnerability processing, and performance updates.", - "articleImageUrl": "/images/articles/fleet-4.11.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.12.0", - "title": "Fleet 4.12.0", - "lastModifiedAt": 1734534699118, - "htmlId": "articles--fleet-4120--4bc9e064ba", - "sectionRelativeRepoPath": "fleet-4.12.0.md", - "meta": { - "category": "releases", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2022-03-25", - "articleTitle": "Fleet 4.12.0 | Platform-specific policies, and improved query results", - "articleImageUrl": "/images/articles/fleet-4.12.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.13.0", - "title": "Fleet 4.13.0", - "lastModifiedAt": 1734534699119, - "htmlId": "articles--fleet-4130--cb9b277673", - "sectionRelativeRepoPath": "fleet-4.13.0.md", - "meta": { - "category": "releases", - "authorFullName": "Fleet", - "authorGitHubUsername": "fleetdm", - "publishedOn": "2022-04-19", - "articleTitle": "Fleet 4.13.0 | Security fixes, policy automations for teams, and aggregated macOS versions for MacAdmins.", - "articleImageUrl": "/images/articles/fleet-4.13.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.14.0", - "title": "Fleet 4.14.0", - "lastModifiedAt": 1734534699120, - "htmlId": "articles--fleet-4140--119ab6bde6", - "sectionRelativeRepoPath": "fleet-4.14.0.md", - "meta": { - "category": "releases", - "authorFullName": "Kathy Satterlee", - "authorGitHubUsername": "ksatter", - "publishedOn": "2022-05-06", - "articleTitle": "Fleet 4.14.0 adds beta support for automatic ticket creation and improves the live query experience.", - "articleImageUrl": "/images/articles/fleet-4.14.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.15.0", - "title": "Fleet 4.15.0", - "lastModifiedAt": 1734534699121, - "htmlId": "articles--fleet-4150--5ca468cde4", - "sectionRelativeRepoPath": "fleet-4.15.0.md", - "meta": { - "category": "releases", - "authorFullName": "Kathy Satterlee", - "authorGitHubUsername": "ksatter", - "publishedOn": "2022-05-30", - "articleTitle": "Fleet 4.15.0 adds beta support for Self-service, Scope transparency, and brings Zendesk to the party.", - "articleImageUrl": "/images/articles/fleet-4.15.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.16.0", - "title": "Fleet 4.16.0", - "lastModifiedAt": 1734534699122, - "htmlId": "articles--fleet-4160--b989e3c168", - "sectionRelativeRepoPath": "fleet-4.16.0.md", - "meta": { - "category": "releases", - "authorFullName": "Kathy Satterlee", - "authorGitHubUsername": "ksatter", - "publishedOn": "2022-06-16", - "articleTitle": "Fleet 4.16.0 | more customization, beefed up vuln management, Jira added to integrations.", - "articleImageUrl": "/images/articles/fleet-4.16.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.17.0", - "title": "Fleet 4.17.0", - "lastModifiedAt": 1734534699123, - "htmlId": "articles--fleet-4170--8923c0d5ab", - "sectionRelativeRepoPath": "fleet-4.17.0.md", - "meta": { - "category": "releases", - "authorFullName": "Kathy Satterlee", - "authorGitHubUsername": "ksatter", - "publishedOn": "2022-07-11", - "articleTitle": "Fleet 4.17.0 | Better osquery management, user engagement, improved host vitals.", - "articleImageUrl": "/images/articles/fleet-4.17.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.18.0", - "title": "Fleet 4.18.0", - "lastModifiedAt": 1734534699124, - "htmlId": "articles--fleet-4180--56ef86a9d5", - "sectionRelativeRepoPath": "fleet-4.18.0.md", - "meta": { - "category": "releases", - "authorFullName": "Kathy Satterlee", - "authorGitHubUsername": "ksatter", - "publishedOn": "2022-08-03", - "articleTitle": "Fleet 4.18.0 | Better security and user messaging in Fleet Desktop", - "articleImageUrl": "/images/articles/fleet-4.18.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.19.0", - "title": "Fleet 4.19.0", - "lastModifiedAt": 1734534699125, - "htmlId": "articles--fleet-4190--5c143179c9", - "sectionRelativeRepoPath": "fleet-4.19.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2022-08-22", - "articleTitle": "Fleet 4.19.0 | Just-in-time (JIT) user provisioning, remaining disk space, aggregate Windows and mobile device management (MDM) data", - "articleImageUrl": "/images/articles/fleet-4.19.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.2.0", - "title": "Fleet 4.2.0", - "lastModifiedAt": 1734534699126, - "htmlId": "articles--fleet-420--9537c701a9", - "sectionRelativeRepoPath": "fleet-4.2.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2021-08-12", - "articleTitle": "Fleet 4.2.0", - "articleImageUrl": "/images/articles/fleet-4.2.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.20.0", - "title": "Fleet 4.20.0", - "lastModifiedAt": 1734534699127, - "htmlId": "articles--fleet-4200--d5427af58e", - "sectionRelativeRepoPath": "fleet-4.20.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2022-09-09", - "articleTitle": "Fleet 4.20.0 | Aggregate Munki issues, test features on canary teams, improved macOS vulnerability detection", - "articleImageUrl": "/images/articles/fleet-4.20.0-1600x900.jpg" - } - }, - { - "url": "/releases/fleet-4.21.0", - "title": "Fleet 4.21.0", - "lastModifiedAt": 1734534699128, - "htmlId": "articles--fleet-4210--250af294a1", - "sectionRelativeRepoPath": "fleet-4.21.0.md", - "meta": { - "category": "releases", - "authorFullName": "Chris McGillicuddy", - "authorGitHubUsername": "chris-mcgillicuddy", - "publishedOn": "2022-10-05", - "articleTitle": "Fleet 4.21.0 | Validate config and teams YAML documents, manage osquery flags remotely with Orbit, view team and global policy compliance", - "articleImageUrl": "/images/articles/fleet-4.21.0-1600x900@2x.jpeg" - } - }, - { - "url": "/releases/fleet-4.22.0", - "title": "Fleet 4.22.0", - "lastModifiedAt": 1734534699129, - "htmlId": "articles--fleet-4220--95aabc5883", - "sectionRelativeRepoPath": "fleet-4.22.0.md", - "meta": { - "category": "releases", - "authorFullName": "Chris McGillicuddy", - "authorGitHubUsername": "chris-mcgillicuddy", - "publishedOn": "2022-10-21", - "articleTitle": "Fleet 4.22.0 | Easier access to host information, better query console UX, and clearer display names", - "articleImageUrl": "/images/articles/fleet-4.22.0-cover-800x450@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.23.0", - "title": "Fleet 4.23.0", - "lastModifiedAt": 1734534699131, - "htmlId": "articles--fleet-4230--76f329be16", - "sectionRelativeRepoPath": "fleet-4.23.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2022-11-14", - "articleTitle": "Fleet 4.23.0 | Better insight into inherited policies, improved host vitals, and more configuration visibility", - "articleImageUrl": "/images/articles/fleet-4.23.0-800x450@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.24.0", - "title": "Fleet 4.24.0", - "lastModifiedAt": 1734534699131, - "htmlId": "articles--fleet-4240--7b89434612", - "sectionRelativeRepoPath": "fleet-4.24.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2022-12-06", - "articleTitle": "Fleet 4.24.0 | Live query notifications and navigation improvements", - "articleImageUrl": "/images/articles/fleet-4.24.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.25.0", - "title": "Fleet 4.25.0", - "lastModifiedAt": 1734534699132, - "htmlId": "articles--fleet-4250--9084d84103", - "sectionRelativeRepoPath": "fleet-4.25.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2023-01-03", - "articleTitle": "Fleet 4.25.0 | Extra security and MDM visibility", - "articleImageUrl": "/images/articles/fleet-4.25.0-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.26.0", - "title": "Fleet 4.26.0", - "lastModifiedAt": 1734534699134, - "htmlId": "articles--fleet-4260--643bc79002", - "sectionRelativeRepoPath": "fleet-4.26.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2023-01-16", - "articleTitle": "Fleet 4.26.0 | Easier osquery extensions, external audit log destinations, and cleaner data lakes", - "articleImageUrl": "/images/articles/fleet-4.26.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.27.0", - "title": "Fleet 4.27.0", - "lastModifiedAt": 1734534699135, - "htmlId": "articles--fleet-4270--5955f2d968", - "sectionRelativeRepoPath": "fleet-4.27.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2023-02-14", - "articleTitle": "Fleet 4.27.0 | Improved access management and improved search filters", - "articleImageUrl": "/images/articles/fleet-4.27.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.28.0", - "title": "Fleet 4.28.0", - "lastModifiedAt": 1734534699136, - "htmlId": "articles--fleet-4280--dd7df2918a", - "sectionRelativeRepoPath": "fleet-4.28.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-02-28", - "articleTitle": "Fleet 4.28.0 | CIS benchmarks for Ventura", - "articleImageUrl": "/images/articles/fleet-4.28.0-800x450@2x.png" - } - }, - { - "url": "/releases/fleet-4.29.0", - "title": "Fleet 4.29.0", - "lastModifiedAt": 1734534699139, - "htmlId": "articles--fleet-4290--f49e0cb8d6", - "sectionRelativeRepoPath": "fleet-4.29.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-03-22", - "articleTitle": "Fleet 4.29.0 | SSO provides JIT Fleet user roles", - "articleImageUrl": "/images/articles/fleet-4.29.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.3.0", - "title": "Fleet 4.3.0", - "lastModifiedAt": 1734534699140, - "htmlId": "articles--fleet-430--9a60f316f1", - "sectionRelativeRepoPath": "fleet-4.3.0.md", - "meta": { - "category": "releases", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2021-09-07", - "articleTitle": "Fleet 4.3.0", - "articleImageUrl": "/images/articles/fleet-4.3.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.30.0", - "title": "Fleet 4.30.0", - "lastModifiedAt": 1734534699141, - "htmlId": "articles--fleet-4300--6a3be55987", - "sectionRelativeRepoPath": "fleet-4.30.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-04-11", - "articleTitle": "Fleet 4.30.0 | MDM public beta, Observer+ role, Vulnerability publication dates", - "articleImageUrl": "/images/articles/fleet-4.30.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.31.0", - "title": "Fleet 4.31.0", - "lastModifiedAt": 1734534699142, - "htmlId": "articles--fleet-4310--ba7de02e11", - "sectionRelativeRepoPath": "fleet-4.31.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-05-01", - "articleTitle": "Fleet 4.31.0 | MDM enrollment workflow, API user role.", - "articleImageUrl": "/images/articles/fleet-4.31.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.32.0", - "title": "Fleet 4.32.0", - "lastModifiedAt": 1734534699143, - "htmlId": "articles--fleet-4320--747f0854b4", - "sectionRelativeRepoPath": "fleet-4.32.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-05-24", - "articleTitle": "Fleet 4.32.0 | User migration, customizing macOS Setup Assistant.", - "articleImageUrl": "/images/articles/fleet-4.32.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.33.0", - "title": "Fleet 4.33.0", - "lastModifiedAt": 1734534699145, - "htmlId": "articles--fleet-4330--1fee221322", - "sectionRelativeRepoPath": "fleet-4.33.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-06-13", - "articleTitle": "Fleet 4.33.0 | ChromeOS support, new verified status", - "articleImageUrl": "/images/articles/fleet-4.33.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.34.0", - "title": "Fleet 4.34.0", - "lastModifiedAt": 1734534699146, - "htmlId": "articles--fleet-4340--e5a31e5868", - "sectionRelativeRepoPath": "fleet-4.34.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-07-12", - "articleTitle": "Fleet 4.34.0 | ChromeOS tables, CIS Benchmark load testing", - "articleImageUrl": "/images/articles/fleet-4.34.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.35.0", - "title": "Fleet 4.35.0", - "lastModifiedAt": 1734534699147, - "htmlId": "articles--fleet-4350--249a0f8772", - "sectionRelativeRepoPath": "fleet-4.35.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-08-01", - "articleTitle": "Fleet 4.35.0 | Improvements and bug fixes.", - "articleImageUrl": "/images/articles/fleet-4.35.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.36.0", - "title": "Fleet 4.36.0", - "lastModifiedAt": 1734534699148, - "htmlId": "articles--fleet-4360--ebb48de30e", - "sectionRelativeRepoPath": "fleet-4.36.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-08-18", - "articleTitle": "Fleet 4.36.0 | Saved and scheduled queries merge.", - "articleImageUrl": "/images/articles/fleet-4.36.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.37.0", - "title": "Fleet 4.37.0", - "lastModifiedAt": 1734534699149, - "htmlId": "articles--fleet-4370--688288f4e8", - "sectionRelativeRepoPath": "fleet-4.37.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-09-07", - "articleTitle": "Fleet 4.37.0 | Remote script execution & Puppet support.", - "articleImageUrl": "/images/articles/fleet-4.37.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.38.0", - "title": "Fleet 4.38.0", - "lastModifiedAt": 1734534699151, - "htmlId": "articles--fleet-4380--d9dff8c995", - "sectionRelativeRepoPath": "fleet-4.38.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-09-25", - "articleTitle": "Fleet 4.38.0 | Profile redelivery, NVD details, and custom extension label support.", - "articleImageUrl": "/images/articles/fleet-4.38.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.39.0", - "title": "Fleet 4.39.0", - "lastModifiedAt": 1734534699152, - "htmlId": "articles--fleet-4390--c36caafa80", - "sectionRelativeRepoPath": "fleet-4.39.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-10-26", - "articleTitle": "Fleet 4.39.0 | Sonoma support, script library, query reports.", - "articleImageUrl": "/images/articles/fleet-4.39.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.4.0", - "title": "Fleet 4.4.0", - "lastModifiedAt": 1734534699153, - "htmlId": "articles--fleet-440--8b0a4ce185", - "sectionRelativeRepoPath": "fleet-4.4.0.md", - "meta": { - "category": "releases", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2021-10-07", - "articleTitle": "Fleet 4.4.0 releases aggregated software inventory, team policies, and improved team scheduling", - "articleImageUrl": "/images/articles/fleet-4.4.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.40.0", - "title": "Fleet 4.40.0", - "lastModifiedAt": 1734534699154, - "htmlId": "articles--fleet-4400--0b9e981d27", - "sectionRelativeRepoPath": "fleet-4.40.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-11-06", - "articleTitle": "Fleet 4.40.0 | More Data, Rapid Security Response, CIS Benchmark updates.", - "articleImageUrl": "/images/articles/fleet-4.40.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.41.0", - "title": "Fleet 4.41.0", - "lastModifiedAt": 1734534699155, - "htmlId": "articles--fleet-4410--769634013d", - "sectionRelativeRepoPath": "fleet-4.41.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-11-28", - "articleTitle": "Fleet 4.41.0 | NVD API 2.0, Windows script library.", - "articleImageUrl": "/images/articles/fleet-4.41.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.42.0", - "title": "Fleet 4.42.0", - "lastModifiedAt": 1734534699156, - "htmlId": "articles--fleet-4420--310101f058", - "sectionRelativeRepoPath": "fleet-4.42.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-12-21", - "articleTitle": "Fleet 4.42.0 | Query performance reporting, host targeting improvements.", - "articleImageUrl": "/images/articles/fleet-4.42.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.43.0", - "title": "Fleet 4.43.0", - "lastModifiedAt": 1734534699157, - "htmlId": "articles--fleet-4430--8ac4a50fbb", - "sectionRelativeRepoPath": "fleet-4.43.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-01-09", - "articleTitle": "Fleet 4.43.0 | Query performance reporting, host targeting improvements.", - "articleImageUrl": "/images/articles/fleet-4.43.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.44.0", - "title": "Fleet 4.44.0", - "lastModifiedAt": 1734534699159, - "htmlId": "articles--fleet-4440--26af837653", - "sectionRelativeRepoPath": "fleet-4.44.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-02-05", - "articleTitle": "Fleet 4.44.0 | Script execution, host expiry, and host targeting improvements.", - "articleImageUrl": "/images/articles/fleet-4.44.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.45.0", - "title": "Fleet 4.45.0", - "lastModifiedAt": 1734534699160, - "htmlId": "articles--fleet-4450--c8ae399334", - "sectionRelativeRepoPath": "fleet-4.45.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-02-21", - "articleTitle": "Fleet 4.45.0 | Remote lock, Linux script library, osquery storage location.", - "articleImageUrl": "/images/articles/fleet-4.45.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.46.0", - "title": "Fleet 4.46.0", - "lastModifiedAt": 1734534699161, - "htmlId": "articles--fleet-4460--e728f3d2b3", - "sectionRelativeRepoPath": "fleet-4.46.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-02-26", - "articleTitle": "Fleet 4.46.0 | Automatic SCEP certificate renewal.", - "articleImageUrl": "/images/articles/fleet-4.46.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.47.0", - "title": "Fleet 4.47.0", - "lastModifiedAt": 1734534699163, - "htmlId": "articles--fleet-4470--6295db06d8", - "sectionRelativeRepoPath": "fleet-4.47.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-03-12", - "articleTitle": "Fleet 4.47.0 | Cross-platform remote wipe, vulnerabilities page, and scripting improvements.", - "articleImageUrl": "/images/articles/fleet-4.47.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.48.0", - "title": "Fleet 4.48.0", - "lastModifiedAt": 1734534699164, - "htmlId": "articles--fleet-4480--0de641ecf8", - "sectionRelativeRepoPath": "fleet-4.48.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-04-03", - "articleTitle": "Fleet 4.48.0 | IdP local account creation, VS Code extensions.", - "articleImageUrl": "/images/articles/fleet-4.48.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.5.0", - "title": "Fleet 4.5.0", - "lastModifiedAt": 1734534699165, - "htmlId": "articles--fleet-450--16090a81fa", - "sectionRelativeRepoPath": "fleet-4.5.0.md", - "meta": { - "category": "releases", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2021-11-02", - "articleTitle": "Fleet 4.5.0 with new team admin role, live OS compatibility checking, query performance impact, and a new-look dashboard", - "articleImageUrl": "/images/articles/fleet-4.5.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.49.0", - "title": "Fleet 4.49.0", - "lastModifiedAt": 1734534699167, - "htmlId": "articles--fleet-4490--785565c6fe", - "sectionRelativeRepoPath": "fleet-4.49.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-04-23", - "articleTitle": "Fleet 4.49.0 | VulnCheck's NVD++, device health API, fleetd data parsing.", - "articleImageUrl": "/images/articles/fleet-4.49.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.50.0", - "title": "Fleet 4.50.0", - "lastModifiedAt": 1734534699169, - "htmlId": "articles--fleet-4500--db0ec5db63", - "sectionRelativeRepoPath": "fleet-4.50.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-05-22", - "articleTitle": "Fleet 4.50.0 | Security agent deployment, AI descriptions, and Mac Admins SOFA support.", - "articleImageUrl": "/images/articles/fleet-4.50.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.51.0", - "title": "Fleet 4.51.0", - "lastModifiedAt": 1734534699171, - "htmlId": "articles--fleet-4510--6fb26e7b9f", - "sectionRelativeRepoPath": "fleet-4.51.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-06-10", - "articleTitle": "Fleet 4.51.0 | Global activity webhook, macOS TCC table, and software self-service.", - "articleImageUrl": "/images/articles/fleet-4.51.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.53.0", - "title": "Fleet 4.53.0", - "lastModifiedAt": 1734534699173, - "htmlId": "articles--fleet-4530--e7adae62e6", - "sectionRelativeRepoPath": "fleet-4.53.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-06-25", - "articleTitle": "Fleet 4.53.0 | Better vuln matching, multi-issue hosts, & `fleetd` logs as tables", - "articleImageUrl": "/images/articles/fleet-4.53.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.54.0", - "title": "Fleet 4.54.0", - "lastModifiedAt": 1734534699174, - "htmlId": "articles--fleet-4540--92d9f0afc7", - "sectionRelativeRepoPath": "fleet-4.54.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-07-17", - "articleTitle": "Fleet 4.54.0 | Target hosts via label exclusion, script execution time.", - "articleImageUrl": "/images/articles/fleet-4.54.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.55.0", - "title": "Fleet 4.55.0", - "lastModifiedAt": 1734534699176, - "htmlId": "articles--fleet-4550--136a79fe52", - "sectionRelativeRepoPath": "fleet-4.55.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-08-09", - "articleTitle": "Fleet 4.55.0 | MySQL 8, arm64 support, FileVault improvements, VPP support.", - "articleImageUrl": "/images/articles/fleet-4.55.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.57.0", - "title": "Fleet 4.57.0", - "lastModifiedAt": 1734534699177, - "htmlId": "articles--fleet-4570--af6b8081fd", - "sectionRelativeRepoPath": "fleet-4.57.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-09-23", - "articleTitle": "Fleet 4.57.0 | Software improvements, policy automation, GitLab support.", - "articleImageUrl": "/images/articles/fleet-4.57.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.56.0", - "title": "Fleet 4.56.0", - "lastModifiedAt": 1734534699179, - "htmlId": "articles--fleet-4560--27b9f794d8", - "sectionRelativeRepoPath": "fleet-4.56.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-09-07", - "articleTitle": "Fleet 4.56.0 | Enhanced MDM migration, Exact CVE Search, and Self-Service VPP Apps.", - "articleImageUrl": "/images/articles/fleet-4.56.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.58.0", - "title": "Fleet 4.58.0", - "lastModifiedAt": 1734534699180, - "htmlId": "articles--fleet-4580--7c0f184c1f", - "sectionRelativeRepoPath": "fleet-4.58.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-10-16", - "articleTitle": "Fleet 4.58.0 | Run script on policy failure, Fleet-maintained apps, Sequoia firewall status.", - "articleImageUrl": "/images/articles/fleet-4.58.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.59.0", - "title": "Fleet 4.59.0", - "lastModifiedAt": 1734534699181, - "htmlId": "articles--fleet-4590--cd9cf3359d", - "sectionRelativeRepoPath": "fleet-4.59.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2024-11-12", - "articleTitle": "Fleet 4.59.0 | Install apps during new Mac boot, connect end users to Wi-Fi", - "articleImageUrl": "/images/articles/fleet-4.59.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.6.0", - "title": "Fleet 4.6.0", - "lastModifiedAt": 1734534699183, - "htmlId": "articles--fleet-460--f6d14e9b59", - "sectionRelativeRepoPath": "fleet-4.6.0.md", - "meta": { - "category": "releases", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2021-11-19", - "articleTitle": "Fleet 4.6.0 with osquery installer, enroll secret management, and improved host vitals", - "articleImageUrl": "/images/articles/fleet-4.6.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.60.0", - "title": "Fleet 4.60.0", - "lastModifiedAt": 1734534699184, - "htmlId": "articles--fleet-4600--e1b5593d81", - "sectionRelativeRepoPath": "fleet-4.60.0.md", - "meta": { - "category": "releases", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "publishedOn": "2024-11-27", - "articleTitle": "Fleet 4.60.0 | Escrow Linux disk encryption keys, custom targets for OS settings, scripts preview", - "articleImageUrl": "/images/articles/fleet-4.60.0-1600x900@2x.png" - } - }, - { - "url": "/releases/fleet-4.7.0", - "title": "Fleet 4.7.0", - "lastModifiedAt": 1734534699185, - "htmlId": "articles--fleet-470--a62ddf9cc9", - "sectionRelativeRepoPath": "fleet-4.7.0.md", - "meta": { - "category": "releases", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2021-12-14", - "articleTitle": "Does Fleet 4.7.0 bring more power to your osquery compliance policies? Yes.", - "articleImageUrl": "/images/articles/fleet-4.7.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.8.0", - "title": "Fleet 4.8.0", - "lastModifiedAt": 1734534699186, - "htmlId": "articles--fleet-480--d05a01c735", - "sectionRelativeRepoPath": "fleet-4.8.0.md", - "meta": { - "category": "releases", - "authorFullName": "Drew Baker", - "authorGitHubUsername": "Drew-P-drawers", - "publishedOn": "2021-12-31", - "articleTitle": "Looking for policy automations, Google Chrome profile search, and Munki details from your hosts? Upgrade to Fleet 4.8.0", - "articleImageUrl": "/images/articles/fleet-4.8.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/releases/fleet-4.9.0", - "title": "Fleet 4.9.0", - "lastModifiedAt": 1734534699187, - "htmlId": "articles--fleet-490--ec1e278406", - "sectionRelativeRepoPath": "fleet-4.9.0.md", - "meta": { - "category": "releases", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2022-01-24", - "articleTitle": "Fleet 4.9.0 brings performance updates, paginated live query results, and policy YAML doc support.", - "articleImageUrl": "/images/articles/fleet-4.9.0-cover-1600x900@2x.jpg" - } - }, - { - "url": "/announcements/fleet-adds-support-for-chrome-os", - "title": "Fleet adds support for chrome os", - "lastModifiedAt": 1734534699188, - "htmlId": "articles--fleet-adds-support-f--d81844f01b", - "sectionRelativeRepoPath": "fleet-adds-support-for-chrome-os.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "spokanemac", - "authorFullName": "JD Strong", - "publishedOn": "2023-06-13", - "articleTitle": "Fleet enhances device management with ChromeOS support", - "articleImageUrl": "/images/articles/fleet-adds-support-for-chrome-os-1600x900@2x.png", - "description": "We're thrilled to announce that Fleet has expanded support to include ChromeOS and ChromeOS Flex!" - } - }, - { - "url": "/guides/fleet-ai-assisted-policy-descriptions-and-resolutions", - "title": "Fleet ai assisted policy descriptions and resolutions", - "lastModifiedAt": 1734534699189, - "htmlId": "articles--fleet-ai-assisted-po--a7882a108b", - "sectionRelativeRepoPath": "fleet-ai-assisted-policy-descriptions-and-resolutions.md", - "meta": { - "articleTitle": "Fleet’s AI-assisted policy descriptions and resolutions", - "authorFullName": "Rachel Perkins", - "authorGitHubUsername": "rachelelysia", - "category": "guides", - "publishedOn": "2024-05-20", - "articleImageUrl": "/images/articles/fleet-ai-assisted-policy-descriptions-and-resolutions-1600x900@2x.png", - "description": "AI guides our way, Policies clear, secure paths, Compliance shines bright." - } - }, - { - "url": "/announcements/fleet-desktop-says-hello-world", - "title": "Fleet desktop says hello world", - "lastModifiedAt": 1734534699191, - "htmlId": "articles--fleet-desktop-says-h--2f36103425", - "sectionRelativeRepoPath": "fleet-desktop-says-hello-world.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "zhumo", - "authorFullName": "Mo Zhu", - "publishedOn": "2022-08-02", - "articleTitle": "Fleet Desktop says “Hello, world!”", - "articleImageUrl": "/images/articles/fleet-desktop-says-hello-world-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/fleet-desktop", - "title": "Fleet desktop", - "lastModifiedAt": 1734534699192, - "htmlId": "articles--fleet-desktop--d36161e24b", - "sectionRelativeRepoPath": "fleet-desktop.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "zhumo", - "authorFullName": "Mo Zhu", - "publishedOn": "2024-04-19", - "articleTitle": "Fleet Desktop", - "description": "Learn about Fleet Desktop's features for self-remediation and transparency." - } - }, - { - "url": "/announcements/fleet-in-your-calendar-introducing-maintenance-windows", - "title": "Fleet in your calendar introducing maintenance windows", - "lastModifiedAt": 1734534699193, - "htmlId": "articles--fleet-in-your-calend--03ef1241cd", - "sectionRelativeRepoPath": "fleet-in-your-calendar-introducing-maintenance-windows.md", - "meta": { - "category": "announcements", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-04-30", - "articleTitle": "Fleet in your calendar: introducing maintenance windows", - "articleImageUrl": "/images/articles/fleet-in-your-calendar-introducing-maintenance-windows-cover-900x450@2x.png", - "description": "Like any good colleague, when Fleet needs some of your time, it puts it on your calendar." - } - }, - { - "url": "/releases/fleet-introduces-mdm", - "title": "Fleet introduces mdm", - "lastModifiedAt": 1734534699194, - "htmlId": "articles--fleet-introduces-mdm--e126b508aa", - "sectionRelativeRepoPath": "fleet-introduces-mdm.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-04-11", - "articleTitle": "Fleet introduces MDM", - "articleImageUrl": "/images/articles/fleet-mdm-launch-cover-800x450@2x.jpg" - } - }, - { - "url": "/announcements/fleet-in-vegas-2023", - "title": "Fleet in vegas 2023", - "lastModifiedAt": 1734534699195, - "htmlId": "articles--fleet-in-vegas-2023--5e6e6c4702", - "sectionRelativeRepoPath": "fleet-in-vegas-2023.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "spokanemac", - "authorFullName": "JD Strong", - "publishedOn": "2023-08-02", - "articleTitle": "Fleet takes on Vegas: Exploring cybersecurity's future at Black Hat, B-Sides, and DEF CON 31", - "articleImageUrl": "/images/articles/fleet-in-vegas-2023@2x.jpg", - "description": "Explore cybersecurity's cutting edge with Fleet at three top-tier conferences - Black Hat, Security B-Sides, and DEF CON." - } - }, - { - "url": "/announcements/fleet-introduces-windows-mdm", - "title": "Fleet introduces windows mdm", - "lastModifiedAt": 1734534699197, - "htmlId": "articles--fleet-introduces-win--cd488bb223", - "sectionRelativeRepoPath": "fleet-introduces-windows-mdm.md", - "meta": { - "category": "announcements", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-01-24", - "articleTitle": "Fleet introduces Windows MDM", - "articleImageUrl": "/images/articles/fleet-win-mdm-launch-cover-800x450@2x.png" - } - }, - { - "url": "/announcements/fleet-is-abuzz-for-macdevops-yvr-2023", - "title": "Fleet is abuzz for macdevops yvr 2023", - "lastModifiedAt": 1734534699198, - "htmlId": "articles--fleet-is-abuzz-for-m--fc35974d97", - "sectionRelativeRepoPath": "fleet-is-abuzz-for-macdevops-yvr-2023.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "spokanemac", - "authorFullName": "JD Strong", - "publishedOn": "2023-06-07", - "articleTitle": "Fleet is abuzz 🐝 for MacDevOps:YVR", - "articleImageUrl": "/images/articles/fleet-is-abuzz-for-macdevops-yvr-2023@2x.png", - "description": "Fleet is a proud sponsor of MacDevOps:YVR which is back in person in Vancouver, B.C. June 21-22, 2023" - } - }, - { - "url": "/announcements/fleet-now-supports-ios-and-ipados-software-deployment-and-automated-patch-management", - "title": "Fleet now supports ios and ipados software deployment and automated patch management", - "lastModifiedAt": 1734534699199, - "htmlId": "articles--fleet-now-supports-i--8e6c12ef82", - "sectionRelativeRepoPath": "fleet-now-supports-ios-and-ipados-software-deployment-and-automated-patch-management.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "Drew-P-drawers", - "authorFullName": "Andrew Baker", - "publishedOn": "2024-09-26", - "articleTitle": "Fleet now supports iOS and iPadOS, software deployment, and automated patch management.", - "description": "Fleet announces support for iOS and iPadOS, software deployment, and automated patch management" - } - }, - { - "url": "/securing/fleet-osquery-unlocking-the-value-of-axonius-with-open-source-telemetry", - "title": "Fleet osquery unlocking the value of axonius with open source telemetry", - "lastModifiedAt": 1734534699200, - "htmlId": "articles--fleet-osquery-unlock--5e320c2813", - "sectionRelativeRepoPath": "fleet-osquery-unlocking-the-value-of-axonius-with-open-source-telemetry.md", - "meta": { - "category": "security", - "authorFullName": "Brad Macdowall", - "authorGitHubUsername": "BradMacd", - "publishedOn": "2023-12-28", - "articleTitle": "Fleet & osquery: Unlocking the value of Axonius with open-source telemetry", - "articleImageUrl": "/images/articles/fleet-osquery-unlocking-the-value-of-axonius-with-open-source-telemetry-1600x900@2x.png" - } - }, - { - "url": "/guides/fleet-quick-tips-querying-procdump-eula-has-been-accepted", - "title": "Fleet quick tips querying procdump eula has been accepted", - "lastModifiedAt": 1734534699200, - "htmlId": "articles--fleet-quick-tips-que--cc69d0c9b3", - "sectionRelativeRepoPath": "fleet-quick-tips-querying-procdump-eula-has-been-accepted.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "mike-j-thomas", - "authorFullName": "Mike Thomas", - "publishedOn": "2021-05-11", - "articleTitle": "Fleet quick tips — identify systems where the ProcDump EULA has been accepted", - "articleImageUrl": "/images/articles/fleet-quick-tips-querying-procdump-eula-has-been-accepted-cover-700x440@2x.png" - } - }, - { - "url": "/announcements/fleet-supports-macos-15-sequoia-ios-18-and-ipados-18", - "title": "Fleet supports macos 15 sequoia ios 18 and ipados 18", - "lastModifiedAt": 1734534699201, - "htmlId": "articles--fleet-supports-macos--8b3b33de24", - "sectionRelativeRepoPath": "fleet-supports-macos-15-sequoia-ios-18-and-ipados-18.md", - "meta": { - "category": "announcements", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-09-27", - "articleTitle": "Fleet supports Apple’s latest operating systems: macOS 15 Sequoia, iOS 18, and iPadOS 18", - "articleImageUrl": "/images/articles/fleet-supports-macos-15-sequoia-ios-18-and-ipados-18-1600x900@2x.jpg", - "description": "Fleet is pleased to announce full support for macOS 15 Sequoia, iOS 18, and iPadOS 18." - } - }, - { - "url": "/guides/fleet-terraform-byo-vpc-module", - "title": "Fleet terraform byo vpc module", - "lastModifiedAt": 1734534699202, - "htmlId": "articles--fleet-terraform-byo---67fad5f83d", - "sectionRelativeRepoPath": "fleet-terraform-byo-vpc-module.md", - "meta": { - "category": "guides", - "authorFullName": "Robert Fairburn", - "authorGitHubUsername": "rfairburn", - "publishedOn": "2023-09-01", - "articleTitle": "Using the Fleet Terraform module with an existing VPC" - } - }, - { - "url": "/announcements/fleet-terraform-module", - "title": "Fleet terraform module", - "lastModifiedAt": 1734534699203, - "htmlId": "articles--fleet-terraform-modu--ee02810266", - "sectionRelativeRepoPath": "fleet-terraform-module.md", - "meta": { - "category": "announcements", - "authorFullName": "Zachary Winnerman", - "authorGitHubUsername": "zwinnerman-fleetdm", - "publishedOn": "2023-01-09", - "articleTitle": "Keep Fleet running smoothly on AWS with the new Terraform module" - } - }, - { - "url": "/announcements/fleet-reimagines-observability-with-devops-teams", - "title": "Fleet reimagines observability with devops teams", - "lastModifiedAt": 1734534699204, - "htmlId": "articles--fleet-reimagines-obs--e61405d9fc", - "sectionRelativeRepoPath": "fleet-reimagines-observability-with-devops-teams.md", - "meta": { - "category": "announcements", - "authorFullName": "Mike McNeil", - "authorGitHubUsername": "mikermcneil", - "publishedOn": "2024-11-14", - "articleTitle": "Fleet reimagines observability with DevOps teams at Roblox, Atlassian, Dropbox", - "description": "Fleet speeds up compliance audits and enables next-gen intrusion detection in large production infrastructures" - } - }, - { - "url": "/guides/fleet-usage-statistics", - "title": "Fleet usage statistics", - "lastModifiedAt": 1734534699205, - "htmlId": "articles--fleet-usage-statisti--14a3f66822", - "sectionRelativeRepoPath": "fleet-usage-statistics.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-08-13", - "articleTitle": "Fleet usage statistics", - "description": "Learn about Fleet's usage statistics and what information is collected." - } - }, - { - "url": "/success-stories/fleet-user-stories-f100", - "title": "Fleet user stories f100", - "lastModifiedAt": 1734534699207, - "htmlId": "articles--fleet-user-stories-f--037a54a633", - "sectionRelativeRepoPath": "fleet-user-stories-f100.md", - "meta": { - "category": "success stories", - "authorGitHubUsername": "mike-j-thomas", - "authorFullName": "Mike Thomas", - "publishedOn": "2021-09-29", - "articleTitle": "Fleet user stories — F100", - "articleImageUrl": "/images/articles/fleet-user-stories-f100-cover-800x450@2x.png" - } - }, - { - "url": "/success-stories/fleet-user-stories-schrodinger", - "title": "Fleet user stories schrodinger", - "lastModifiedAt": 1734534699208, - "htmlId": "articles--fleet-user-stories-s--18d6e5a27f", - "sectionRelativeRepoPath": "fleet-user-stories-schrodinger.md", - "meta": { - "category": "success stories", - "authorGitHubUsername": "mike-j-thomas", - "authorFullName": "Mike Thomas", - "publishedOn": "2021-09-10", - "articleTitle": "Fleet user stories — Schrödinger", - "articleImageUrl": "/images/articles/fleet-user-stories-schrodinger-cover-800x450@2x.png" - } - }, - { - "url": "/success-stories/fleet-user-stories-wayfair", - "title": "Fleet user stories wayfair", - "lastModifiedAt": 1734534699209, - "htmlId": "articles--fleet-user-stories-w--bf80b85383", - "sectionRelativeRepoPath": "fleet-user-stories-wayfair.md", - "meta": { - "category": "success stories", - "authorGitHubUsername": "mike-j-thomas", - "authorFullName": "Mike Thomas", - "publishedOn": "2021-08-20", - "articleTitle": "Fleet user stories — Wayfair", - "articleImageUrl": "/images/articles/fleet-user-stories-wayfair-cover-800x450@2x.png" - } - }, - { - "url": "/guides/fleetctl", - "title": "Fleetctl", - "lastModifiedAt": 1734534699210, - "htmlId": "articles--fleetctl--6d77afeae9", - "sectionRelativeRepoPath": "fleetctl.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-07-04", - "articleTitle": "fleetctl", - "description": "Read about fleetctl, a CLI tool for managing Fleet and osquery configurations, running queries, generating Fleet's agent (fleetd), and more." - } - }, - { - "url": "/guides/fleetd-authentication", - "title": "Fleetd authentication", - "lastModifiedAt": 1734534699211, - "htmlId": "articles--fleetd-authenticatio--8506cf0233", - "sectionRelativeRepoPath": "fleetd-authentication.md", - "meta": { - "authorGitHubUsername": "lucasmrod", - "authorFullName": "Lucas Rodriguez", - "publishedOn": "2024-11-14", - "articleTitle": "Fleetd authentication", - "category": "guides" - } - }, - { - "url": "/guides/fleetd-mtls", - "title": "Fleetd mtls", - "lastModifiedAt": 1734534699213, - "htmlId": "articles--fleetd-mtls--8e886750d3", - "sectionRelativeRepoPath": "fleetd-mtls.md", - "meta": { - "authorGitHubUsername": "lucasmrod", - "authorFullName": "Lucas Rodriguez", - "publishedOn": "2024-12-06", - "articleTitle": "mTLS support in fleetd", - "category": "guides" - } - }, - { - "url": "/guides/fleetd-updates", - "title": "Fleetd updates", - "lastModifiedAt": 1734534699214, - "htmlId": "articles--fleetd-updates--c5705e22b1", - "sectionRelativeRepoPath": "fleetd-updates.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-04-30", - "articleTitle": "Fleetd updates", - "description": "Information on how to manage and secure Fleet agent updates." - } - }, - { - "url": "/announcements/foursquare-quickly-migrates-to-fleet", - "title": "Foursquare quickly migrates to Fleet", - "lastModifiedAt": 1734534699215, - "htmlId": "articles--foursquare-quickly-m--44a6d79b32", - "sectionRelativeRepoPath": "foursquare-quickly-migrates-to-fleet.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "Drew-P-drawers", - "authorFullName": "Andrew Baker", - "publishedOn": "2024-12-13", - "articleTitle": "Foursquare quickly migrates to Fleet for Device Management", - "description": "Foursquare quickly migrates to Fleet for Device Management" - } - }, - { - "url": "/announcements/from-osquery-to-fleet-planting-the-seed", - "title": "From osquery to Fleet planting the seed", - "lastModifiedAt": 1734534699216, - "htmlId": "articles--from-osquery-to-flee--4079a239ba", - "sectionRelativeRepoPath": "from-osquery-to-fleet-planting-the-seed.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2022-01-20", - "articleTitle": "The next step for Fleet: our $5M seed round 🌱", - "articleImageUrl": "/images/articles/from-osquery-to-fleet-planting-the-seed-cover-800x450@2x.png" - } - }, - { - "url": "/guides/generate-process-trees-with-osquery", - "title": "Generate process trees with osquery", - "lastModifiedAt": 1734534699217, - "htmlId": "articles--generate-process-tre--d66f117257", - "sectionRelativeRepoPath": "generate-process-trees-with-osquery.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2020-03-17", - "articleTitle": "Generate process trees with osquery", - "articleImageUrl": "/images/articles/generate-process-trees-with-osquery-cover-700x393@2x.jpeg" - } - }, - { - "url": "/securing/get-and-stay-compliant-across-your-devices-with-fleet", - "title": "Get and stay compliant across your devices with Fleet", - "lastModifiedAt": 1734534699219, - "htmlId": "articles--get-and-stay-complia--962ba5c6b2", - "sectionRelativeRepoPath": "get-and-stay-compliant-across-your-devices-with-fleet.md", - "meta": { - "category": "security", - "authorFullName": "Drew Baker", - "authorGitHubUsername": "Drew-P-drawers", - "publishedOn": "2022-03-09", - "articleTitle": "Get and stay compliant across your devices with Fleet.", - "articleImageUrl": "/images/articles/get-and-stay-compliant-across-your-devices-with-fleet-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/get-current-telemetry-from-your-devices-with-live-queries", - "title": "Get current telemetry from your devices with live queries", - "lastModifiedAt": 1734534699220, - "htmlId": "articles--get-current-telemetr--3c3b77f4f1", - "sectionRelativeRepoPath": "get-current-telemetry-from-your-devices-with-live-queries.md", - "meta": { - "articleTitle": "Get current telemetry from your devices with live queries", - "authorFullName": "Victor Lyuboslavsky", - "authorGitHubUsername": "getvictor", - "category": "guides", - "publishedOn": "2023-12-27", - "description": "Learn how live queries work under the hood." - } - }, - { - "url": "/announcements/global-cloud-platform-simplifies-device-management-with-fleet", - "title": "Global cloud platform simplifies device management with Fleet", - "lastModifiedAt": 1734534699221, - "htmlId": "articles--global-cloud-platfor--900400eb11", - "sectionRelativeRepoPath": "global-cloud-platform-simplifies-device-management-with-fleet.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "Drew-P-drawers", - "authorFullName": "Andrew Baker", - "publishedOn": "2024-12-09", - "articleTitle": "Global edge cloud platform simplifies device management with Fleet", - "description": "Global edge cloud platform simplifies device management" - } - }, - { - "url": "/announcements/global-social-media-platform-switches-to-fleet", - "title": "Global social media platform switches to Fleet", - "lastModifiedAt": 1734534699221, - "htmlId": "articles--global-social-media---20a1284024", - "sectionRelativeRepoPath": "global-social-media-platform-switches-to-fleet.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "Drew-P-drawers", - "authorFullName": "Andrew Baker", - "publishedOn": "2024-12-16", - "articleTitle": "Global social media platform migrates to Fleet", - "description": "Global social media platform migrates to Fleet" - } - }, - { - "url": "/announcements/government-agencies-need-to-dith-the-mdm-thicket", - "title": "Government agencies need to dith the mdm thicket", - "lastModifiedAt": 1734534699222, - "htmlId": "articles--government-agencies---854c091be3", - "sectionRelativeRepoPath": "government-agencies-need-to-dith-the-mdm-thicket.md", - "meta": { - "category": "announcements", - "authorFullName": "Keith Barnes", - "authorGitHubUsername": "KAB703", - "publishedOn": "2024-02-09", - "articleTitle": "Government agencies need to ditch the MDM thicket: multiple solutions cost you more than you think", - "articleImageUrl": "/images/articles/government-agencies-need-to-dith-the-mdm-thicket-1600x900@2x.png" - } - }, - { - "url": "/announcements/happy-1st-anniversary-fleet", - "title": "Happy 1st anniversary Fleet", - "lastModifiedAt": 1734534699223, - "htmlId": "articles--happy-1st-anniversar--f5bfe1b189", - "sectionRelativeRepoPath": "happy-1st-anniversary-fleet.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "mike-j-thomas", - "authorFullName": "Mike Thomas", - "publishedOn": "2021-10-08", - "articleTitle": "Happy 1st anniversary, Fleet.", - "articleImageUrl": "/images/articles/happy-1st-anniversary-fleet-cover-800x450@2x.png" - } - }, - { - "url": "/securing/how-fleet-helps-federal-agencies-meet-cisa-bod-23-01", - "title": "How Fleet helps federal agencies meet cisa bod 23 01", - "lastModifiedAt": 1734534699224, - "htmlId": "articles--how-fleet-helps-fede--a65d1be4f6", - "sectionRelativeRepoPath": "how-fleet-helps-federal-agencies-meet-cisa-bod-23-01.md", - "meta": { - "category": "security", - "authorFullName": "Chris McGillicuddy", - "authorGitHubUsername": "chris-mcgillicuddy", - "publishedOn": "2022-10-28", - "articleTitle": "How Fleet helps federal agencies meet CISA BOD 23-01", - "articleImageUrl": "/images/articles/BOD-23-01-800x450@2x.jpg" - } - }, - { - "url": "/securing/how-osquery-can-help-cyber-responders", - "title": "How osquery can help cyber responders", - "lastModifiedAt": 1734534699225, - "htmlId": "articles--how-osquery-can-help--64d8236168", - "sectionRelativeRepoPath": "how-osquery-can-help-cyber-responders.md", - "meta": { - "category": "security", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-11-02", - "articleTitle": "How osquery can help cyber responders.", - "articleImageUrl": "/images/articles/osquery-for-cyber-responders-1600x900@2x.png" - } - }, - { - "url": "/guides/how-to-install-osquery-and-enroll-linux-devices-into-fleet", - "title": "How to install osquery and enroll linux devices into Fleet", - "lastModifiedAt": 1734534699226, - "htmlId": "articles--how-to-install-osque--d33896be80", - "sectionRelativeRepoPath": "how-to-install-osquery-and-enroll-linux-devices-into-fleet.md", - "meta": { - "category": "guides", - "authorFullName": "Kathy Satterlee", - "authorGitHubUsername": "ksatter", - "publishedOn": "2022-03-19", - "articleTitle": "How to install osquery and enroll Linux devices into Fleet", - "articleImageUrl": "/images/articles/install-osquery-and-enroll-linux-devices-into-fleet-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/how-to-configure-logging-destinations", - "title": "How to configure logging destinations", - "lastModifiedAt": 1734534699227, - "htmlId": "articles--how-to-configure-log--18300d7923", - "sectionRelativeRepoPath": "how-to-configure-logging-destinations.md", - "meta": { - "category": "guides", - "authorFullName": "Grant Bilstad", - "authorGitHubUsername": "pacamaster", - "publishedOn": "2024-06-28", - "articleTitle": "How to configure logging destinations", - "articleImageUrl": "/images/articles/how-to-configure-logging-destinations-1600x900@2x.jpg" - } - }, - { - "url": "/guides/how-to-install-osquery-and-enroll-macos-devices-into-fleet", - "title": "How to install osquery and enroll macos devices into Fleet", - "lastModifiedAt": 1734534699228, - "htmlId": "articles--how-to-install-osque--fa9a55f7e1", - "sectionRelativeRepoPath": "how-to-install-osquery-and-enroll-macos-devices-into-fleet.md", - "meta": { - "category": "guides", - "authorFullName": "Kelvin Omereshone", - "authorGitHubUsername": "dominuskelvin", - "publishedOn": "2022-01-13", - "articleTitle": "How to install osquery and enroll macOS devices into Fleet", - "articleImageUrl": "/images/articles/install-osquery-and-enroll-macos-devices-into-fleet-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/how-to-install-osquery-and-enroll-windows-devices-into-fleet", - "title": "How to install osquery and enroll windows devices into Fleet", - "lastModifiedAt": 1734534699229, - "htmlId": "articles--how-to-install-osque--39c080aee9", - "sectionRelativeRepoPath": "how-to-install-osquery-and-enroll-windows-devices-into-fleet.md", - "meta": { - "category": "guides", - "authorFullName": "Kelvin Omereshone", - "authorGitHubUsername": "dominuskelvin", - "publishedOn": "2022-02-03", - "articleTitle": "How to install osquery and enroll Windows devices into Fleet", - "articleImageUrl": "/images/articles/install-osquery-and-enroll-windows-devices-into-fleet-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/how-to-uninstall-fleetd", - "title": "How to uninstall fleetd", - "lastModifiedAt": 1734534699230, - "htmlId": "articles--how-to-uninstall-fle--4929ab558d", - "sectionRelativeRepoPath": "how-to-uninstall-fleetd.md", - "meta": { - "category": "guides", - "authorFullName": "Eric Shaw", - "authorGitHubUsername": "eashaw", - "publishedOn": "2021-09-08", - "articleTitle": "How to uninstall fleetd", - "articleImageUrl": "/images/articles/how-to-uninstall-osquery-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/how-to-use-policies-for-patch-management-in-fleet", - "title": "How to use policies for patch management in Fleet", - "lastModifiedAt": 1734534699231, - "htmlId": "articles--how-to-use-policies---747d9b8a2e", - "sectionRelativeRepoPath": "how-to-use-policies-for-patch-management-in-fleet.md", - "meta": { - "articleTitle": "How to use policies for patch management in Fleet", - "authorFullName": "Harrison Ravazzolo", - "authorGitHubUsername": "harrisonravazzolo", - "category": "guides", - "publishedOn": "2024-11-07", - "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", - "description": "This guide explores automating patching across your environment." - } - }, - { - "url": "/guides/import-and-export-queries-in-fleet", - "title": "Import and export queries in Fleet", - "lastModifiedAt": 1734534699231, - "htmlId": "articles--import-and-export-qu--94263bf86b", - "sectionRelativeRepoPath": "import-and-export-queries-in-fleet.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2021-02-16", - "articleTitle": "Import and export queries in Fleet", - "articleImageUrl": "/images/articles/import-and-export-queries-in-Fleet-1600x900@2x.png" - } - }, - { - "url": "/guides/install-fleet-maintained-apps-on-macos-hosts", - "title": "Install Fleet maintained apps on macos hosts", - "lastModifiedAt": 1734534699232, - "htmlId": "articles--install-fleet-mainta--6f89dd04e8", - "sectionRelativeRepoPath": "install-fleet-maintained-apps-on-macos-hosts.md", - "meta": { - "category": "guides", - "authorFullName": "Gabriel Hernandez", - "authorGitHubUsername": "ghernandez345", - "publishedOn": "2024-10-16", - "articleTitle": "Fleet-maintained apps" - } - }, - { - "url": "/guides/install-vpp-apps-on-macos-using-fleet", - "title": "Install vpp apps on macos using Fleet", - "lastModifiedAt": 1734534699234, - "htmlId": "articles--install-vpp-apps-on---db2a5ca3fb", - "sectionRelativeRepoPath": "install-vpp-apps-on-macos-using-fleet.md", - "meta": { - "articleTitle": "Install App Store (VPP) apps", - "authorFullName": "Jahziel Villasana-Espinoza", - "authorGitHubUsername": "jahzielv", - "category": "guides", - "publishedOn": "2024-08-12", - "articleImageUrl": "/images/articles/install-vpp-apps-on-macos-using-fleet-1600x900@2x.png", - "description": "This guide will walk you through installing VPP apps on macOS, iOS, and iPadOS using Fleet." - } - }, - { - "url": "/announcements/introducing-cross-platform-script-execution", - "title": "Introducing cross platform script execution", - "lastModifiedAt": 1734534699235, - "htmlId": "articles--introducing-cross-pl--5d1c4a2317", - "sectionRelativeRepoPath": "introducing-cross-platform-script-execution.md", - "meta": { - "category": "announcements", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-10-17", - "articleTitle": "Introducing cross-platform script execution", - "articleImageUrl": "/images/articles/introducing-cross-platform-script-execution-800x450@2x.png" - } - }, - { - "url": "/announcements/introducing-fleet-ultimate", - "title": "Introducing Fleet ultimate", - "lastModifiedAt": 1734534699235, - "htmlId": "articles--introducing-fleet-ul--219d4821a9", - "sectionRelativeRepoPath": "introducing-fleet-ultimate.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "jarodreyes", - "authorFullName": "Jarod Reyes", - "publishedOn": "2023-02-20", - "articleTitle": "Introducing CIS benchmarks, managed-cloud hosting and custom calculator in the new Fleet Ultimate plan.", - "articleImageUrl": "/images/articles/happy-1st-anniversary-fleet-cover-800x450@2x.png" - } - }, - { - "url": "/announcements/introducing-orbit-your-fleet-agent-manager", - "title": "Introducing orbit your Fleet agent manager", - "lastModifiedAt": 1734534699236, - "htmlId": "articles--introducing-orbit-yo--93e04455a9", - "sectionRelativeRepoPath": "introducing-orbit-your-fleet-agent-manager.md", - "meta": { - "category": "announcements", - "authorFullName": "Mo Zhu", - "authorGitHubUsername": "zhumo", - "publishedOn": "2022-08-18", - "articleTitle": "Introducing Orbit, your Fleet agent manager", - "articleImageUrl": "/images/articles/fleet-4.17.0-1-1600x900@2x.jpg" - } - }, - { - "url": "/securing/introducing-workbrew", - "title": "Introducing workbrew", - "lastModifiedAt": 1734534699237, - "htmlId": "articles--introducing-workbrew--e4596aa816", - "sectionRelativeRepoPath": "introducing-workbrew.md", - "meta": { - "authorGitHubUsername": "drew-p-drawers", - "authorFullName": "Drew Baker", - "publishedOn": "2024-11-19", - "articleTitle": "Introducing Workbrew: bringing enterprise control to Homebrew deployments", - "category": "security", - "articleImageUrl": "/images/articles/fleet-and-workbrew-1600x900@2x.png" - } - }, - { - "url": "/announcements/large-gaming-company-enhances-server-observability-with-fleet", - "title": "Large gaming company enhances server observability with Fleet", - "lastModifiedAt": 1734534699238, - "htmlId": "articles--large-gaming-company--a14a1d829c", - "sectionRelativeRepoPath": "large-gaming-company-enhances-server-observability-with-fleet.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "Drew-P-drawers", - "authorFullName": "Andrew Baker", - "publishedOn": "2024-12-11", - "articleTitle": "Large gaming company enhances server observability with Fleet", - "description": "Large gaming company enhances server observability with Fleet" - } - }, - { - "url": "/guides/linux-disk-encryption-end-user", - "title": "Linux disk encryption end user", - "lastModifiedAt": 1734534699240, - "htmlId": "articles--linux-disk-encryptio--41be992ae8", - "sectionRelativeRepoPath": "linux-disk-encryption-end-user.md", - "meta": { - "articleTitle": "Encrypt your Fleet-managed Linux device", - "authorFullName": "Rachael Shaw", - "authorGitHubUsername": "rachaelshaw", - "category": "guides", - "publishedOn": "2024-11-25", - "description": "Instructions for end users to encrypt Linux devices enrolled in Fleet." - } - }, - { - "url": "/engineering/linux-vulnerability-detection-with-oval-and-fleet", - "title": "Linux vulnerability detection with oval and Fleet", - "lastModifiedAt": 1734534699241, - "htmlId": "articles--linux-vulnerability---93b6713d3f", - "sectionRelativeRepoPath": "linux-vulnerability-detection-with-oval-and-fleet.md", - "meta": { - "category": "engineering", - "authorGitHubUsername": "juan-fdz-hawa", - "authorFullName": "Juan Fernandes", - "publishedOn": "2022-07-29", - "articleTitle": "Linux vulnerability detection with OVAL and Fleet", - "articleImageUrl": "/images/articles/linux-vulnerability-detection-with-oval-and-fleet-1600x900@2x.jpg" - } - }, - { - "url": "/guides/locate-assets-with-osquery", - "title": "Locate assets with osquery", - "lastModifiedAt": 1734534699242, - "htmlId": "articles--locate-assets-with-o--e0c56a771b", - "sectionRelativeRepoPath": "locate-assets-with-osquery.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2021-05-11", - "articleTitle": "Locate device assets in the event of an emergency.", - "articleImageUrl": "/images/articles/locate-assets-with-osquery-cover-700x393@2x.jpeg" - } - }, - { - "url": "/guides/lock-wipe-hosts", - "title": "Lock wipe hosts", - "lastModifiedAt": 1734534699244, - "htmlId": "articles--lock-wipe-hosts--96ff748610", - "sectionRelativeRepoPath": "lock-wipe-hosts.md", - "meta": { - "articleTitle": "Lock and wipe hosts", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "category": "guides", - "publishedOn": "2024-07-09", - "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png" - } - }, - { - "url": "/guides/log-destinations", - "title": "Log destinations", - "lastModifiedAt": 1734534699247, - "htmlId": "articles--log-destinations--d18a750fa9", - "sectionRelativeRepoPath": "log-destinations.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "rachaelshaw", - "authorFullName": "Rachael Shaw", - "publishedOn": "2023-11-02", - "articleTitle": "Log destinations", - "description": "Learn about supported log destinations in Fleet, including Amazon Kinesis, AWS Lambda Snowflake, Splunk, and more." - } - }, - { - "url": "/securing/lossless-yubikeys-with-yubitrak-and-airtag", - "title": "Lossless yubikeys with yubitrak and airtag", - "lastModifiedAt": 1734534699248, - "htmlId": "articles--lossless-yubikeys-wi--df5b60eafb", - "sectionRelativeRepoPath": "lossless-yubiKeys-with-yubitrak-and-airtag.md", - "meta": { - "category": "security", - "authorGitHubUsername": "GuillaumeRoss", - "authorFullName": "Guillaume Ross", - "publishedOn": "2022-06-16", - "articleTitle": "Lossless YubiKeys with Yubitrak and AirTag", - "articleImageUrl": "/images/articles/lossless-yubikeys-with-yubitrak-and-airtag-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/macos-mdm-setup", - "title": "Macos mdm setup", - "lastModifiedAt": 1734534699249, - "htmlId": "articles--macos-mdm-setup--287604fb55", - "sectionRelativeRepoPath": "macos-mdm-setup.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "zhumo", - "authorFullName": "Mo Zhu", - "publishedOn": "2024-07-02", - "articleTitle": "macOS MDM setup", - "description": "Learn how to turn on MDM features in Fleet." - } - }, - { - "url": "/guides/macos-setup-experience", - "title": "Macos setup experience", - "lastModifiedAt": 1734534699251, - "htmlId": "articles--macos-setup-experien--3896ddbd41", - "sectionRelativeRepoPath": "macos-setup-experience.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-07-03", - "articleTitle": "macOS setup experience", - "description": "Customize your macOS setup experience with Fleet Premium by managing user authentication, Setup Assistant panes, and installing bootstrap packages." - } - }, - { - "url": "/guides/managing-labels-in-fleet", - "title": "Managing labels in Fleet", - "lastModifiedAt": 1734534699252, - "htmlId": "articles--managing-labels-in-f--794fb9f460", - "sectionRelativeRepoPath": "managing-labels-in-fleet.md", - "meta": { - "articleTitle": "Managing labels in Fleet", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "category": "guides", - "publishedOn": "2024-07-18", - "articleImageUrl": "/images/articles/managing-labels-in-fleet-1600x900@2x.png", - "description": "This guide will walk you through managing labels using the Fleet web UI." - } - }, - { - "url": "/securing/mapping-fleet-and-osquery-results-to-the-mitre-attck-framework-via-splunk", - "title": "Mapping Fleet and osquery results to the mitre attck framework via splunk", - "lastModifiedAt": 1734534699253, - "htmlId": "articles--mapping-fleet-and-os--68bafcbe1a", - "sectionRelativeRepoPath": "mapping-fleet-and-osquery-results-to-the-mitre-attck-framework-via-splunk.md", - "meta": { - "category": "security", - "authorFullName": "Dave Herder", - "authorGitHubUsername": "dherder", - "publishedOn": "2023-01-30", - "articleTitle": "Mapping Fleet and osquery results to the MITRE ATT&CK® framework via Splunk", - "articleImageUrl": "/images/articles/mapping-fleet-and-osquery-results-to-the-mitre-attck-framework-via-splunk-1600x900@2x.png" - } - }, - { - "url": "/guides/mdm-commands", - "title": "Mdm commands", - "lastModifiedAt": 1734534699254, - "htmlId": "articles--mdm-commands--bdf57f5f77", - "sectionRelativeRepoPath": "mdm-commands.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-06-12", - "articleTitle": "MDM commands", - "description": "Learn how to run custom MDM commands on hosts using Fleet." - } - }, - { - "url": "/guides/mdm-migration", - "title": "Mdm migration", - "lastModifiedAt": 1734534699255, - "htmlId": "articles--mdm-migration--be7bd5f783", - "sectionRelativeRepoPath": "mdm-migration.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "zhumo", - "authorFullName": "Mo Zhu", - "publishedOn": "2024-08-14", - "articleTitle": "MDM migration", - "description": "Instructions for migrating hosts away from an old MDM solution to Fleet." - } - }, - { - "url": "/guides/ndes-scep-proxy", - "title": "Ndes scep proxy", - "lastModifiedAt": 1734534699257, - "htmlId": "articles--ndes-scep-proxy--9665f50868", - "sectionRelativeRepoPath": "ndes-scep-proxy.md", - "meta": { - "articleTitle": "Connect end users to Wi-Fi with Simple Certificate Enrollment Protocol (SCEP)", - "authorFullName": "Victor Lyuboslavsky", - "authorGitHubUsername": "getvictor", - "category": "guides", - "publishedOn": "2024-10-30", - "description": "Learn how to help your end users connect to Wi-Fi by adding your SCEP server" - } - }, - { - "url": "/announcements/nvd-api-2.0", - "title": "Nvd API 2.0", - "lastModifiedAt": 1734534699258, - "htmlId": "articles--nvd-api-20--30c8a8e41e", - "sectionRelativeRepoPath": "nvd-api-2.0.md", - "meta": { - "category": "announcements", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-11-28", - "articleTitle": "NVD API 2.0: An important update for Fleet users", - "articleImageUrl": "/images/articles/nvd-api-2.0-1600x900@2x.jpg" - } - }, - { - "url": "/securing/optimizing-government-cybersecurity-strategies", - "title": "Optimizing government cybersecurity strategies", - "lastModifiedAt": 1734534699259, - "htmlId": "articles--optimizing-governmen--45c52b1839", - "sectionRelativeRepoPath": "optimizing-government-cybersecurity-strategies.md", - "meta": { - "category": "security", - "authorFullName": "Keith Barnes", - "authorGitHubUsername": "KAB703", - "publishedOn": "2023-11-14", - "articleTitle": "Optimizing government cybersecurity strategies with Fleet.", - "articleImageUrl": "/images/articles/optimizing-government-cybersecurity-strategies-1600x900@2x.png" - } - }, - { - "url": "/releases/osquery-5.11.0", - "title": "Osquery 5.11.0", - "lastModifiedAt": 1734534699260, - "htmlId": "articles--osquery-5110--2907f78617", - "sectionRelativeRepoPath": "osquery-5.11.0.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2024-02-16", - "articleTitle": "osquery 5.11.0 | VSCode, Apple silicon, and more", - "articleImageUrl": "/images/articles/osquery-5.11.0-cover-1600x900@2x.png" - } - }, - { - "url": "/releases/osquery-5.8.1", - "title": "Osquery 5.8.1", - "lastModifiedAt": 1734534699261, - "htmlId": "articles--osquery-581--835bbfa1b6", - "sectionRelativeRepoPath": "osquery-5.8.1.md", - "meta": { - "category": "releases", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "publishedOn": "2023-03-14", - "articleTitle": "osquery 5.8.1 | Process auditing, stats, and additional tables", - "articleImageUrl": "/images/articles/osquery-5.8.1-cover-1600x900@2x.png" - } - }, - { - "url": "/guides/osquery-a-tool-to-easily-ask-questions-about-operating-systems", - "title": "Osquery a tool to easily ask questions about operating systems", - "lastModifiedAt": 1734534699262, - "htmlId": "articles--osquery-a-tool-to-ea--bd641644df", - "sectionRelativeRepoPath": "osquery-a-tool-to-easily-ask-questions-about-operating-systems.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "dominuskelvin", - "authorFullName": "Kelvin Omereshone", - "publishedOn": "2022-04-04", - "articleTitle": "Osquery: a tool to easily ask questions about operating systems", - "articleImageUrl": "/images/articles/osquery-a-tool-to-easily-ask-questions-about-operating-systems-cover-1600x900@2x.jpg" - } - }, - { - "url": "/securing/osquery-as-a-threat-hunting-platform", - "title": "Osquery as a threat hunting platform", - "lastModifiedAt": 1734534699263, - "htmlId": "articles--osquery-as-a-threat---5c9ebe9358", - "sectionRelativeRepoPath": "osquery-as-a-threat-hunting-platform.md", - "meta": { - "category": "security", - "authorFullName": "Chris McGillicuddy", - "authorGitHubUsername": "chris-mcgillicuddy", - "publishedOn": "2022-09-16", - "articleTitle": "Osquery… as a threat hunting platform?", - "articleImageUrl": "/images/articles/osquery-for-threat-hunting-1600x900@2x.jpg" - } - }, - { - "url": "/guides/osquery-consider-joining-against-the-users-table", - "title": "Osquery consider joining against the users table", - "lastModifiedAt": 1734534699264, - "htmlId": "articles--osquery-consider-joi--601c6b1fc1", - "sectionRelativeRepoPath": "osquery-consider-joining-against-the-users-table.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2021-05-06", - "articleTitle": "Osquery: Consider joining against the users table", - "articleImageUrl": "/images/articles/osquery-consider-joining-against-the-users-table-cover-700x437@2x.jpeg" - } - }, - { - "url": "/guides/osquery-evented-tables-overview", - "title": "Osquery evented tables overview", - "lastModifiedAt": 1734534699266, - "htmlId": "articles--osquery-evented-tabl--84be7887a2", - "sectionRelativeRepoPath": "osquery-evented-tables-overview.md", - "meta": { - "articleTitle": "How to use osquery evented tables", - "authorFullName": "Mo Zhu", - "authorGitHubUsername": "zhumo", - "category": "guides", - "publishedOn": "2022-09-21" - } - }, - { - "url": "/securing/osquery-vulnerability-management-at-scale", - "title": "Osquery vulnerability management at scale", - "lastModifiedAt": 1734534699267, - "htmlId": "articles--osquery-vulnerabilit--d68763c174", - "sectionRelativeRepoPath": "osquery-vulnerability-management-at-scale.md", - "meta": { - "category": "security", - "authorFullName": "Chris McGillicuddy", - "authorGitHubUsername": "chris-mcgillicuddy", - "publishedOn": "2022-10-05", - "articleTitle": "Vulnerability management at scale: a presentation from osquery Co-creator Zach Wasserman", - "articleImageUrl": "/images/articles/vulnerability-management-at-scale-with-osquery_800x450@2x.jpg" - } - }, - { - "url": "/guides/osquery-watchdog", - "title": "Osquery watchdog", - "lastModifiedAt": 1734534699268, - "htmlId": "articles--osquery-watchdog--98379aab2d", - "sectionRelativeRepoPath": "osquery-watchdog.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "juan-fdz-hawa", - "authorFullName": "Juan Fernandes", - "publishedOn": "2023-07-28", - "articleTitle": "Osquery watchdog", - "description": "Learn about how osquery process manages child processes and managed extensions in Fleet." - } - }, - { - "url": "/guides/policy-automation-run-script", - "title": "Policy automation run script", - "lastModifiedAt": 1734534699268, - "htmlId": "articles--policy-automation-ru--358f3723ed", - "sectionRelativeRepoPath": "policy-automation-run-script.md", - "meta": { - "articleTitle": "Automatically run scripts", - "authorFullName": "Ian Littman", - "authorGitHubUsername": "iansltx", - "category": "guides", - "publishedOn": "2024-10-07", - "description": "A guide to workflows using automatic script execution in Fleet." - } - }, - { - "url": "/announcements/psu-macadmins-conference-2023", - "title": "Psu macadmins conference 2023", - "lastModifiedAt": 1734534699269, - "htmlId": "articles--psu-macadmins-confer--72f5252a2d", - "sectionRelativeRepoPath": "psu-macadmins-conference-2023.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "spokanemac", - "authorFullName": "JD Strong", - "publishedOn": "2023-07-13", - "articleTitle": "Mac admins summer camp ⛺ at PSU MacAdmins Conference 2023", - "articleImageUrl": "/images/articles/psu-macadmins-conference-2023@2x.png", - "description": "A look ahead to PSU MacAdmin Conference July 18-21, 2023" - } - }, - { - "url": "/guides/puppet-module", - "title": "Puppet module", - "lastModifiedAt": 1734534699270, - "htmlId": "articles--puppet-module--84eb56d4df", - "sectionRelativeRepoPath": "puppet-module.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-05-24", - "articleTitle": "Puppet module", - "description": "Learn how to use Fleet's Puppet module to automatically assign custom configuration profiles on your macOS hosts." - } - }, - { - "url": "/guides/queries", - "title": "Queries", - "lastModifiedAt": 1734534699271, - "htmlId": "articles--queries--434e34c828", - "sectionRelativeRepoPath": "queries.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-08-09", - "articleTitle": "Queries", - "description": "Learn how to create, run, and schedule queries, as well as update agent options in the Fleet user interface." - } - }, - { - "url": "/guides/querying-process-file-events-table-on-centos-7", - "title": "Querying process file events table on centos 7", - "lastModifiedAt": 1734534699272, - "htmlId": "articles--querying-process-fil--fb83decd51", - "sectionRelativeRepoPath": "querying-process-file-events-table-on-centos-7.md", - "meta": { - "articleTitle": "Querying process_file_events on CentOS 7", - "description": "Learn how to configure and query the process_file_events table on CentOS 7 with Fleet.", - "category": "guides", - "authorGitHubUsername": "lucasmrod", - "authorFullName": "Lucas Rodriguez", - "publishedOn": "2023-07-17" - } - }, - { - "url": "/guides/resolving-a-critical-firefox-vulnerability-using-fleets-new-automation-features", - "title": "Resolving a critical firefox vulnerability using fleets new automation features", - "lastModifiedAt": 1734534699274, - "htmlId": "articles--resolving-a-critical--93a8be83c4", - "sectionRelativeRepoPath": "resolving-a-critical-firefox-vulnerability-using-fleets-new-automation-features.md", - "meta": { - "articleTitle": "Resolving a critical Firefox vulnerability using Fleet's new automation features", - "authorFullName": "Luke Heath", - "authorGitHubUsername": "lukeheath", - "category": "guides", - "publishedOn": "2024-12-04", - "articleImageUrl": "/images/articles/vulnerability-management-advantages-of-fleet-to-support-government-agencies-1600x900@2x.png", - "description": "This guide outlines the process of using Fleet policies to automatically remediate software vulnerabillities." - } - }, - { - "url": "/guides/role-based-access", - "title": "Role based access", - "lastModifiedAt": 1734534699276, - "htmlId": "articles--role-based-access--214b7fa195", - "sectionRelativeRepoPath": "role-based-access.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-10-31", - "articleTitle": "Role-based access", - "description": "Learn about the different roles and permissions in Fleet." - } - }, - { - "url": "/engineering/saving-over-100x-on-egress-switching-from-aws-to-hetzner", - "title": "Saving over 100x on egress switching from aws to hetzner", - "lastModifiedAt": 1734534699277, - "htmlId": "articles--saving-over-100x-on---eaa2acc4f3", - "sectionRelativeRepoPath": "saving-over-100x-on-egress-switching-from-aws-to-hetzner.md", - "meta": { - "category": "engineering", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2022-01-25", - "articleTitle": "Saving over 100x on egress switching from AWS to Hetzner", - "articleImageUrl": "/images/articles/saving-over-100x-on-egress-switching-from-aws-to-hetzner-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/scripts", - "title": "Scripts", - "lastModifiedAt": 1734534699278, - "htmlId": "articles--scripts--5eb8fe34fa", - "sectionRelativeRepoPath": "scripts.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-10-07", - "articleTitle": "Scripts", - "description": "Learn how to execute a custom script on macOS, Windows, and Linux hosts in Fleet." - } - }, - { - "url": "/guides/seamless-mdm-migration", - "title": "Seamless mdm migration", - "lastModifiedAt": 1734534699281, - "htmlId": "articles--seamless-mdm-migrati--1c0acbb5f3", - "sectionRelativeRepoPath": "seamless-mdm-migration.md", - "meta": { - "category": "guides", - "authorFullName": "Zach Wasserman", - "authorGitHubUsername": "zwass", - "publishedOn": "2024-08-08", - "articleTitle": "Seamless MDM migrations to Fleet", - "articleImageUrl": "/images/articles/seamless-mdm-migration-1600x900@2x.png", - "description": "This guide provides a process for seamlessly migrating macOS devices from an existing MDM solution to Fleet." - } - }, - { - "url": "/announcements/seattle-bellevue-cyber-security-summit-march-8-2023", - "title": "Seattle bellevue cyber security summit march 8 2023", - "lastModifiedAt": 1734534699282, - "htmlId": "articles--seattle-bellevue-cyb--412da6d2bc", - "sectionRelativeRepoPath": "seattle-bellevue-cyber-security-summit-march-8-2023.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "spokanemac", - "authorFullName": "JD Strong", - "publishedOn": "2023-03-02", - "articleTitle": "Join Fleet at Cyber Security Summit Seattle/Bellevue", - "articleImageUrl": "/images/articles/seattle-bellevue-cyber-security-summit-social-post-1200x628@2x.png" - } - }, - { - "url": "/securing/security-testing-at-fleet-fleet-pentest", - "title": "Security testing at Fleet Fleet pentest", - "lastModifiedAt": 1734534699284, - "htmlId": "articles--security-testing-at---930f51ff1d", - "sectionRelativeRepoPath": "security-testing-at-fleet-fleet-pentest.md", - "meta": { - "category": "security", - "authorGitHubUsername": "GuillaumeRoss", - "authorFullName": "Guillaume Ross", - "publishedOn": "2022-05-10", - "articleTitle": "Penetration testing of Fleet (April 2022)", - "articleImageUrl": "/images/articles/security-testing-at-fleet-fleet-pentest-cover-1600x900@2x.jpg" - } - }, - { - "url": "/securing/security-testing-at-fleet-orbit-auto-updater-audit", - "title": "Security testing at Fleet orbit auto updater audit", - "lastModifiedAt": 1734534699285, - "htmlId": "articles--security-testing-at---3c01c231c3", - "sectionRelativeRepoPath": "security-testing-at-fleet-orbit-auto-updater-audit.md", - "meta": { - "category": "security", - "authorGitHubUsername": "GuillaumeRoss", - "authorFullName": "Guillaume Ross", - "publishedOn": "2022-03-30", - "articleTitle": "Security testing at Fleet/Orbit auto-updater audit", - "articleImageUrl": "/images/articles/security-testing-at-fleet-orbit-auto-updater-audit-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/software-self-service", - "title": "Software self service", - "lastModifiedAt": 1734534699286, - "htmlId": "articles--software-self-servic--687f8ad0ba", - "sectionRelativeRepoPath": "software-self-service.md", - "meta": { - "articleTitle": "Software self-service", - "authorFullName": "Jahziel Villasana-Espinoza", - "authorGitHubUsername": "jahzielv", - "category": "guides", - "publishedOn": "2024-08-06", - "articleImageUrl": "/images/articles/software-self-service-1600x900@2x.png", - "description": "This guide will walk you through adding apps to Fleet for user self-service." - } - }, - { - "url": "/guides/standard-query-library", - "title": "Standard query library", - "lastModifiedAt": 1734534699287, - "htmlId": "articles--standard-query-libra--5e6c1f7c33", - "sectionRelativeRepoPath": "standard-query-library.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-04-04", - "articleTitle": "Standard query library", - "description": "Learn how to use and contribute to Fleet's standard query library." - } - }, - { - "url": "/report/state-of-device-management", - "title": "State of device management", - "lastModifiedAt": 1734534699287, - "htmlId": "articles--state-of-device-mana--6cee389e23", - "sectionRelativeRepoPath": "state-of-device-management.md", - "meta": { - "category": "report", - "authorFullName": "Mike McNeil", - "authorGitHubUsername": "mikermcneil", - "publishedOn": "2022-07-07", - "articleTitle": "State of Device Management report 2022", - "articleImageUrl": "/images/articles/state-of-device-management-report-1600x900@2x.png" - } - }, - { - "url": "/securing/stay-on-course-with-your-security-compliance-goals", - "title": "Stay on course with your security compliance goals", - "lastModifiedAt": 1734534699288, - "htmlId": "articles--stay-on-course-with---af690679b4", - "sectionRelativeRepoPath": "stay-on-course-with-your-security-compliance-goals.md", - "meta": { - "category": "security", - "authorFullName": "Chris McGillicuddy", - "authorGitHubUsername": "chris-mcgillicuddy", - "publishedOn": "2022-07-18", - "articleTitle": "Stay on course with your security compliance goals", - "articleImageUrl": "/images/articles/security-compliance-goals-cover-800x450@2x.jpg" - } - }, - { - "url": "/guides/sysadmin-diaries-device-enrollment", - "title": "Sysadmin diaries device enrollment", - "lastModifiedAt": 1734534699289, - "htmlId": "articles--sysadmin-diaries-dev--5d20ddd4a7", - "sectionRelativeRepoPath": "sysadmin-diaries-device-enrollment.md", - "meta": { - "articleTitle": "Sysadmin diaries: device enrollment", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "category": "guides", - "publishedOn": "2024-05-03", - "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", - "description": "In this sysadmin diary, we explore a the differences in device enrollment." - } - }, - { - "url": "/guides/sysadmin-diaries-exporting-policies", - "title": "Sysadmin diaries exporting policies", - "lastModifiedAt": 1734534699290, - "htmlId": "articles--sysadmin-diaries-exp--f9c46f65fc", - "sectionRelativeRepoPath": "sysadmin-diaries-exporting-policies.md", - "meta": { - "articleTitle": "Sysadmin diaries: exporting policies", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "category": "guides", - "publishedOn": "2024-06-28", - "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", - "description": "In this sysadmin diary, we explore extracting existing policies to enable gitops." - } - }, - { - "url": "/guides/sysadmin-diaries-gitops-a-strategic-advantage", - "title": "Sysadmin diaries gitops a strategic advantage", - "lastModifiedAt": 1734534699291, - "htmlId": "articles--sysadmin-diaries-git--aafc1c530a", - "sectionRelativeRepoPath": "sysadmin-diaries-gitops-a-strategic-advantage.md", - "meta": { - "articleTitle": "GitOps: A strategic advantage for automation, collaboration, and cost savings", - "authorFullName": "Allen Houchins", - "authorGitHubUsername": "allenhouchins", - "category": "guides", - "publishedOn": "2024-09-27", - "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", - "description": "This diary entry explores why GitOps will save time, money and effort." - } - }, - { - "url": "/guides/sysadmin-diaries-passcode-profiles", - "title": "Sysadmin diaries passcode profiles", - "lastModifiedAt": 1734534699292, - "htmlId": "articles--sysadmin-diaries-pas--ad866cee62", - "sectionRelativeRepoPath": "sysadmin-diaries-passcode-profiles.md", - "meta": { - "articleTitle": "Sysadmin diaries: passcode profiles", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "category": "guides", - "publishedOn": "2024-04-01", - "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", - "description": "In this sysadmin diary, we explore a missapplied passcode policy." - } - }, - { - "url": "/guides/sysadmin-diaries-restoring-fleetd", - "title": "Sysadmin diaries restoring fleetd", - "lastModifiedAt": 1734534699293, - "htmlId": "articles--sysadmin-diaries-res--e1b7e5b22c", - "sectionRelativeRepoPath": "sysadmin-diaries-restoring-fleetd.md", - "meta": { - "articleTitle": "Sysadmin diaries: restoring fleetd", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "category": "guides", - "publishedOn": "2024-06-14", - "articleImageUrl": "/images/articles/sysadmin-diaries-1600x900@2x.png", - "description": "In this sysadmin diary, we explore restoring fleetd deleted by a surly employee." - } - }, - { - "url": "/securing/tales-from-fleet-security-google-groups-scams", - "title": "Tales from Fleet security google groups scams", - "lastModifiedAt": 1734534699294, - "htmlId": "articles--tales-from-fleet-sec--9b8848d72f", - "sectionRelativeRepoPath": "tales-from-fleet-security-google-groups-scams.md", - "meta": { - "category": "security", - "authorFullName": "Guillaume Ross", - "authorGitHubUsername": "GuillaumeRoss", - "publishedOn": "2022-08-05", - "articleTitle": "Tales from Fleet security: scams targeting Google Groups", - "articleImageUrl": "/images/articles/tales-from-fleet-security-google-groups-scams-cover-1600x900@2x.jpg" - } - }, - { - "url": "/securing/tales-from-fleet-security-github-configuration-and-openssf-scorecards", - "title": "Tales from Fleet security github configuration and openssf scorecards", - "lastModifiedAt": 1734534699295, - "htmlId": "articles--tales-from-fleet-sec--cea5e29dc6", - "sectionRelativeRepoPath": "tales-from-fleet-security-github-configuration-and-openssf-scorecards.md", - "meta": { - "category": "security", - "authorFullName": "Guillaume Ross", - "authorGitHubUsername": "GuillaumeRoss", - "publishedOn": "2022-04-15", - "articleTitle": "Tales from Fleet security: GitHub configuration and OpenSSF Scorecards", - "articleImageUrl": "/images/articles/tales-from-fleet-security-github-configuration-and-openssf-scorecards-cover-1600x900@2x.jpg" - } - }, - { - "url": "/securing/tales-from-fleet-security-securing-1password", - "title": "Tales from Fleet security securing 1password", - "lastModifiedAt": 1734534699296, - "htmlId": "articles--tales-from-fleet-sec--7c53a1854f", - "sectionRelativeRepoPath": "tales-from-fleet-security-securing-1password.md", - "meta": { - "category": "security", - "authorFullName": "Guillaume Ross", - "authorGitHubUsername": "GuillaumeRoss", - "publishedOn": "2022-05-06", - "articleTitle": "Tales from Fleet security: securing 1Password", - "articleImageUrl": "/images/articles/tales-from-fleet-security-securing-1password-cover-1600x900@2x.jpg" - } - }, - { - "url": "/securing/tales-from-fleet-security-securing-bank-accounts-from-business-email-compromise", - "title": "Tales from Fleet security securing bank accounts from business email compromise", - "lastModifiedAt": 1734534699298, - "htmlId": "articles--tales-from-fleet-sec--3934315928", - "sectionRelativeRepoPath": "tales-from-fleet-security-securing-bank-accounts-from-business-email-compromise.md", - "meta": { - "category": "security", - "authorFullName": "Guillaume Ross", - "authorGitHubUsername": "GuillaumeRoss", - "publishedOn": "2022-07-15", - "articleTitle": "Tales from Fleet security: securing bank accounts from business email compromise", - "articleImageUrl": "/images/articles/securing-bank-accounts-from-business-email-compromise-1600x900@2x.jpg" - } - }, - { - "url": "/securing/tales-from-fleet-security-securing-google-workspace", - "title": "Tales from Fleet security securing google workspace", - "lastModifiedAt": 1734534699299, - "htmlId": "articles--tales-from-fleet-sec--248e6e273e", - "sectionRelativeRepoPath": "tales-from-fleet-security-securing-google-workspace.md", - "meta": { - "category": "security", - "authorFullName": "Guillaume Ross", - "authorGitHubUsername": "GuillaumeRoss", - "publishedOn": "2022-03-25", - "articleTitle": "Tales from Fleet security: securing Google Workspace", - "articleImageUrl": "/images/articles/tales-from-fleet-security-securing-google-workspace-cover-1600x900@2x.jpg" - } - }, - { - "url": "/securing/tales-from-fleet-security-securing-the-startup", - "title": "Tales from Fleet security securing the startup", - "lastModifiedAt": 1734534699300, - "htmlId": "articles--tales-from-fleet-sec--d1bfda077f", - "sectionRelativeRepoPath": "tales-from-fleet-security-securing-the-startup.md", - "meta": { - "category": "security", - "authorFullName": "Guillaume Ross", - "authorGitHubUsername": "GuillaumeRoss", - "publishedOn": "2022-03-17", - "articleTitle": "Tales from Fleet security: securing the startup", - "articleImageUrl": "/images/articles/tales-from-fleet-security-securing-the-startup-cover-1600x900@2x.jpg" - } - }, - { - "url": "/securing/tales-from-fleet-security-soc2", - "title": "Tales from Fleet security soc2", - "lastModifiedAt": 1734534699301, - "htmlId": "articles--tales-from-fleet-sec--9f5fe9c66a", - "sectionRelativeRepoPath": "tales-from-fleet-security-soc2.md", - "meta": { - "category": "security", - "authorGitHubUsername": "GuillaumeRoss", - "authorFullName": "Guillaume Ross", - "publishedOn": "2022-06-24", - "articleTitle": "Tales from Fleet security: how we achieved our SOC 2 type 1 rapidly", - "articleImageUrl": "/images/articles/tales-from-fleet-soc2-type1-report-cover-1600x900@2x.jpg" - } - }, - { - "url": "/securing/tales-from-fleet-security-speeding-up-macos-updates-with-nudge", - "title": "Tales from Fleet security speeding up macos updates with nudge", - "lastModifiedAt": 1734534699302, - "htmlId": "articles--tales-from-fleet-sec--940df70258", - "sectionRelativeRepoPath": "tales-from-fleet-security-speeding-up-macos-updates-with-nudge.md", - "meta": { - "category": "security", - "authorFullName": "Guillaume Ross", - "authorGitHubUsername": "GuillaumeRoss", - "publishedOn": "2022-07-05", - "articleTitle": "Tales from Fleet security: speeding up macOS updates with Nudge", - "articleImageUrl": "/images/articles/tales-from-fleet-nudge-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/teams", - "title": "Teams", - "lastModifiedAt": 1734534699303, - "htmlId": "articles--teams--e2733c8673", - "sectionRelativeRepoPath": "teams.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-07-11", - "articleTitle": "Teams", - "description": "Learn how to group hosts in Fleet to apply specific queries, policies, and agent options using teams." - } - }, - { - "url": "/announcements/the-device-security-tightrope-balancing-cost-and-protection-in-k-12-schools", - "title": "The device security tightrope balancing cost and protection in k 12 schools", - "lastModifiedAt": 1734534699304, - "htmlId": "articles--the-device-security---582e5b6447", - "sectionRelativeRepoPath": "the-device-security-tightrope-balancing-cost-and-protection-in-K-12-schools.md", - "meta": { - "category": "announcements", - "authorFullName": "Keith Barnes", - "authorGitHubUsername": "KAB703", - "publishedOn": "2024-03-01", - "articleTitle": "The device security tightrope: balancing cost and protection in K-12 schools", - "articleImageUrl": "/images/articles/the-device-security-tightrope-balancing-cost-and-protection-in-K-12-schools-1600x900@2x.png" - } - }, - { - "url": "/podcasts/the-future-of-device-management-ep1", - "title": "The future of device management ep1", - "lastModifiedAt": 1734534699305, - "htmlId": "articles--the-future-of-device--01a0d40000", - "sectionRelativeRepoPath": "the-future-of-device-management-ep1.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2022-06-06", - "articleTitle": "Future of device management episode 1", - "articleImageUrl": "/images/articles/future-of-device-management-ep1-cover-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/the-future-of-device-management-ep2", - "title": "The future of device management ep2", - "lastModifiedAt": 1734534699306, - "htmlId": "articles--the-future-of-device--1e93b8170c", - "sectionRelativeRepoPath": "the-future-of-device-management-ep2.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2022-06-30", - "articleTitle": "Future of device management episode 2", - "articleImageUrl": "/images/articles/future-of-device-management-ep2-cover-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/the-future-of-device-management-ep3", - "title": "The future of device management ep3", - "lastModifiedAt": 1734534699306, - "htmlId": "articles--the-future-of-device--19ed07e849", - "sectionRelativeRepoPath": "the-future-of-device-management-ep3.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2022-07-21", - "articleTitle": "Future of device management episode 3", - "articleImageUrl": "/images/articles/future-of-device-management-ep3-cover-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/the-future-of-device-management-ep4", - "title": "The future of device management ep4", - "lastModifiedAt": 1734534699307, - "htmlId": "articles--the-future-of-device--ff8f5f6da2", - "sectionRelativeRepoPath": "the-future-of-device-management-ep4.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2022-08-12", - "articleTitle": "Future of device management episode 4", - "articleImageUrl": "/images/articles/future-of-device-management-ep4-cover-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/the-future-of-device-management-ep5", - "title": "The future of device management ep5", - "lastModifiedAt": 1734534699308, - "htmlId": "articles--the-future-of-device--cc68742b47", - "sectionRelativeRepoPath": "the-future-of-device-management-ep5.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2022-09-01", - "articleTitle": "Future of device management episode 5", - "articleImageUrl": "/images/articles/future-of-device-management-ep5-cover-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/the-future-of-device-management-ep6", - "title": "The future of device management ep6", - "lastModifiedAt": 1734534699309, - "htmlId": "articles--the-future-of-device--ed513fe175", - "sectionRelativeRepoPath": "the-future-of-device-management-ep6.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2022-09-23", - "articleTitle": "Future of device management episode 6", - "articleImageUrl": "/images/articles/future-of-device-management-ep6-cover-1600x900@2x.jpg" - } - }, - { - "url": "/podcasts/the-future-of-device-management-ep7", - "title": "The future of device management ep7", - "lastModifiedAt": 1734534699309, - "htmlId": "articles--the-future-of-device--bad91f26f5", - "sectionRelativeRepoPath": "the-future-of-device-management-ep7.md", - "meta": { - "category": "podcasts", - "authorGitHubUsername": "zwass", - "authorFullName": "Zach Wasserman", - "publishedOn": "2022-11-03", - "articleTitle": "Future of device management episode 7", - "articleImageUrl": "/images/articles/future-of-device-management-ep7-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/understanding-the-intricacies-of-fleet-policies", - "title": "Understanding the intricacies of Fleet policies", - "lastModifiedAt": 1734534699310, - "htmlId": "articles--understanding-the-in--1a9195f886", - "sectionRelativeRepoPath": "understanding-the-intricacies-of-fleet-policies.md", - "meta": { - "articleTitle": "Understanding the intricacies of Fleet policies", - "authorFullName": "Victor Lyuboslavsky", - "authorGitHubUsername": "getvictor", - "category": "guides", - "publishedOn": "2023-12-29", - "description": "Learn how Fleet policies work behind the scenes." - } - }, - { - "url": "/guides/using-elasticsearch-and-kibana-to-visualize-osquery-performance", - "title": "Using elasticsearch and kibana to visualize osquery performance", - "lastModifiedAt": 1734534699312, - "htmlId": "articles--using-elasticsearch---bd56725806", - "sectionRelativeRepoPath": "using-elasticsearch-and-kibana-to-visualize-osquery-performance.md", - "meta": { - "category": "guides", - "authorFullName": "Zach Wasserman", - "authorGitHubUsername": "zwass", - "publishedOn": "2021-05-26", - "articleTitle": "Using Elasticsearch and Kibana to visualize osquery performance", - "articleImageUrl": "/images/articles/using-elasticsearch-and-kibana-to-visualize-osquery-performance-cover-700x393@2x.jpeg" - } - }, - { - "url": "/guides/using-fleet-and-okta-workflows-to-generate-a-daily-os-report", - "title": "Using Fleet and okta workflows to generate a daily os report", - "lastModifiedAt": 1734534699314, - "htmlId": "articles--using-fleet-and-okta--8c58926ea7", - "sectionRelativeRepoPath": "using-fleet-and-okta-workflows-to-generate-a-daily-os-report.md", - "meta": { - "articleTitle": "Using Fleet and Okta Workflows to generate a daily OS report", - "authorFullName": "Harrison Ravazzolo", - "authorGitHubUsername": "harrisonravazzolo", - "category": "guides", - "publishedOn": "2023-05-09", - "articleImageUrl": "/images/articles/using-fleet-and-okta-workflows-to-generate-a-daily-os-report@2x.jpg", - "description": "Learn how to use Fleet to query device OS information through the Fleet REST API and automate daily Slack notifications using Okta Workflows." - } - }, - { - "url": "/guides/using-fleet-and-tines-together", - "title": "Using Fleet and tines together", - "lastModifiedAt": 1734534699315, - "htmlId": "articles--using-fleet-and-tine--b9eb6330ab", - "sectionRelativeRepoPath": "using-fleet-and-tines-together.md", - "meta": { - "category": "guides", - "authorFullName": "Dave Herder", - "authorGitHubUsername": "dherder", - "publishedOn": "2023-03-08", - "articleTitle": "Using Fleet and Tines together", - "articleImageUrl": "/images/articles/using-fleet-and-tines-together-1600x900@2x.png" - } - }, - { - "url": "/guides/using-github-actions-to-apply-configuration-profiles-with-fleet", - "title": "Using github actions to apply configuration profiles with Fleet", - "lastModifiedAt": 1734534699316, - "htmlId": "articles--using-github-actions--d7eb24949f", - "sectionRelativeRepoPath": "using-github-actions-to-apply-configuration-profiles-with-fleet.md", - "meta": { - "articleTitle": "Using GitHub Actions to apply configuration profiles with Fleet", - "authorFullName": "JD Strong", - "authorGitHubUsername": "spokanemac", - "category": "guides", - "publishedOn": "2023-05-31", - "articleImageUrl": "/images/articles/using-github-actions-to-apply-configuration-profiles-with-fleet@2x.jpg", - "description": "A guide on using GitHub Actions with Fleet for efficient and automated application of the latest configuration profiles for a GitOps workflow." - } - }, - { - "url": "/announcements/vehicle-manufacturer-transitions-to-fleet-for-endpoint-security", - "title": "Vehicle manufacturer transitions to Fleet for endpoint security", - "lastModifiedAt": 1734534699318, - "htmlId": "articles--vehicle-manufacturer--1ee8fe6b7e", - "sectionRelativeRepoPath": "vehicle-manufacturer-transitions-to-fleet-for-endpoint-security.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "Drew-P-drawers", - "authorFullName": "Andrew Baker", - "publishedOn": "2024-12-12", - "articleTitle": "Vehicle manufacturer transitions to Fleet for endpoint security", - "description": "Vehicle manufacturer transitions to Fleet for endpoint security" - } - }, - { - "url": "/securing/vulnerability-management-the-advantages-of-fleet-to-support-government-agencies", - "title": "Vulnerability management the advantages of Fleet to support government agencies", - "lastModifiedAt": 1734534699319, - "htmlId": "articles--vulnerability-manage--089ffd6fe2", - "sectionRelativeRepoPath": "vulnerability-management-the-advantages-of-fleet-to-support-government-agencies.md", - "meta": { - "category": "security", - "authorFullName": "Keith Barnes", - "authorGitHubUsername": "KAB703", - "publishedOn": "2023-12-26", - "articleTitle": "Vulnerability management: advantages of Fleet to support government agencies", - "articleImageUrl": "/images/articles/vulnerability-management-advantages-of-fleet-to-support-government-agencies-1600x900@2x.png" - } - }, - { - "url": "/guides/vulnerability-processing", - "title": "Vulnerability processing", - "lastModifiedAt": 1734534699320, - "htmlId": "articles--vulnerability-proces--6ad60d991f", - "sectionRelativeRepoPath": "vulnerability-processing.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "noahtalerman", - "authorFullName": "Noah Talerman", - "publishedOn": "2024-07-12", - "articleTitle": "Vulnerability processing", - "description": "Find out how Fleet detects vulnerabilities and what software it covers." - } - }, - { - "url": "/guides/what-api-endpoints-to-expose-to-the-public-internet", - "title": "What API endpoints to expose to the public internet", - "lastModifiedAt": 1734534699321, - "htmlId": "articles--what-api-endpoints-t--d331baccba", - "sectionRelativeRepoPath": "what-api-endpoints-to-expose-to-the-public-internet.md", - "meta": { - "category": "guides", - "authorGitHubUsername": "mike-j-thomas", - "authorFullName": "Mike Thomas", - "publishedOn": "2023-11-13", - "articleTitle": "Which API endpoints to expose to the public internet?" - } - }, - { - "url": "/securing/what-are-fleet-policies", - "title": "What are Fleet policies", - "lastModifiedAt": 1734534699322, - "htmlId": "articles--what-are-fleet-polic--5be3fb9039", - "sectionRelativeRepoPath": "what-are-fleet-policies.md", - "meta": { - "category": "security", - "authorGitHubUsername": "Drew-P-drawers", - "authorFullName": "Andrew Baker", - "publishedOn": "2022-05-20", - "articleTitle": "What are Fleet policies?", - "articleImageUrl": "/images/articles/what-are-fleet-policies-cover-1600x900@2x.jpg" - } - }, - { - "url": "/guides/windows-mdm-setup", - "title": "Windows mdm setup", - "lastModifiedAt": 1734534699324, - "htmlId": "articles--windows-mdm-setup--c79ef4765d", - "sectionRelativeRepoPath": "windows-mdm-setup.md", - "meta": { - "articleTitle": "Windows MDM setup", - "authorFullName": "Noah Talerman", - "authorGitHubUsername": "noahtalerman", - "category": "guides", - "publishedOn": "2023-10-23", - "articleImageUrl": "/images/articles/windows-mdm-fleet-1600x900@2x.png", - "description": "Configuring Windows MDM in Fleet." - } - }, - { - "url": "/securing/work-may-be-watching-but-it-might-not-be-as-bad-as-you-think", - "title": "Work may be watching but it might not be as bad as you think", - "lastModifiedAt": 1734534699325, - "htmlId": "articles--work-may-be-watching--6c555b7789", - "sectionRelativeRepoPath": "work-may-be-watching-but-it-might-not-be-as-bad-as-you-think.md", - "meta": { - "category": "security", - "authorFullName": "Mike Thomas", - "authorGitHubUsername": "mike-j-thomas", - "publishedOn": "2021-10-22", - "articleTitle": "Work may be watching, but it might not be as bad as you think.", - "articleImageUrl": "/images/articles/work-may-be-watching-but-it-might-not-be-as-bad-as-you-think-cover-1600x900@2x.jpg" - } - }, - { - "url": "/announcements/worldwide-security-and-authentication-platform-chooses-fleet-for-linux", - "title": "Worldwide security and authentication platform chooses Fleet for linux", - "lastModifiedAt": 1734534699326, - "htmlId": "articles--worldwide-security-a--a82ed8b41a", - "sectionRelativeRepoPath": "worldwide-security-and-authentication-platform-chooses-fleet-for-linux.md", - "meta": { - "category": "announcements", - "authorGitHubUsername": "Drew-P-drawers", - "authorFullName": "Andrew Baker", - "publishedOn": "2024-12-10", - "articleTitle": "Worldwide security and authentication platform chooses Fleet for Linux management", - "description": "Worldwide security and authentication platform switches to Fleet for Linux device management" - } - }, - { - "url": "/guides/zero-trust-attestation-with-fleet", - "title": "Zero trust attestation with Fleet", - "lastModifiedAt": 1734534699327, - "htmlId": "articles--zero-trust-attestati--bfff868640", - "sectionRelativeRepoPath": "zero-trust-attestation-with-fleet.md", - "meta": { - "articleTitle": "How to use Fleet for zero trust attestation", - "authorFullName": "Mo Zhu", - "authorGitHubUsername": "zhumo", - "category": "guides", - "publishedOn": "2022-10-14", - "articleImageUrl": "/images/articles/fleet-for-zero-trust-attestation-800x450@2x.jpg" - } - }, - { - "url": "/handbook/company/open-positions/software-engineer", - "title": "🚀 Software Engineer", - "lastModifiedAt": 1734534699327, - "htmlId": "handbook--software-engineer--acca3f0c38", - "sectionRelativeRepoPath": "company/open-positions.yml", - "meta": { - "maintainedBy": "LukeHeath" - } - }, - { - "url": "/tables/account_policy_data", - "title": "account_policy_data", - "htmlId": "table--accountpolicydata--a6cb3ebfbd", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "account_policy_data", - "creation_time", - "failed_login_count", - "failed_login_timestamp", - "password_last_set_time", - "uid" - ], - "sectionRelativeRepoPath": "account_policy_data", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/account_policy_data.yml" - }, - { - "url": "/tables/ad_config", - "title": "ad_config", - "htmlId": "table--adconfig--476c3b5c1d", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "ad_config", - "domain", - "name", - "option", - "value" - ], - "sectionRelativeRepoPath": "ad_config", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ad_config.yml" - }, - { - "url": "/tables/alf", - "title": "alf", - "htmlId": "table--alf--1bf234c5b7", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "alf", - "allow_signed_enabled", - "firewall_unload", - "global_state", - "logging_enabled", - "logging_option", - "stealth_enabled", - "version" - ], - "sectionRelativeRepoPath": "alf", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf.yml" - }, - { - "url": "/tables/alf_exceptions", - "title": "alf_exceptions", - "htmlId": "table--alfexceptions--6aabd269bf", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "alf_exceptions", - "path", - "state" - ], - "sectionRelativeRepoPath": "alf_exceptions", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf_exceptions.yml" - }, - { - "url": "/tables/alf_explicit_auths", - "title": "alf_explicit_auths", - "htmlId": "table--alfexplicitauths--74cc921abc", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "alf_explicit_auths", - "process" - ], - "sectionRelativeRepoPath": "alf_explicit_auths", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/alf_explicit_auths.yml" - }, - { - "url": "/tables/apfs_physical_stores", - "title": "apfs_physical_stores", - "htmlId": "table--apfsphysicalstores--de1144e8a4", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "apfs_physical_stores", - "container_capacity_ceiling", - "container_capacity_free", - "container_designated_physical_store", - "container_fusion", - "container_reference", - "container_uuid", - "identifier", - "size", - "uuid" - ], - "sectionRelativeRepoPath": "apfs_physical_stores", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_physical_stores.yml" - }, - { - "url": "/tables/apfs_volumes", - "title": "apfs_volumes", - "htmlId": "table--apfsvolumes--113c163a66", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "apfs_volumes", - "capacity_in_use", - "capacity_quota", - "capacity_reserve", - "container_capacity_ceiling", - "container_capacity_free", - "container_designated_physical_store", - "container_fusion", - "container_reference", - "container_uuid", - "crypto_migration_on", - "device_identifier", - "encryption", - "filevault", - "locked", - "name", - "role", - "uuid" - ], - "sectionRelativeRepoPath": "apfs_volumes", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apfs_volumes.yml" - }, - { - "url": "/tables/app_icons", - "title": "app_icons", - "htmlId": "table--appicons--1f2e0f14e8", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "app_icons", - "hash", - "icon", - "path" - ], - "sectionRelativeRepoPath": "app_icons", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/app_icons.yml" - }, - { - "url": "/tables/app_schemes", - "title": "app_schemes", - "htmlId": "table--appschemes--5c76313b4c", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "app_schemes", - "enabled", - "external", - "handler", - "protected", - "scheme" - ], - "sectionRelativeRepoPath": "app_schemes", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/app_schemes.yml" - }, - { - "url": "/tables/apparmor_events", - "title": "apparmor_events", - "htmlId": "table--apparmorevents--92ccac98cc", - "evented": true, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "apparmor_events", - "apparmor", - "capability", - "capname", - "comm", - "denied_mask", - "eid", - "error", - "fsuid", - "info", - "label", - "message", - "name", - "namespace", - "operation", - "ouid", - "parent", - "pid", - "profile", - "requested_mask", - "time", - "type", - "uptime" - ], - "sectionRelativeRepoPath": "apparmor_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fapparmor_events.yml&value=name%3A%20apparmor_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/apparmor_profiles", - "title": "apparmor_profiles", - "htmlId": "table--apparmorprofiles--b2f6964e9a", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "apparmor_profiles", - "attach", - "mode", - "name", - "path", - "sha1" - ], - "sectionRelativeRepoPath": "apparmor_profiles", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fapparmor_profiles.yml&value=name%3A%20apparmor_profiles%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/appcompat_shims", - "title": "appcompat_shims", - "htmlId": "table--appcompatshims--81c1fcea9f", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "appcompat_shims", - "description", - "executable", - "install_time", - "path", - "sdb_id", - "type" - ], - "sectionRelativeRepoPath": "appcompat_shims", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fappcompat_shims.yml&value=name%3A%20appcompat_shims%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/apps", - "title": "apps", - "htmlId": "table--apps--8dce5de4cb", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "apps", - "applescript_enabled", - "bundle_executable", - "bundle_identifier", - "bundle_name", - "bundle_package_type", - "bundle_short_version", - "bundle_version", - "category", - "compiler", - "copyright", - "development_region", - "display_name", - "element", - "environment", - "info_string", - "last_opened_time", - "minimum_system_version", - "name", - "path" - ], - "sectionRelativeRepoPath": "apps", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apps.yml" - }, - { - "url": "/tables/apt_sources", - "title": "apt_sources", - "htmlId": "table--aptsources--fb80ea21a7", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "apt_sources", - "architectures", - "base_uri", - "components", - "maintainer", - "name", - "pid_with_namespace", - "release", - "source", - "version" - ], - "sectionRelativeRepoPath": "apt_sources", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/apt_sources.yml" - }, - { - "url": "/tables/arp_cache", - "title": "arp_cache", - "htmlId": "table--arpcache--89b3b20025", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "arp_cache", - "address", - "interface", - "mac", - "permanent" - ], - "sectionRelativeRepoPath": "arp_cache", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/arp_cache.yml" - }, - { - "url": "/tables/asl", - "title": "asl", - "htmlId": "table--asl--99886b336f", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "asl", - "extra", - "facility", - "gid", - "host", - "level", - "message", - "pid", - "ref_pid", - "ref_proc", - "sender", - "time", - "time_nano_sec", - "uid" - ], - "sectionRelativeRepoPath": "asl", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/asl.yml" - }, - { - "url": "/tables/augeas", - "title": "augeas", - "htmlId": "table--augeas--e79531b6fd", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "augeas", - "label", - "node", - "path", - "value" - ], - "sectionRelativeRepoPath": "augeas", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/augeas.yml" - }, - { - "url": "/tables/authdb", - "title": "authdb", - "htmlId": "table--authdb--7e3d3e49b9", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "authdb", - "json_result", - "right_name" - ], - "sectionRelativeRepoPath": "authdb", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authdb.yml" - }, - { - "url": "/tables/authenticode", - "title": "authenticode", - "htmlId": "table--authenticode--1265714bb6", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "authenticode", - "issuer_name", - "original_program_name", - "path", - "result", - "serial_number", - "subject_name" - ], - "sectionRelativeRepoPath": "authenticode", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fauthenticode.yml&value=name%3A%20authenticode%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/authorization_mechanisms", - "title": "authorization_mechanisms", - "htmlId": "table--authorizationmechanisms--0fb5864d8d", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "authorization_mechanisms", - "entry", - "label", - "mechanism", - "plugin", - "privileged" - ], - "sectionRelativeRepoPath": "authorization_mechanisms", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorization_mechanisms.yml" - }, - { - "url": "/tables/authorizations", - "title": "authorizations", - "htmlId": "table--authorizations--bad53d08da", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "authorizations", - "allow_root", - "authenticate_user", - "class", - "comment", - "created", - "label", - "modified", - "session_owner", - "shared", - "timeout", - "tries", - "version" - ], - "sectionRelativeRepoPath": "authorizations", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorizations.yml" - }, - { - "url": "/tables/authorized_keys", - "title": "authorized_keys", - "htmlId": "table--authorizedkeys--74557c32ec", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "authorized_keys", - "algorithm", - "comment", - "key", - "key_file", - "options", - "pid_with_namespace", - "uid" - ], - "sectionRelativeRepoPath": "authorized_keys", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/authorized_keys.yml" - }, - { - "url": "/tables/autoexec", - "title": "autoexec", - "htmlId": "table--autoexec--a26aad7a1a", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "autoexec", - "name", - "path", - "source" - ], - "sectionRelativeRepoPath": "autoexec", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fautoexec.yml&value=name%3A%20autoexec%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/azure_instance_metadata", - "title": "azure_instance_metadata", - "htmlId": "table--azureinstancemetadata--b5b904136c", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "azure_instance_metadata", - "location", - "name", - "offer", - "os_type", - "placement_group_id", - "platform_fault_domain", - "platform_update_domain", - "publisher", - "resource_group_name", - "sku", - "subscription_id", - "version", - "vm_id", - "vm_scale_set_name", - "vm_size", - "zone" - ], - "sectionRelativeRepoPath": "azure_instance_metadata", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/azure_instance_metadata.yml" - }, - { - "url": "/tables/azure_instance_tags", - "title": "azure_instance_tags", - "htmlId": "table--azureinstancetags--bd992a5351", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "azure_instance_tags", - "key", - "value", - "vm_id" - ], - "sectionRelativeRepoPath": "azure_instance_tags", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/azure_instance_tags.yml" - }, - { - "url": "/tables/background_activities_moderator", - "title": "background_activities_moderator", - "htmlId": "table--backgroundactivitiesmoderator--173703ea94", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "background_activities_moderator", - "last_execution_time", - "path", - "sid" - ], - "sectionRelativeRepoPath": "background_activities_moderator", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fbackground_activities_moderator.yml&value=name%3A%20background_activities_moderator%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/battery", - "title": "battery", - "htmlId": "table--battery--013882e970", - "evented": false, - "platforms": [ - "darwin", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "battery", - "amperage", - "charged", - "charging", - "chemistry", - "condition", - "current_capacity", - "cycle_count", - "designed_capacity", - "health", - "manufacture_date", - "manufacturer", - "max_capacity", - "minutes_to_full_charge", - "minutes_until_empty", - "model", - "percent_remaining", - "serial_number", - "state", - "voltage" - ], - "sectionRelativeRepoPath": "battery", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/battery.yml" - }, - { - "url": "/tables/bitlocker_info", - "title": "bitlocker_info", - "htmlId": "table--bitlockerinfo--ec4cf83c63", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "bitlocker_info", - "conversion_status", - "device_id", - "drive_letter", - "encryption_method", - "lock_status", - "percentage_encrypted", - "persistent_volume_id", - "protection_status", - "version" - ], - "sectionRelativeRepoPath": "bitlocker_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/bitlocker_info.yml" - }, - { - "url": "/tables/block_devices", - "title": "block_devices", - "htmlId": "table--blockdevices--02b86eaa11", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "block_devices", - "block_size", - "label", - "model", - "name", - "parent", - "size", - "type", - "uuid", - "vendor" - ], - "sectionRelativeRepoPath": "block_devices", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/block_devices.yml" - }, - { - "url": "/tables/bpf_process_events", - "title": "bpf_process_events", - "htmlId": "table--bpfprocessevents--e4d218dd16", - "evented": true, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "bpf_process_events", - "cid", - "cmdline", - "cwd", - "duration", - "eid", - "exit_code", - "gid", - "json_cmdline", - "ntime", - "parent", - "path", - "pid", - "probe_error", - "syscall", - "tid", - "time", - "uid" - ], - "sectionRelativeRepoPath": "bpf_process_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fbpf_process_events.yml&value=name%3A%20bpf_process_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/bpf_socket_events", - "title": "bpf_socket_events", - "htmlId": "table--bpfsocketevents--d159f6e0ec", - "evented": true, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "bpf_socket_events", - "cid", - "duration", - "eid", - "exit_code", - "family", - "fd", - "gid", - "local_address", - "local_port", - "ntime", - "parent", - "path", - "pid", - "probe_error", - "protocol", - "remote_address", - "remote_port", - "syscall", - "tid", - "time", - "type", - "uid" - ], - "sectionRelativeRepoPath": "bpf_socket_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fbpf_socket_events.yml&value=name%3A%20bpf_socket_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/carbon_black_info", - "title": "carbon_black_info", - "htmlId": "table--carbonblackinfo--6f86f36018", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "carbon_black_info", - "binary_queue", - "collect_cross_processes", - "collect_data_file_writes", - "collect_emet_events", - "collect_file_mods", - "collect_module_info", - "collect_module_loads", - "collect_net_conns", - "collect_process_user_context", - "collect_processes", - "collect_reg_mods", - "collect_sensor_operations", - "collect_store_files", - "config_name", - "event_queue", - "log_file_disk_quota_mb", - "log_file_disk_quota_percentage", - "protection_disabled", - "sensor_backend_server", - "sensor_id", - "sensor_ip_addr" - ], - "sectionRelativeRepoPath": "carbon_black_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/carbon_black_info.yml" - }, - { - "url": "/tables/carves", - "title": "carves", - "htmlId": "table--carves--21d0d7abcc", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "carves", - "carve", - "carve_guid", - "path", - "request_id", - "sha256", - "size", - "status", - "time" - ], - "sectionRelativeRepoPath": "carves", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fcarves.yml&value=name%3A%20carves%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/certificates", - "title": "certificates", - "htmlId": "table--certificates--c5deae5c8a", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "certificates", - "authority_key_id", - "ca", - "common_name", - "issuer", - "issuer2", - "key_algorithm", - "key_strength", - "key_usage", - "not_valid_after", - "not_valid_before", - "path", - "self_signed", - "serial", - "sha1", - "sid", - "signing_algorithm", - "store", - "store_id", - "store_location", - "subject", - "subject2", - "subject_key_id", - "username" - ], - "sectionRelativeRepoPath": "certificates", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/certificates.yml" - }, - { - "url": "/tables/chassis_info", - "title": "chassis_info", - "htmlId": "table--chassisinfo--83a136fff8", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "chassis_info", - "audible_alarm", - "breach_description", - "chassis_types", - "description", - "lock", - "manufacturer", - "model", - "security_breach", - "serial", - "sku", - "smbios_tag", - "status", - "visible_alarm" - ], - "sectionRelativeRepoPath": "chassis_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fchassis_info.yml&value=name%3A%20chassis_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/chocolatey_packages", - "title": "chocolatey_packages", - "htmlId": "table--chocolateypackages--288501d5b6", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "chocolatey_packages", - "author", - "license", - "name", - "path", - "summary", - "version" - ], - "sectionRelativeRepoPath": "chocolatey_packages", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fchocolatey_packages.yml&value=name%3A%20chocolatey_packages%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/chrome_extension_content_scripts", - "title": "chrome_extension_content_scripts", - "htmlId": "table--chromeextensioncontentscripts--abacba6da5", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "chrome_extension_content_scripts", - "browser_type", - "identifier", - "match", - "path", - "profile_path", - "referenced", - "script", - "uid", - "version" - ], - "sectionRelativeRepoPath": "chrome_extension_content_scripts", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/chrome_extension_content_scripts.yml" - }, - { - "url": "/tables/chrome_extensions", - "title": "chrome_extensions", - "htmlId": "table--chromeextensions--d60f6f5172", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux", - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "chrome_extensions", - "author", - "browser_type", - "current_locale", - "default_locale", - "description", - "from_webstore", - "identifier", - "install_time", - "install_timestamp", - "key", - "manifest_hash", - "manifest_json", - "name", - "optional_permissions", - "optional_permissions_json", - "path", - "permissions", - "permissions_json", - "persistent", - "profile", - "profile_path", - "referenced", - "referenced_identifier", - "state", - "uid", - "update_url", - "version" - ], - "sectionRelativeRepoPath": "chrome_extensions", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/chrome_extensions.yml" - }, - { - "url": "/tables/cis_audit", - "title": "cis_audit", - "htmlId": "table--cisaudit--874111a684", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "cis_audit", - "item", - "value" - ], - "sectionRelativeRepoPath": "cis_audit", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cis_audit.yml" - }, - { - "url": "/tables/codesign", - "title": "codesign", - "htmlId": "table--codesign--fa0a38aee8", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "codesign", - "path", - "team_identifier" - ], - "sectionRelativeRepoPath": "codesign", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/codesign.yml" - }, - { - "url": "/tables/connected_displays", - "title": "connected_displays", - "htmlId": "table--connecteddisplays--63b891fe5b", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "connected_displays", - "ambient_brightness_enabled", - "connection_type", - "display_id", - "display_type", - "main", - "manufactured_week", - "manufactured_year", - "mirror", - "name", - "online", - "pixels", - "product_id", - "resolution", - "rotation", - "serial_number", - "vendor_id" - ], - "sectionRelativeRepoPath": "connected_displays", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fconnected_displays.yml&value=name%3A%20connected_displays%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/connectivity", - "title": "connectivity", - "htmlId": "table--connectivity--0ed058b2bd", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "connectivity", - "disconnected", - "ipv4_internet", - "ipv4_local_network", - "ipv4_no_traffic", - "ipv4_subnet", - "ipv6_internet", - "ipv6_local_network", - "ipv6_no_traffic", - "ipv6_subnet" - ], - "sectionRelativeRepoPath": "connectivity", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fconnectivity.yml&value=name%3A%20connectivity%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/corestorage_logical_volume_families", - "title": "corestorage_logical_volume_families", - "htmlId": "table--corestoragelogicalvolumefamilies--75a2be8167", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "corestorage_logical_volume_families", - "EncryptionStatus", - "EncryptionType", - "HasVisibleUsers", - "HasVolumeKey", - "IsAcceptingNewUsers", - "IsFullySecure", - "MayHaveEncryptedEvents", - "RequiresPasswordUnlock", - "UUID", - "vg_FreeSpace", - "vg_FusionDrive", - "vg_Name", - "vg_Sequence", - "vg_Size", - "vg_Sparse", - "vg_Status", - "vg_UUID", - "vg_Version" - ], - "sectionRelativeRepoPath": "corestorage_logical_volume_families", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/corestorage_logical_volume_families.yml" - }, - { - "url": "/tables/corestorage_logical_volumes", - "title": "corestorage_logical_volumes", - "htmlId": "table--corestoragelogicalvolumes--2e5c4b4eda", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "corestorage_logical_volumes", - "ContentHint", - "ConversionState", - "ConverstionProgressPercent", - "DesignatedPhysicalVolume", - "DesignatedPhysicalVolumeIdentifier", - "Identifier", - "Name", - "Sequence", - "Size", - "Status", - "UUID", - "Version", - "VolumeName", - "lvf_EncryptionStatus", - "lvf_EncryptionType", - "lvf_HasVisibleUsers", - "lvf_HasVolumeKey", - "lvf_IsAcceptingNewUsers", - "lvf_IsFullySecure", - "lvf_MayHaveEncryptedEvents", - "lvf_RequiresPasswordUnlock", - "lvf_UUID", - "vg_FreeSpace", - "vg_FusionDrive", - "vg_Name", - "vg_Sequence", - "vg_Size", - "vg_Sparse", - "vg_Status", - "vg_UUID", - "vg_Version" - ], - "sectionRelativeRepoPath": "corestorage_logical_volumes", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/corestorage_logical_volumes.yml" - }, - { - "url": "/tables/cpu_info", - "title": "cpu_info", - "htmlId": "table--cpuinfo--dc58632cc4", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "cpu_info", - "address_width", - "availability", - "cpu_status", - "current_clock_speed", - "device_id", - "load_percentage", - "logical_processors", - "manufacturer", - "max_clock_speed", - "model", - "number_of_cores", - "number_of_efficiency_cores", - "number_of_performance_cores", - "processor_type", - "socket_designation" - ], - "sectionRelativeRepoPath": "cpu_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpu_info.yml" - }, - { - "url": "/tables/cpu_time", - "title": "cpu_time", - "htmlId": "table--cputime--8255dad033", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "cpu_time", - "core", - "guest", - "guest_nice", - "idle", - "iowait", - "irq", - "nice", - "softirq", - "steal", - "system", - "user" - ], - "sectionRelativeRepoPath": "cpu_time", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpu_time.yml" - }, - { - "url": "/tables/cpuid", - "title": "cpuid", - "htmlId": "table--cpuid--e436e18fab", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "cpuid", - "feature", - "input_eax", - "output_bit", - "output_register", - "value" - ], - "sectionRelativeRepoPath": "cpuid", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cpuid.yml" - }, - { - "url": "/tables/crashes", - "title": "crashes", - "htmlId": "table--crashes--3bbfa2aecf", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "crashes", - "crash_path", - "crashed_thread", - "datetime", - "exception_codes", - "exception_notes", - "exception_type", - "identifier", - "parent", - "path", - "pid", - "registers", - "responsible", - "stack_trace", - "type", - "uid", - "version" - ], - "sectionRelativeRepoPath": "crashes", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/crashes.yml" - }, - { - "url": "/tables/crontab", - "title": "crontab", - "htmlId": "table--crontab--b9ef1cb44f", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "crontab", - "command", - "day_of_month", - "day_of_week", - "event", - "hour", - "minute", - "month", - "path", - "pid_with_namespace" - ], - "sectionRelativeRepoPath": "crontab", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/crontab.yml" - }, - { - "url": "/tables/cryptoinfo", - "title": "cryptoinfo", - "htmlId": "table--cryptoinfo--4e6f3402e4", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "cryptoinfo", - "fullkey", - "key", - "parent", - "passphrase", - "path", - "query", - "value" - ], - "sectionRelativeRepoPath": "cryptoinfo", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cryptoinfo.yml" - }, - { - "url": "/tables/cryptsetup_status", - "title": "cryptsetup_status", - "htmlId": "table--cryptsetupstatus--92e356d70a", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "cryptsetup_status", - "fullkey", - "key", - "name", - "parent", - "query", - "value" - ], - "sectionRelativeRepoPath": "cryptsetup_status", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cryptsetup_status.yml" - }, - { - "url": "/tables/csrutil_info", - "title": "csrutil_info", - "htmlId": "table--csrutilinfo--b59be8aa56", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "csrutil_info", - "ssv_enabled" - ], - "sectionRelativeRepoPath": "csrutil_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/csrutil_info.yml" - }, - { - "url": "/tables/cups_destinations", - "title": "cups_destinations", - "htmlId": "table--cupsdestinations--2afbcf27b5", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "cups_destinations", - "name", - "option_name", - "option_value" - ], - "sectionRelativeRepoPath": "cups_destinations", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cups_destinations.yml" - }, - { - "url": "/tables/cups_jobs", - "title": "cups_jobs", - "htmlId": "table--cupsjobs--bb7b9d647d", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "cups_jobs", - "completed_time", - "creation_time", - "destination", - "format", - "processing_time", - "size", - "title", - "user" - ], - "sectionRelativeRepoPath": "cups_jobs", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/cups_jobs.yml" - }, - { - "url": "/tables/curl", - "title": "curl", - "htmlId": "table--curl--be66eddb51", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "curl", - "bytes", - "method", - "response_code", - "result", - "round_trip_time", - "url", - "user_agent" - ], - "sectionRelativeRepoPath": "curl", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/curl.yml" - }, - { - "url": "/tables/curl_certificate", - "title": "curl_certificate", - "htmlId": "table--curlcertificate--b068ff9340", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "curl_certificate", - "authority_key_identifier", - "basic_constraint", - "common_name", - "dump_certificate", - "extended_key_usage", - "has_expired", - "hostname", - "info_access", - "issuer_alternative_names", - "issuer_common_name", - "issuer_organization", - "issuer_organization_unit", - "key_usage", - "name_constraints", - "organization", - "organization_unit", - "pem", - "policies", - "policy_constraints", - "policy_mappings", - "serial_number", - "sha1_fingerprint", - "sha256_fingerprint", - "signature", - "signature_algorithm", - "subject_alternative_names", - "subject_info_access", - "subject_key_identifier", - "timeout", - "valid_from", - "valid_to", - "version" - ], - "sectionRelativeRepoPath": "curl_certificate", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/curl_certificate.yml" - }, - { - "url": "/tables/deb_packages", - "title": "deb_packages", - "htmlId": "table--debpackages--51b09c301a", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "deb_packages", - "admindir", - "arch", - "maintainer", - "mount_namespace_id", - "name", - "pid_with_namespace", - "priority", - "revision", - "section", - "size", - "source", - "status", - "version" - ], - "sectionRelativeRepoPath": "deb_packages", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/deb_packages.yml" - }, - { - "url": "/tables/default_environment", - "title": "default_environment", - "htmlId": "table--defaultenvironment--2ae05ad964", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "default_environment", - "expand", - "value", - "variable" - ], - "sectionRelativeRepoPath": "default_environment", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdefault_environment.yml&value=name%3A%20default_environment%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/device_file", - "title": "device_file", - "htmlId": "table--devicefile--21a9dfaeec", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "device_file", - "atime", - "block_size", - "ctime", - "device", - "filename", - "gid", - "hard_links", - "inode", - "mode", - "mtime", - "partition", - "path", - "size", - "type", - "uid" - ], - "sectionRelativeRepoPath": "device_file", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdevice_file.yml&value=name%3A%20device_file%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/device_firmware", - "title": "device_firmware", - "htmlId": "table--devicefirmware--51430913ce", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "device_firmware", - "device", - "type", - "version" - ], - "sectionRelativeRepoPath": "device_firmware", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/device_firmware.yml" - }, - { - "url": "/tables/device_hash", - "title": "device_hash", - "htmlId": "table--devicehash--3df4b40471", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "device_hash", - "device", - "inode", - "md5", - "partition", - "sha1", - "sha256" - ], - "sectionRelativeRepoPath": "device_hash", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdevice_hash.yml&value=name%3A%20device_hash%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/device_partitions", - "title": "device_partitions", - "htmlId": "table--devicepartitions--76f282a65c", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "device_partitions", - "blocks", - "blocks_size", - "device", - "flags", - "inodes", - "label", - "offset", - "partition", - "type" - ], - "sectionRelativeRepoPath": "device_partitions", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdevice_partitions.yml&value=name%3A%20device_partitions%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/disk_encryption", - "title": "disk_encryption", - "htmlId": "table--diskencryption--491e7cd22b", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "disk_encryption", - "encrypted", - "encryption_status", - "filevault_status", - "name", - "type", - "uid", - "user_uuid", - "uuid" - ], - "sectionRelativeRepoPath": "disk_encryption", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_encryption.yml" - }, - { - "url": "/tables/disk_events", - "title": "disk_events", - "htmlId": "table--diskevents--d600925ce7", - "evented": true, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "disk_events", - "action", - "checksum", - "content", - "device", - "eid", - "ejectable", - "filesystem", - "media_name", - "mountable", - "name", - "path", - "size", - "time", - "uuid", - "vendor", - "writable" - ], - "sectionRelativeRepoPath": "disk_events", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_events.yml" - }, - { - "url": "/tables/disk_info", - "title": "disk_info", - "htmlId": "table--diskinfo--50152e88f0", - "evented": false, - "platforms": [ - "windows", - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "disk_info", - "description", - "disk_index", - "disk_size", - "hardware_model", - "id", - "manufacturer", - "name", - "partitions", - "pnp_device_id", - "serial", - "type" - ], - "sectionRelativeRepoPath": "disk_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/disk_info.yml" - }, - { - "url": "/tables/dns_cache", - "title": "dns_cache", - "htmlId": "table--dnscache--0f9ca87f83", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "dns_cache", - "flags", - "name", - "type" - ], - "sectionRelativeRepoPath": "dns_cache", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dns_cache.yml" - }, - { - "url": "/tables/dns_resolvers", - "title": "dns_resolvers", - "htmlId": "table--dnsresolvers--640b39c11c", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "dns_resolvers", - "address", - "id", - "netmask", - "options", - "pid_with_namespace", - "type" - ], - "sectionRelativeRepoPath": "dns_resolvers", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dns_resolvers.yml" - }, - { - "url": "/tables/docker_container_envs", - "title": "docker_container_envs", - "htmlId": "table--dockercontainerenvs--81a610f9b8", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_container_envs", - "id", - "key", - "value" - ], - "sectionRelativeRepoPath": "docker_container_envs", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_envs.yml" - }, - { - "url": "/tables/docker_container_fs_changes", - "title": "docker_container_fs_changes", - "htmlId": "table--dockercontainerfschanges--146475674b", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_container_fs_changes", - "change_type", - "id", - "path" - ], - "sectionRelativeRepoPath": "docker_container_fs_changes", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_container_fs_changes.yml&value=name%3A%20docker_container_fs_changes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_container_labels", - "title": "docker_container_labels", - "htmlId": "table--dockercontainerlabels--729a84f2c8", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_container_labels", - "id", - "key", - "value" - ], - "sectionRelativeRepoPath": "docker_container_labels", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_labels.yml" - }, - { - "url": "/tables/docker_container_mounts", - "title": "docker_container_mounts", - "htmlId": "table--dockercontainermounts--a4cdda336d", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_container_mounts", - "destination", - "driver", - "id", - "mode", - "name", - "propagation", - "rw", - "source", - "type" - ], - "sectionRelativeRepoPath": "docker_container_mounts", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_mounts.yml" - }, - { - "url": "/tables/docker_container_networks", - "title": "docker_container_networks", - "htmlId": "table--dockercontainernetworks--f1ba390a95", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_container_networks", - "endpoint_id", - "gateway", - "id", - "ip_address", - "ip_prefix_len", - "ipv6_address", - "ipv6_gateway", - "ipv6_prefix_len", - "mac_address", - "name", - "network_id" - ], - "sectionRelativeRepoPath": "docker_container_networks", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_networks.yml" - }, - { - "url": "/tables/docker_container_ports", - "title": "docker_container_ports", - "htmlId": "table--dockercontainerports--98e5d50e58", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_container_ports", - "host_ip", - "host_port", - "id", - "port", - "type" - ], - "sectionRelativeRepoPath": "docker_container_ports", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_container_ports.yml" - }, - { - "url": "/tables/docker_container_processes", - "title": "docker_container_processes", - "htmlId": "table--dockercontainerprocesses--0d43e2476d", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_container_processes", - "cmdline", - "cpu", - "egid", - "euid", - "gid", - "id", - "mem", - "name", - "nice", - "parent", - "pgroup", - "pid", - "resident_size", - "sgid", - "start_time", - "state", - "suid", - "threads", - "time", - "total_size", - "uid", - "user", - "wired_size" - ], - "sectionRelativeRepoPath": "docker_container_processes", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_container_processes.yml&value=name%3A%20docker_container_processes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_container_stats", - "title": "docker_container_stats", - "htmlId": "table--dockercontainerstats--cbc44cbb1e", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_container_stats", - "cpu_kernelmode_usage", - "cpu_total_usage", - "cpu_usermode_usage", - "disk_read", - "disk_write", - "id", - "interval", - "memory_cached", - "memory_limit", - "memory_max_usage", - "memory_usage", - "name", - "network_rx_bytes", - "network_tx_bytes", - "num_procs", - "online_cpus", - "pids", - "pre_cpu_kernelmode_usage", - "pre_cpu_total_usage", - "pre_cpu_usermode_usage", - "pre_online_cpus", - "pre_system_cpu_usage", - "preread", - "read", - "system_cpu_usage" - ], - "sectionRelativeRepoPath": "docker_container_stats", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_container_stats.yml&value=name%3A%20docker_container_stats%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_containers", - "title": "docker_containers", - "htmlId": "table--dockercontainers--7e3bf8c583", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_containers", - "cgroup_namespace", - "command", - "config_entrypoint", - "created", - "env_variables", - "finished_at", - "id", - "image", - "image_id", - "ipc_namespace", - "mnt_namespace", - "name", - "net_namespace", - "path", - "pid", - "pid_namespace", - "privileged", - "readonly_rootfs", - "security_options", - "started_at", - "state", - "status", - "user_namespace", - "uts_namespace" - ], - "sectionRelativeRepoPath": "docker_containers", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_containers.yml" - }, - { - "url": "/tables/docker_image_history", - "title": "docker_image_history", - "htmlId": "table--dockerimagehistory--4ae09de63b", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_image_history", - "comment", - "created", - "created_by", - "id", - "size", - "tags" - ], - "sectionRelativeRepoPath": "docker_image_history", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_image_history.yml&value=name%3A%20docker_image_history%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_image_labels", - "title": "docker_image_labels", - "htmlId": "table--dockerimagelabels--3f0926bda2", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_image_labels", - "id", - "key", - "value" - ], - "sectionRelativeRepoPath": "docker_image_labels", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_image_labels.yml&value=name%3A%20docker_image_labels%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_image_layers", - "title": "docker_image_layers", - "htmlId": "table--dockerimagelayers--3ecfc0546e", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_image_layers", - "id", - "layer_id", - "layer_order" - ], - "sectionRelativeRepoPath": "docker_image_layers", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_image_layers.yml&value=name%3A%20docker_image_layers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_images", - "title": "docker_images", - "htmlId": "table--dockerimages--cf3cfdc1ef", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_images", - "created", - "id", - "size_bytes", - "tags" - ], - "sectionRelativeRepoPath": "docker_images", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_images.yml" - }, - { - "url": "/tables/docker_info", - "title": "docker_info", - "htmlId": "table--dockerinfo--714b1bde6d", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_info", - "architecture", - "bridge_nf_ip6tables", - "bridge_nf_iptables", - "cgroup_driver", - "containers", - "containers_paused", - "containers_running", - "containers_stopped", - "cpu_cfs_period", - "cpu_cfs_quota", - "cpu_set", - "cpu_shares", - "cpus", - "http_proxy", - "https_proxy", - "id", - "images", - "ipv4_forwarding", - "kernel_memory", - "kernel_version", - "logging_driver", - "memory", - "memory_limit", - "name", - "no_proxy", - "oom_kill_disable", - "os", - "os_type", - "root_dir", - "server_version", - "storage_driver", - "swap_limit" - ], - "sectionRelativeRepoPath": "docker_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_info.yml&value=name%3A%20docker_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_network_labels", - "title": "docker_network_labels", - "htmlId": "table--dockernetworklabels--4f542d1ff2", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_network_labels", - "id", - "key", - "value" - ], - "sectionRelativeRepoPath": "docker_network_labels", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_network_labels.yml&value=name%3A%20docker_network_labels%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_networks", - "title": "docker_networks", - "htmlId": "table--dockernetworks--fa4acfa370", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_networks", - "created", - "driver", - "enable_ipv6", - "gateway", - "id", - "name", - "subnet" - ], - "sectionRelativeRepoPath": "docker_networks", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_networks.yml&value=name%3A%20docker_networks%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_version", - "title": "docker_version", - "htmlId": "table--dockerversion--e97ecaec5b", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_version", - "api_version", - "arch", - "build_time", - "git_commit", - "go_version", - "kernel_version", - "min_api_version", - "os", - "version" - ], - "sectionRelativeRepoPath": "docker_version", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_version.yml&value=name%3A%20docker_version%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_volume_labels", - "title": "docker_volume_labels", - "htmlId": "table--dockervolumelabels--66e9aa67f9", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_volume_labels", - "key", - "name", - "value" - ], - "sectionRelativeRepoPath": "docker_volume_labels", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdocker_volume_labels.yml&value=name%3A%20docker_volume_labels%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/docker_volumes", - "title": "docker_volumes", - "htmlId": "table--dockervolumes--3f29ba576c", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "docker_volumes", - "driver", - "mount_point", - "name", - "type" - ], - "sectionRelativeRepoPath": "docker_volumes", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/docker_volumes.yml" - }, - { - "url": "/tables/drivers", - "title": "drivers", - "htmlId": "table--drivers--ebf2da6641", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "drivers", - "class", - "date", - "description", - "device_id", - "device_name", - "driver_key", - "image", - "inf", - "manufacturer", - "provider", - "service", - "service_key", - "signed", - "version" - ], - "sectionRelativeRepoPath": "drivers", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fdrivers.yml&value=name%3A%20drivers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/dscl", - "title": "dscl", - "htmlId": "table--dscl--6a32fb5697", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "dscl", - "command", - "key", - "path", - "value" - ], - "sectionRelativeRepoPath": "dscl", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/dscl.yml" - }, - { - "url": "/tables/ec2_instance_metadata", - "title": "ec2_instance_metadata", - "htmlId": "table--ec2instancemetadata--1fe001f1fc", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "ec2_instance_metadata", - "account_id", - "ami_id", - "architecture", - "availability_zone", - "iam_arn", - "instance_id", - "instance_type", - "local_hostname", - "local_ipv4", - "mac", - "region", - "reservation_id", - "security_groups", - "ssh_public_key" - ], - "sectionRelativeRepoPath": "ec2_instance_metadata", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fec2_instance_metadata.yml&value=name%3A%20ec2_instance_metadata%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/ec2_instance_tags", - "title": "ec2_instance_tags", - "htmlId": "table--ec2instancetags--a1ae69e37b", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "ec2_instance_tags", - "instance_id", - "key", - "value" - ], - "sectionRelativeRepoPath": "ec2_instance_tags", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fec2_instance_tags.yml&value=name%3A%20ec2_instance_tags%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/es_process_events", - "title": "es_process_events", - "htmlId": "table--esprocessevents--46fde3e1bf", - "evented": true, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "es_process_events", - "cdhash", - "child_pid", - "cmdline", - "cmdline_count", - "codesigning_flags", - "cwd", - "egid", - "eid", - "env", - "env_count", - "euid", - "event_type", - "exit_code", - "gid", - "global_seq_num", - "original_parent", - "parent", - "path", - "pid", - "platform_binary", - "seq_num", - "signing_id", - "team_id", - "time", - "uid", - "username", - "version" - ], - "sectionRelativeRepoPath": "es_process_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fes_process_events.yml&value=name%3A%20es_process_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/es_process_file_events", - "title": "es_process_file_events", - "htmlId": "table--esprocessfileevents--ae9663cc9c", - "evented": true, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "es_process_file_events", - "dest_filename", - "eid", - "event_type", - "filename", - "global_seq_num", - "parent", - "path", - "pid", - "seq_num", - "time", - "version" - ], - "sectionRelativeRepoPath": "es_process_file_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fes_process_file_events.yml&value=name%3A%20es_process_file_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/etc_hosts", - "title": "etc_hosts", - "htmlId": "table--etchosts--aef5ac1189", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "etc_hosts", - "address", - "hostnames", - "pid_with_namespace" - ], - "sectionRelativeRepoPath": "etc_hosts", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/etc_hosts.yml" - }, - { - "url": "/tables/etc_protocols", - "title": "etc_protocols", - "htmlId": "table--etcprotocols--3294d792c1", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "etc_protocols", - "alias", - "comment", - "name", - "number" - ], - "sectionRelativeRepoPath": "etc_protocols", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fetc_protocols.yml&value=name%3A%20etc_protocols%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/etc_services", - "title": "etc_services", - "htmlId": "table--etcservices--5eadf265ad", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "etc_services", - "aliases", - "comment", - "name", - "port", - "protocol" - ], - "sectionRelativeRepoPath": "etc_services", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/etc_services.yml" - }, - { - "url": "/tables/event_taps", - "title": "event_taps", - "htmlId": "table--eventtaps--346fb130c6", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "event_taps", - "enabled", - "event_tap_id", - "event_tapped", - "process_being_tapped", - "tapping_process" - ], - "sectionRelativeRepoPath": "event_taps", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/event_taps.yml" - }, - { - "url": "/tables/extended_attributes", - "title": "extended_attributes", - "htmlId": "table--extendedattributes--4a537de12f", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "extended_attributes", - "base64", - "directory", - "key", - "path", - "value" - ], - "sectionRelativeRepoPath": "extended_attributes", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fextended_attributes.yml&value=name%3A%20extended_attributes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/falcon_kernel_check", - "title": "falcon_kernel_check", - "htmlId": "table--falconkernelcheck--3fb5ac699a", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "falcon_kernel_check", - "kernel", - "sensor_version", - "supported" - ], - "sectionRelativeRepoPath": "falcon_kernel_check", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/falcon_kernel_check.yml" - }, - { - "url": "/tables/falconctl_options", - "title": "falconctl_options", - "htmlId": "table--falconctloptions--3f358ca8e2", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "falconctl_options", - "options" - ], - "sectionRelativeRepoPath": "falconctl_options", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/falconctl_options.yml" - }, - { - "url": "/tables/fan_speed_sensors", - "title": "fan_speed_sensors", - "htmlId": "table--fanspeedsensors--2978a01b93", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "fan_speed_sensors", - "actual", - "fan", - "max", - "min", - "name", - "target" - ], - "sectionRelativeRepoPath": "fan_speed_sensors", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Ffan_speed_sensors.yml&value=name%3A%20fan_speed_sensors%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/file", - "title": "file", - "htmlId": "table--file--0998d79258", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "file", - "atime", - "attributes", - "block_size", - "bsd_flags", - "btime", - "ctime", - "device", - "directory", - "file_id", - "file_version", - "filename", - "gid", - "hard_links", - "inode", - "mode", - "mount_namespace_id", - "mtime", - "original_filename", - "path", - "pid_with_namespace", - "product_version", - "shortcut_comment", - "shortcut_run", - "shortcut_start_in", - "shortcut_target_location", - "shortcut_target_path", - "shortcut_target_type", - "size", - "symlink", - "type", - "uid", - "volume_serial" - ], - "sectionRelativeRepoPath": "file", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/file.yml" - }, - { - "url": "/tables/file_events", - "title": "file_events", - "htmlId": "table--fileevents--89f8fc187d", - "evented": true, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "file_events", - "action", - "atime", - "category", - "ctime", - "eid", - "gid", - "hashed", - "inode", - "md5", - "mode", - "mtime", - "sha1", - "sha256", - "size", - "target_path", - "time", - "transaction_id", - "uid" - ], - "sectionRelativeRepoPath": "file_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Ffile_events.yml&value=name%3A%20file_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/file_lines", - "title": "file_lines", - "htmlId": "table--filelines--b1cf006b9f", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "file_lines", - "line", - "path" - ], - "sectionRelativeRepoPath": "file_lines", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/file_lines.yml" - }, - { - "url": "/tables/filevault_prk", - "title": "filevault_prk", - "htmlId": "table--filevaultprk--c80ae4bc73", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "filevault_prk", - "base64_encrypted" - ], - "sectionRelativeRepoPath": "filevault_prk", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_prk.yml" - }, - { - "url": "/tables/filevault_status", - "title": "filevault_status", - "htmlId": "table--filevaultstatus--f596dfe332", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "filevault_status", - "status" - ], - "sectionRelativeRepoPath": "filevault_status", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_status.yml" - }, - { - "url": "/tables/filevault_users", - "title": "filevault_users", - "htmlId": "table--filevaultusers--4fef59eeaf", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "filevault_users", - "username", - "uuid" - ], - "sectionRelativeRepoPath": "filevault_users", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/filevault_users.yml" - }, - { - "url": "/tables/find_cmd", - "title": "find_cmd", - "htmlId": "table--findcmd--deb6daee06", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "find_cmd", - "directory", - "path", - "perm", - "type" - ], - "sectionRelativeRepoPath": "find_cmd", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/find_cmd.yml" - }, - { - "url": "/tables/firefox_addons", - "title": "firefox_addons", - "htmlId": "table--firefoxaddons--17b4919e2c", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "firefox_addons", - "active", - "autoupdate", - "creator", - "description", - "disabled", - "identifier", - "location", - "name", - "path", - "source_url", - "type", - "uid", - "version", - "visible" - ], - "sectionRelativeRepoPath": "firefox_addons", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firefox_addons.yml" - }, - { - "url": "/tables/firefox_preferences", - "title": "firefox_preferences", - "htmlId": "table--firefoxpreferences--c1cc16e572", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "firefox_preferences", - "fullkey", - "key", - "parent", - "path", - "query", - "value" - ], - "sectionRelativeRepoPath": "firefox_preferences", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firefox_preferences.yml" - }, - { - "url": "/tables/firmware_eficheck_integrity_check", - "title": "firmware_eficheck_integrity_check", - "htmlId": "table--firmwareeficheckintegritycheck--d824ba10bd", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "firmware_eficheck_integrity_check", - "chip", - "output" - ], - "sectionRelativeRepoPath": "firmware_eficheck_integrity_check", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmware_eficheck_integrity_check.yml" - }, - { - "url": "/tables/firmwarepasswd", - "title": "firmwarepasswd", - "htmlId": "table--firmwarepasswd--1d4038effe", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "firmwarepasswd", - "mode", - "option_roms_allowed", - "password_enabled" - ], - "sectionRelativeRepoPath": "firmwarepasswd", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/firmwarepasswd.yml" - }, - { - "url": "/tables/fleetd_logs", - "title": "fleetd_logs", - "htmlId": "table--fleetdlogs--6779899341", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "fleetd_logs", - "error", - "level", - "message", - "payload", - "time" - ], - "sectionRelativeRepoPath": "fleetd_logs", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/fleetd_logs.yml" - }, - { - "url": "/tables/gatekeeper", - "title": "gatekeeper", - "htmlId": "table--gatekeeper--eeec63c313", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "gatekeeper", - "assessments_enabled", - "dev_id_enabled", - "opaque_version", - "version" - ], - "sectionRelativeRepoPath": "gatekeeper", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/gatekeeper.yml" - }, - { - "url": "/tables/gatekeeper_approved_apps", - "title": "gatekeeper_approved_apps", - "htmlId": "table--gatekeeperapprovedapps--5262f09ccf", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "gatekeeper_approved_apps", - "ctime", - "mtime", - "path", - "requirement" - ], - "sectionRelativeRepoPath": "gatekeeper_approved_apps", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fgatekeeper_approved_apps.yml&value=name%3A%20gatekeeper_approved_apps%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/geolocation", - "title": "geolocation", - "htmlId": "table--geolocation--7b8fdd3df6", - "evented": false, - "platforms": [ - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "geolocation", - "city", - "country", - "ip", - "region" - ], - "sectionRelativeRepoPath": "geolocation", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/geolocation.yml" - }, - { - "url": "/tables/google_chrome_profiles", - "title": "google_chrome_profiles", - "htmlId": "table--googlechromeprofiles--ba450e3fda", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "google_chrome_profiles", - "email", - "ephemeral", - "name", - "username" - ], - "sectionRelativeRepoPath": "google_chrome_profiles", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/google_chrome_profiles.yml" - }, - { - "url": "/tables/groups", - "title": "groups", - "htmlId": "table--groups--67e19bd020", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "groups", - "comment", - "gid", - "gid_signed", - "group_sid", - "groupname", - "is_hidden", - "pid_with_namespace" - ], - "sectionRelativeRepoPath": "groups", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/groups.yml" - }, - { - "url": "/tables/hardware_events", - "title": "hardware_events", - "htmlId": "table--hardwareevents--0ec1e5a067", - "evented": true, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "hardware_events", - "action", - "driver", - "eid", - "model", - "model_id", - "path", - "revision", - "serial", - "time", - "type", - "vendor", - "vendor_id" - ], - "sectionRelativeRepoPath": "hardware_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fhardware_events.yml&value=name%3A%20hardware_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/hash", - "title": "hash", - "htmlId": "table--hash--7b1d73cbdf", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "hash", - "directory", - "md5", - "mount_namespace_id", - "path", - "pid_with_namespace", - "sha1", - "sha256" - ], - "sectionRelativeRepoPath": "hash", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/hash.yml" - }, - { - "url": "/tables/homebrew_packages", - "title": "homebrew_packages", - "htmlId": "table--homebrewpackages--4c728a5d09", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "homebrew_packages", - "name", - "path", - "prefix", - "type", - "version" - ], - "sectionRelativeRepoPath": "homebrew_packages", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/homebrew_packages.yml" - }, - { - "url": "/tables/hvci_status", - "title": "hvci_status", - "htmlId": "table--hvcistatus--f86e9e772f", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "hvci_status", - "code_integrity_policy_enforcement_status", - "instance_identifier", - "umci_policy_status", - "vbs_status", - "version" - ], - "sectionRelativeRepoPath": "hvci_status", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fhvci_status.yml&value=name%3A%20hvci_status%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/ibridge_info", - "title": "ibridge_info", - "htmlId": "table--ibridgeinfo--7a52b9c110", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "ibridge_info", - "boot_uuid", - "coprocessor_version", - "firmware_version", - "unique_chip_id" - ], - "sectionRelativeRepoPath": "ibridge_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fibridge_info.yml&value=name%3A%20ibridge_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/icloud_private_relay", - "title": "icloud_private_relay", - "htmlId": "table--icloudprivaterelay--e09aa5fd60", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "icloud_private_relay", - "status" - ], - "sectionRelativeRepoPath": "icloud_private_relay", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/icloud_private_relay.yml" - }, - { - "url": "/tables/ie_extensions", - "title": "ie_extensions", - "htmlId": "table--ieextensions--eec76438e2", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "ie_extensions", - "name", - "path", - "registry_path", - "version" - ], - "sectionRelativeRepoPath": "ie_extensions", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ie_extensions.yml" - }, - { - "url": "/tables/intel_me_info", - "title": "intel_me_info", - "htmlId": "table--intelmeinfo--a3cd5396b2", - "evented": false, - "platforms": [ - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "intel_me_info", - "version" - ], - "sectionRelativeRepoPath": "intel_me_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fintel_me_info.yml&value=name%3A%20intel_me_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/interface_addresses", - "title": "interface_addresses", - "htmlId": "table--interfaceaddresses--6fff20210a", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "interface_addresses", - "address", - "broadcast", - "friendly_name", - "interface", - "mask", - "point_to_point", - "type" - ], - "sectionRelativeRepoPath": "interface_addresses", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_addresses.yml" - }, - { - "url": "/tables/interface_details", - "title": "interface_details", - "htmlId": "table--interfacedetails--6b2b348092", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "interface_details", - "collisions", - "connection_id", - "connection_status", - "description", - "dhcp_enabled", - "dhcp_lease_expires", - "dhcp_lease_obtained", - "dhcp_server", - "dns_domain", - "dns_domain_suffix_search_order", - "dns_host_name", - "dns_server_search_order", - "enabled", - "flags", - "friendly_name", - "ibytes", - "idrops", - "ierrors", - "interface", - "ipackets", - "last_change", - "link_speed", - "mac", - "manufacturer", - "metric", - "mtu", - "obytes", - "odrops", - "oerrors", - "opackets", - "pci_slot", - "physical_adapter", - "service", - "speed", - "type" - ], - "sectionRelativeRepoPath": "interface_details", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_details.yml" - }, - { - "url": "/tables/interface_ipv6", - "title": "interface_ipv6", - "htmlId": "table--interfaceipv6--f04ed02559", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "interface_ipv6", - "forwarding_enabled", - "hop_limit", - "interface", - "redirect_accept", - "rtadv_accept" - ], - "sectionRelativeRepoPath": "interface_ipv6", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/interface_ipv6.yml" - }, - { - "url": "/tables/iokit_devicetree", - "title": "iokit_devicetree", - "htmlId": "table--iokitdevicetree--b4caa7690f", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "iokit_devicetree", - "busy_state", - "class", - "depth", - "device_path", - "id", - "name", - "parent", - "retain_count", - "service" - ], - "sectionRelativeRepoPath": "iokit_devicetree", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iokit_devicetree.yml" - }, - { - "url": "/tables/iokit_registry", - "title": "iokit_registry", - "htmlId": "table--iokitregistry--ee42001e08", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "iokit_registry", - "busy_state", - "class", - "depth", - "id", - "name", - "parent", - "retain_count" - ], - "sectionRelativeRepoPath": "iokit_registry", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iokit_registry.yml" - }, - { - "url": "/tables/ioreg", - "title": "ioreg", - "htmlId": "table--ioreg--921f1dc312", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "ioreg", - "c", - "d", - "fullkey", - "k", - "key", - "n", - "p", - "parent", - "query", - "r", - "value" - ], - "sectionRelativeRepoPath": "ioreg", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ioreg.yml" - }, - { - "url": "/tables/iptables", - "title": "iptables", - "htmlId": "table--iptables--a5056bcc8b", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "iptables", - "bytes", - "chain", - "dst_ip", - "dst_mask", - "dst_port", - "filter_name", - "iniface", - "iniface_mask", - "match", - "outiface", - "outiface_mask", - "packets", - "policy", - "protocol", - "src_ip", - "src_mask", - "src_port", - "target" - ], - "sectionRelativeRepoPath": "iptables", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/iptables.yml" - }, - { - "url": "/tables/kernel_extensions", - "title": "kernel_extensions", - "htmlId": "table--kernelextensions--6d92f2c6f0", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "kernel_extensions", - "idx", - "linked_against", - "name", - "path", - "refs", - "size", - "version" - ], - "sectionRelativeRepoPath": "kernel_extensions", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_extensions.yml" - }, - { - "url": "/tables/kernel_info", - "title": "kernel_info", - "htmlId": "table--kernelinfo--c618a2f178", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "kernel_info", - "arguments", - "device", - "path", - "version" - ], - "sectionRelativeRepoPath": "kernel_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_info.yml" - }, - { - "url": "/tables/kernel_keys", - "title": "kernel_keys", - "htmlId": "table--kernelkeys--984dcf5650", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "kernel_keys", - "description", - "flags", - "gid", - "permissions", - "serial_number", - "timeout", - "type", - "uid", - "usage" - ], - "sectionRelativeRepoPath": "kernel_keys", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fkernel_keys.yml&value=name%3A%20kernel_keys%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/kernel_modules", - "title": "kernel_modules", - "htmlId": "table--kernelmodules--febe27dfbc", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "kernel_modules", - "address", - "name", - "size", - "status", - "used_by" - ], - "sectionRelativeRepoPath": "kernel_modules", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fkernel_modules.yml&value=name%3A%20kernel_modules%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/kernel_panics", - "title": "kernel_panics", - "htmlId": "table--kernelpanics--f98f88d76f", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "kernel_panics", - "dependencies", - "frame_backtrace", - "kernel_version", - "last_loaded", - "last_unloaded", - "module_backtrace", - "name", - "os_version", - "path", - "registers", - "system_model", - "time", - "uptime" - ], - "sectionRelativeRepoPath": "kernel_panics", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/kernel_panics.yml" - }, - { - "url": "/tables/keychain_acls", - "title": "keychain_acls", - "htmlId": "table--keychainacls--5882c68df9", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "keychain_acls", - "authorizations", - "description", - "keychain_path", - "label", - "path" - ], - "sectionRelativeRepoPath": "keychain_acls", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/keychain_acls.yml" - }, - { - "url": "/tables/keychain_items", - "title": "keychain_items", - "htmlId": "table--keychainitems--88ecbe05e7", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "keychain_items", - "account", - "comment", - "created", - "description", - "label", - "modified", - "path", - "pk_hash", - "type" - ], - "sectionRelativeRepoPath": "keychain_items", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/keychain_items.yml" - }, - { - "url": "/tables/known_hosts", - "title": "known_hosts", - "htmlId": "table--knownhosts--4a58922977", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "known_hosts", - "key", - "key_file", - "uid" - ], - "sectionRelativeRepoPath": "known_hosts", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/known_hosts.yml" - }, - { - "url": "/tables/kva_speculative_info", - "title": "kva_speculative_info", - "htmlId": "table--kvaspeculativeinfo--adfe134604", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "kva_speculative_info", - "bp_microcode_disabled", - "bp_mitigations", - "bp_system_pol_disabled", - "cpu_pred_cmd_supported", - "cpu_spec_ctrl_supported", - "ibrs_support_enabled", - "kva_shadow_enabled", - "kva_shadow_inv_pcid", - "kva_shadow_pcid", - "kva_shadow_user_global", - "stibp_support_enabled" - ], - "sectionRelativeRepoPath": "kva_speculative_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fkva_speculative_info.yml&value=name%3A%20kva_speculative_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/last", - "title": "last", - "htmlId": "table--last--28534934e6", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "last", - "host", - "pid", - "time", - "tty", - "type", - "type_name", - "username" - ], - "sectionRelativeRepoPath": "last", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/last.yml" - }, - { - "url": "/tables/launchd", - "title": "launchd", - "htmlId": "table--launchd--f247d85600", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "launchd", - "disabled", - "groupname", - "inetd_compatibility", - "keep_alive", - "label", - "name", - "on_demand", - "path", - "process_type", - "program", - "program_arguments", - "queue_directories", - "root_directory", - "run_at_load", - "start_interval", - "start_on_mount", - "stderr_path", - "stdout_path", - "username", - "watch_paths", - "working_directory" - ], - "sectionRelativeRepoPath": "launchd", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/launchd.yml" - }, - { - "url": "/tables/launchd_overrides", - "title": "launchd_overrides", - "htmlId": "table--launchdoverrides--dd07e94fee", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "launchd_overrides", - "key", - "label", - "path", - "uid", - "value" - ], - "sectionRelativeRepoPath": "launchd_overrides", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flaunchd_overrides.yml&value=name%3A%20launchd_overrides%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/listening_ports", - "title": "listening_ports", - "htmlId": "table--listeningports--d51c4032c8", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "listening_ports", - "address", - "family", - "fd", - "net_namespace", - "path", - "pid", - "port", - "protocol", - "socket" - ], - "sectionRelativeRepoPath": "listening_ports", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/listening_ports.yml" - }, - { - "url": "/tables/load_average", - "title": "load_average", - "htmlId": "table--loadaverage--90a074b9c2", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "load_average", - "average", - "period" - ], - "sectionRelativeRepoPath": "load_average", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/load_average.yml" - }, - { - "url": "/tables/location_services", - "title": "location_services", - "htmlId": "table--locationservices--75df8e45c4", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "location_services", - "enabled" - ], - "sectionRelativeRepoPath": "location_services", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/location_services.yml" - }, - { - "url": "/tables/logged_in_users", - "title": "logged_in_users", - "htmlId": "table--loggedinusers--7382490bc1", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "logged_in_users", - "host", - "pid", - "registry_hive", - "sid", - "time", - "tty", - "type", - "user" - ], - "sectionRelativeRepoPath": "logged_in_users", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/logged_in_users.yml" - }, - { - "url": "/tables/logical_drives", - "title": "logical_drives", - "htmlId": "table--logicaldrives--b1a4a1c6c1", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "logical_drives", - "boot_partition", - "description", - "device_id", - "file_system", - "free_space", - "size", - "type" - ], - "sectionRelativeRepoPath": "logical_drives", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flogical_drives.yml&value=name%3A%20logical_drives%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/logon_sessions", - "title": "logon_sessions", - "htmlId": "table--logonsessions--407c721831", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "logon_sessions", - "authentication_package", - "dns_domain_name", - "home_directory", - "home_directory_drive", - "logon_domain", - "logon_id", - "logon_script", - "logon_server", - "logon_sid", - "logon_time", - "logon_type", - "profile_path", - "session_id", - "upn", - "user" - ], - "sectionRelativeRepoPath": "logon_sessions", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flogon_sessions.yml&value=name%3A%20logon_sessions%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/lxd_certificates", - "title": "lxd_certificates", - "htmlId": "table--lxdcertificates--f4905dfe96", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "lxd_certificates", - "certificate", - "fingerprint", - "name", - "type" - ], - "sectionRelativeRepoPath": "lxd_certificates", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_certificates.yml&value=name%3A%20lxd_certificates%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/lxd_cluster", - "title": "lxd_cluster", - "htmlId": "table--lxdcluster--e830826c25", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "lxd_cluster", - "enabled", - "member_config_description", - "member_config_entity", - "member_config_key", - "member_config_name", - "member_config_value", - "server_name" - ], - "sectionRelativeRepoPath": "lxd_cluster", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_cluster.yml&value=name%3A%20lxd_cluster%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/lxd_cluster_members", - "title": "lxd_cluster_members", - "htmlId": "table--lxdclustermembers--ceb8aa7ccf", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "lxd_cluster_members", - "database", - "message", - "server_name", - "status", - "url" - ], - "sectionRelativeRepoPath": "lxd_cluster_members", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_cluster_members.yml&value=name%3A%20lxd_cluster_members%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/lxd_images", - "title": "lxd_images", - "htmlId": "table--lxdimages--2c5e205269", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "lxd_images", - "aliases", - "architecture", - "auto_update", - "cached", - "created_at", - "description", - "expires_at", - "filename", - "id", - "last_used_at", - "os", - "public", - "release", - "size", - "update_source_alias", - "update_source_certificate", - "update_source_protocol", - "update_source_server", - "uploaded_at" - ], - "sectionRelativeRepoPath": "lxd_images", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_images.yml&value=name%3A%20lxd_images%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/lxd_instance_config", - "title": "lxd_instance_config", - "htmlId": "table--lxdinstanceconfig--c470d51e8f", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "lxd_instance_config", - "key", - "name", - "value" - ], - "sectionRelativeRepoPath": "lxd_instance_config", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_instance_config.yml&value=name%3A%20lxd_instance_config%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/lxd_instance_devices", - "title": "lxd_instance_devices", - "htmlId": "table--lxdinstancedevices--0115618474", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "lxd_instance_devices", - "device", - "device_type", - "key", - "name", - "value" - ], - "sectionRelativeRepoPath": "lxd_instance_devices", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_instance_devices.yml&value=name%3A%20lxd_instance_devices%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/lxd_instances", - "title": "lxd_instances", - "htmlId": "table--lxdinstances--5a05be64a0", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "lxd_instances", - "architecture", - "base_image", - "created_at", - "description", - "ephemeral", - "name", - "os", - "pid", - "processes", - "stateful", - "status" - ], - "sectionRelativeRepoPath": "lxd_instances", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_instances.yml&value=name%3A%20lxd_instances%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/lxd_networks", - "title": "lxd_networks", - "htmlId": "table--lxdnetworks--718d71aced", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "lxd_networks", - "bytes_received", - "bytes_sent", - "hwaddr", - "ipv4_address", - "ipv6_address", - "managed", - "mtu", - "name", - "packets_received", - "packets_sent", - "state", - "type", - "used_by" - ], - "sectionRelativeRepoPath": "lxd_networks", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_networks.yml&value=name%3A%20lxd_networks%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/lxd_storage_pools", - "title": "lxd_storage_pools", - "htmlId": "table--lxdstoragepools--1cfcc8d26f", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "lxd_storage_pools", - "driver", - "inodes_total", - "inodes_used", - "name", - "size", - "source", - "space_total", - "space_used" - ], - "sectionRelativeRepoPath": "lxd_storage_pools", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Flxd_storage_pools.yml&value=name%3A%20lxd_storage_pools%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/macadmins_unified_log", - "title": "macadmins_unified_log", - "htmlId": "table--macadminsunifiedlog--38332f1c41", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "macadmins_unified_log", - "activity_identifier", - "boot_uuid", - "category", - "event_message", - "event_type", - "format_string", - "log_level", - "parent_activity_identifier", - "process_id", - "process_image_path", - "sender_image_path", - "sender_image_uuid", - "sender_program_counter", - "subsystem", - "thread_id", - "timestamp", - "trace_id" - ], - "sectionRelativeRepoPath": "macadmins_unified_log", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macadmins_unified_log.yml" - }, - { - "url": "/tables/macos_profiles", - "title": "macos_profiles", - "htmlId": "table--macosprofiles--7cc75ce911", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "macos_profiles", - "description", - "display_name", - "identifier", - "install_date", - "organization", - "type", - "uuid", - "verification_state" - ], - "sectionRelativeRepoPath": "macos_profiles", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_profiles.yml" - }, - { - "url": "/tables/macos_rsr", - "title": "macos_rsr", - "htmlId": "table--macosrsr--42f0c3ef94", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "macos_rsr", - "full_macos_version", - "macos_version", - "rsr_supported", - "rsr_version" - ], - "sectionRelativeRepoPath": "macos_rsr", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/macos_rsr.yml" - }, - { - "url": "/tables/magic", - "title": "magic", - "htmlId": "table--magic--aa3092ede4", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "magic", - "data", - "magic_db_files", - "mime_encoding", - "mime_type", - "path" - ], - "sectionRelativeRepoPath": "magic", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmagic.yml&value=name%3A%20magic%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/managed_policies", - "title": "managed_policies", - "htmlId": "table--managedpolicies--4f50f98371", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "managed_policies", - "domain", - "manual", - "name", - "username", - "uuid", - "value" - ], - "sectionRelativeRepoPath": "managed_policies", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/managed_policies.yml" - }, - { - "url": "/tables/md_devices", - "title": "md_devices", - "htmlId": "table--mddevices--ef8f1583c9", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "md_devices", - "active_disks", - "bitmap_chunk_size", - "bitmap_external_file", - "bitmap_on_mem", - "check_array_finish", - "check_array_progress", - "check_array_speed", - "chunk_size", - "device_name", - "failed_disks", - "nr_raid_disks", - "other", - "raid_disks", - "raid_level", - "recovery_finish", - "recovery_progress", - "recovery_speed", - "reshape_finish", - "reshape_progress", - "reshape_speed", - "resync_finish", - "resync_progress", - "resync_speed", - "size", - "spare_disks", - "status", - "superblock_state", - "superblock_update_time", - "superblock_version", - "unused_devices", - "working_disks" - ], - "sectionRelativeRepoPath": "md_devices", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmd_devices.yml&value=name%3A%20md_devices%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/md_drives", - "title": "md_drives", - "htmlId": "table--mddrives--3d3e5f0540", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "md_drives", - "drive_name", - "md_device_name", - "slot", - "state" - ], - "sectionRelativeRepoPath": "md_drives", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmd_drives.yml&value=name%3A%20md_drives%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/md_personalities", - "title": "md_personalities", - "htmlId": "table--mdpersonalities--08a9ccc7f6", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "md_personalities", - "name" - ], - "sectionRelativeRepoPath": "md_personalities", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmd_personalities.yml&value=name%3A%20md_personalities%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/mdfind", - "title": "mdfind", - "htmlId": "table--mdfind--b1e40bb209", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "mdfind", - "path", - "query" - ], - "sectionRelativeRepoPath": "mdfind", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmdfind.yml&value=name%3A%20mdfind%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/mdls", - "title": "mdls", - "htmlId": "table--mdls--e8e99e3ce4", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "mdls", - "key", - "path", - "value", - "valuetype" - ], - "sectionRelativeRepoPath": "mdls", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdls.yml" - }, - { - "url": "/tables/mdm", - "title": "mdm", - "htmlId": "table--mdm--80e3800ecb", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "mdm", - "access_rights", - "checkin_url", - "dep_capable", - "enrolled", - "has_scep_payload", - "identity_certificate_uuid", - "install_date", - "installed_from_dep", - "payload_identifier", - "server_url", - "sign_message", - "topic", - "user_approved" - ], - "sectionRelativeRepoPath": "mdm", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm.yml" - }, - { - "url": "/tables/mdm_bridge", - "title": "mdm_bridge", - "htmlId": "table--mdmbridge--7423cd106a", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "mdm_bridge", - "enrolled_user", - "enrollment_status", - "mdm_command_input", - "mdm_command_output", - "raw_mdm_command_output" - ], - "sectionRelativeRepoPath": "mdm_bridge", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mdm_bridge.yml" - }, - { - "url": "/tables/memory_array_mapped_addresses", - "title": "memory_array_mapped_addresses", - "htmlId": "table--memoryarraymappedaddresses--bb2ff310e9", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "memory_array_mapped_addresses", - "ending_address", - "handle", - "memory_array_handle", - "partition_width", - "starting_address" - ], - "sectionRelativeRepoPath": "memory_array_mapped_addresses", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_array_mapped_addresses.yml&value=name%3A%20memory_array_mapped_addresses%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/memory_arrays", - "title": "memory_arrays", - "htmlId": "table--memoryarrays--f1e4bec394", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "memory_arrays", - "handle", - "location", - "max_capacity", - "memory_error_correction", - "memory_error_info_handle", - "number_memory_devices", - "use" - ], - "sectionRelativeRepoPath": "memory_arrays", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_arrays.yml&value=name%3A%20memory_arrays%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/memory_device_mapped_addresses", - "title": "memory_device_mapped_addresses", - "htmlId": "table--memorydevicemappedaddresses--4fe77af2d6", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "memory_device_mapped_addresses", - "ending_address", - "handle", - "interleave_data_depth", - "interleave_position", - "memory_array_mapped_address_handle", - "memory_device_handle", - "partition_row_position", - "starting_address" - ], - "sectionRelativeRepoPath": "memory_device_mapped_addresses", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_device_mapped_addresses.yml&value=name%3A%20memory_device_mapped_addresses%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/memory_devices", - "title": "memory_devices", - "htmlId": "table--memorydevices--5354d4db11", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "memory_devices", - "array_handle", - "asset_tag", - "bank_locator", - "configured_clock_speed", - "configured_voltage", - "data_width", - "device_locator", - "form_factor", - "handle", - "manufacturer", - "max_speed", - "max_voltage", - "memory_type", - "memory_type_details", - "min_voltage", - "part_number", - "serial_number", - "set", - "size", - "total_width" - ], - "sectionRelativeRepoPath": "memory_devices", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_devices.yml&value=name%3A%20memory_devices%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/memory_error_info", - "title": "memory_error_info", - "htmlId": "table--memoryerrorinfo--bcdff56603", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "memory_error_info", - "device_error_address", - "error_granularity", - "error_operation", - "error_resolution", - "error_type", - "handle", - "memory_array_error_address", - "vendor_syndrome" - ], - "sectionRelativeRepoPath": "memory_error_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_error_info.yml&value=name%3A%20memory_error_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/memory_info", - "title": "memory_info", - "htmlId": "table--memoryinfo--82908af68f", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "memory_info", - "active", - "buffers", - "cached", - "inactive", - "memory_available", - "memory_free", - "memory_total", - "swap_cached", - "swap_free", - "swap_total" - ], - "sectionRelativeRepoPath": "memory_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_info.yml&value=name%3A%20memory_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/memory_map", - "title": "memory_map", - "htmlId": "table--memorymap--e25236245e", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "memory_map", - "end", - "name", - "start" - ], - "sectionRelativeRepoPath": "memory_map", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmemory_map.yml&value=name%3A%20memory_map%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/mounts", - "title": "mounts", - "htmlId": "table--mounts--b925aef9c1", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "mounts", - "blocks", - "blocks_available", - "blocks_free", - "blocks_size", - "device", - "device_alias", - "flags", - "inodes", - "inodes_free", - "path", - "type" - ], - "sectionRelativeRepoPath": "mounts", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/mounts.yml" - }, - { - "url": "/tables/msr", - "title": "msr", - "htmlId": "table--msr--00632263e3", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "msr", - "feature_control", - "perf_ctl", - "perf_status", - "platform_info", - "processor_number", - "rapl_energy_status", - "rapl_power_limit", - "rapl_power_units", - "turbo_disabled", - "turbo_ratio_limit" - ], - "sectionRelativeRepoPath": "msr", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fmsr.yml&value=name%3A%20msr%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/munki_info", - "title": "munki_info", - "htmlId": "table--munkiinfo--b212c1e8ba", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "munki_info", - "console_user", - "end_time", - "errors", - "manifest_name", - "problem_installs", - "start_time", - "success", - "version", - "warnings" - ], - "sectionRelativeRepoPath": "munki_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_info.yml" - }, - { - "url": "/tables/munki_installs", - "title": "munki_installs", - "htmlId": "table--munkiinstalls--9a5361020e", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "munki_installs", - "end_time", - "installed", - "installed_version", - "name" - ], - "sectionRelativeRepoPath": "munki_installs", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/munki_installs.yml" - }, - { - "url": "/tables/network_interfaces", - "title": "network_interfaces", - "htmlId": "table--networkinterfaces--90c47da90a", - "evented": false, - "platforms": [ - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "network_interfaces", - "ipv4", - "ipv6", - "mac" - ], - "sectionRelativeRepoPath": "network_interfaces", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/network_interfaces.yml" - }, - { - "url": "/tables/nfs_shares", - "title": "nfs_shares", - "htmlId": "table--nfsshares--8c50936f16", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "nfs_shares", - "options", - "readonly", - "share" - ], - "sectionRelativeRepoPath": "nfs_shares", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nfs_shares.yml" - }, - { - "url": "/tables/nftables", - "title": "nftables", - "htmlId": "table--nftables--b937d8c4ff", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "nftables", - "fullkey", - "key", - "parent", - "query", - "value" - ], - "sectionRelativeRepoPath": "nftables", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nftables.yml" - }, - { - "url": "/tables/npm_packages", - "title": "npm_packages", - "htmlId": "table--npmpackages--60cc5ee234", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "npm_packages", - "author", - "description", - "directory", - "homepage", - "license", - "mount_namespace_id", - "name", - "path", - "pid_with_namespace", - "version" - ], - "sectionRelativeRepoPath": "npm_packages", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/npm_packages.yml" - }, - { - "url": "/tables/ntdomains", - "title": "ntdomains", - "htmlId": "table--ntdomains--c8c182e7af", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "ntdomains", - "client_site_name", - "dc_site_name", - "dns_forest_name", - "domain_controller_address", - "domain_controller_name", - "domain_name", - "name", - "status" - ], - "sectionRelativeRepoPath": "ntdomains", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ntdomains.yml" - }, - { - "url": "/tables/ntfs_acl_permissions", - "title": "ntfs_acl_permissions", - "htmlId": "table--ntfsaclpermissions--689eaf130f", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "ntfs_acl_permissions", - "access", - "inherited_from", - "path", - "principal", - "type" - ], - "sectionRelativeRepoPath": "ntfs_acl_permissions", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fntfs_acl_permissions.yml&value=name%3A%20ntfs_acl_permissions%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/ntfs_journal_events", - "title": "ntfs_journal_events", - "htmlId": "table--ntfsjournalevents--478da24aae", - "evented": true, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "ntfs_journal_events", - "action", - "category", - "drive_letter", - "eid", - "file_attributes", - "node_ref_number", - "old_path", - "parent_ref_number", - "partial", - "path", - "record_timestamp", - "record_usn", - "time" - ], - "sectionRelativeRepoPath": "ntfs_journal_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fntfs_journal_events.yml&value=name%3A%20ntfs_journal_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/nvram", - "title": "nvram", - "htmlId": "table--nvram--f3b9191fd9", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "nvram", - "name", - "type", - "value" - ], - "sectionRelativeRepoPath": "nvram", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nvram.yml" - }, - { - "url": "/tables/nvram_info", - "title": "nvram_info", - "htmlId": "table--nvraminfo--35b2b0f859", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "nvram_info", - "amfi_enabled" - ], - "sectionRelativeRepoPath": "nvram_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/nvram_info.yml" - }, - { - "url": "/tables/oem_strings", - "title": "oem_strings", - "htmlId": "table--oemstrings--cdb0ad5941", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "oem_strings", - "handle", - "number", - "value" - ], - "sectionRelativeRepoPath": "oem_strings", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Foem_strings.yml&value=name%3A%20oem_strings%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/office_mru", - "title": "office_mru", - "htmlId": "table--officemru--f544059b5a", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "office_mru", - "application", - "last_opened_time", - "path", - "sid", - "version" - ], - "sectionRelativeRepoPath": "office_mru", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Foffice_mru.yml&value=name%3A%20office_mru%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/orbit_info", - "title": "orbit_info", - "htmlId": "table--orbitinfo--16617a7b98", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "orbit_info", - "desktop_channel", - "desktop_version", - "device_auth_token", - "enrolled", - "last_recorded_error", - "orbit_channel", - "osqueryd_channel", - "scripts_enabled", - "uptime", - "version" - ], - "sectionRelativeRepoPath": "orbit_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/orbit_info.yml" - }, - { - "url": "/tables/os_version", - "title": "os_version", - "htmlId": "table--osversion--1d5c6d9a8d", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows", - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "os_version", - "arch", - "build", - "codename", - "extra", - "install_date", - "major", - "minor", - "mount_namespace_id", - "name", - "patch", - "pid_with_namespace", - "platform", - "platform_like", - "revision", - "version" - ], - "sectionRelativeRepoPath": "os_version", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/os_version.yml" - }, - { - "url": "/tables/osquery_events", - "title": "osquery_events", - "htmlId": "table--osqueryevents--df9fd8253e", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "osquery_events", - "active", - "events", - "name", - "publisher", - "refreshes", - "subscriptions", - "type" - ], - "sectionRelativeRepoPath": "osquery_events", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_events.yml" - }, - { - "url": "/tables/osquery_extensions", - "title": "osquery_extensions", - "htmlId": "table--osqueryextensions--a545584527", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "osquery_extensions", - "name", - "path", - "sdk_version", - "type", - "uuid", - "version" - ], - "sectionRelativeRepoPath": "osquery_extensions", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_extensions.yml" - }, - { - "url": "/tables/osquery_flags", - "title": "osquery_flags", - "htmlId": "table--osqueryflags--5b6a279c33", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "osquery_flags", - "default_value", - "description", - "name", - "shell_only", - "type", - "value" - ], - "sectionRelativeRepoPath": "osquery_flags", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_flags.yml" - }, - { - "url": "/tables/osquery_info", - "title": "osquery_info", - "htmlId": "table--osqueryinfo--dc3652a959", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux", - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "osquery_info", - "build_distro", - "build_platform", - "config_hash", - "config_valid", - "extensions", - "instance_id", - "pid", - "platform_mask", - "start_time", - "uuid", - "version", - "watcher" - ], - "sectionRelativeRepoPath": "osquery_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_info.yml" - }, - { - "url": "/tables/osquery_packs", - "title": "osquery_packs", - "htmlId": "table--osquerypacks--2c039d7ac9", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "osquery_packs", - "active", - "discovery_cache_hits", - "discovery_executions", - "name", - "platform", - "shard", - "version" - ], - "sectionRelativeRepoPath": "osquery_packs", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_packs.yml" - }, - { - "url": "/tables/osquery_registry", - "title": "osquery_registry", - "htmlId": "table--osqueryregistry--897c7454d4", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "osquery_registry", - "active", - "internal", - "name", - "owner_uuid", - "registry" - ], - "sectionRelativeRepoPath": "osquery_registry", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_registry.yml" - }, - { - "url": "/tables/osquery_schedule", - "title": "osquery_schedule", - "htmlId": "table--osqueryschedule--b083d81447", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "osquery_schedule", - "average_memory", - "denylisted", - "executions", - "interval", - "last_executed", - "last_memory", - "last_system_time", - "last_user_time", - "last_wall_time_ms", - "name", - "output_size", - "query", - "system_time", - "user_time", - "wall_time", - "wall_time_ms" - ], - "sectionRelativeRepoPath": "osquery_schedule", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/osquery_schedule.yml" - }, - { - "url": "/tables/package_bom", - "title": "package_bom", - "htmlId": "table--packagebom--9ed683d0d3", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "package_bom", - "filepath", - "gid", - "mode", - "modified_time", - "path", - "size", - "uid" - ], - "sectionRelativeRepoPath": "package_bom", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_bom.yml" - }, - { - "url": "/tables/package_install_history", - "title": "package_install_history", - "htmlId": "table--packageinstallhistory--fed77305b8", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "package_install_history", - "content_type", - "name", - "package_id", - "source", - "time", - "version" - ], - "sectionRelativeRepoPath": "package_install_history", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_install_history.yml" - }, - { - "url": "/tables/package_receipts", - "title": "package_receipts", - "htmlId": "table--packagereceipts--a5f589320c", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "package_receipts", - "install_time", - "installer_name", - "location", - "package_filename", - "package_id", - "path", - "version" - ], - "sectionRelativeRepoPath": "package_receipts", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/package_receipts.yml" - }, - { - "url": "/tables/parse_ini", - "title": "parse_ini", - "htmlId": "table--parseini--a63a77fbe6", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "parse_ini", - "fullkey", - "key", - "parent", - "path", - "value" - ], - "sectionRelativeRepoPath": "parse_ini", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_ini.yml" - }, - { - "url": "/tables/parse_json", - "title": "parse_json", - "htmlId": "table--parsejson--b12b8e8bb3", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "parse_json", - "fullkey", - "key", - "parent", - "path", - "value" - ], - "sectionRelativeRepoPath": "parse_json", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_json.yml" - }, - { - "url": "/tables/parse_jsonl", - "title": "parse_jsonl", - "htmlId": "table--parsejsonl--6aeab2ee4d", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "parse_jsonl", - "fullkey", - "key", - "parent", - "path", - "value" - ], - "sectionRelativeRepoPath": "parse_jsonl", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_jsonl.yml" - }, - { - "url": "/tables/parse_xml", - "title": "parse_xml", - "htmlId": "table--parsexml--10459b2ecf", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "parse_xml", - "fullkey", - "key", - "parent", - "path", - "value" - ], - "sectionRelativeRepoPath": "parse_xml", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/parse_xml.yml" - }, - { - "url": "/tables/password_policy", - "title": "password_policy", - "htmlId": "table--passwordpolicy--cf2e8ac910", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "password_policy", - "policy_content", - "policy_description", - "policy_identifier", - "uid" - ], - "sectionRelativeRepoPath": "password_policy", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/password_policy.yml" - }, - { - "url": "/tables/patches", - "title": "patches", - "htmlId": "table--patches--51b7b9ee8b", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "patches", - "caption", - "csname", - "description", - "fix_comments", - "hotfix_id", - "install_date", - "installed_by", - "installed_on" - ], - "sectionRelativeRepoPath": "patches", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/patches.yml" - }, - { - "url": "/tables/pci_devices", - "title": "pci_devices", - "htmlId": "table--pcidevices--fe5bc03f6b", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "pci_devices", - "driver", - "model", - "model_id", - "pci_class", - "pci_class_id", - "pci_slot", - "pci_subclass", - "pci_subclass_id", - "subsystem_model", - "subsystem_model_id", - "subsystem_vendor", - "subsystem_vendor_id", - "vendor", - "vendor_id" - ], - "sectionRelativeRepoPath": "pci_devices", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pci_devices.yml" - }, - { - "url": "/tables/physical_disk_performance", - "title": "physical_disk_performance", - "htmlId": "table--physicaldiskperformance--08429f390c", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "physical_disk_performance", - "avg_disk_bytes_per_read", - "avg_disk_bytes_per_write", - "avg_disk_read_queue_length", - "avg_disk_sec_per_read", - "avg_disk_sec_per_write", - "avg_disk_write_queue_length", - "current_disk_queue_length", - "name", - "percent_disk_read_time", - "percent_disk_time", - "percent_disk_write_time", - "percent_idle_time" - ], - "sectionRelativeRepoPath": "physical_disk_performance", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fphysical_disk_performance.yml&value=name%3A%20physical_disk_performance%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/pipes", - "title": "pipes", - "htmlId": "table--pipes--8bfc968443", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "pipes", - "flags", - "instances", - "max_instances", - "name", - "pid" - ], - "sectionRelativeRepoPath": "pipes", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pipes.yml" - }, - { - "url": "/tables/platform_info", - "title": "platform_info", - "htmlId": "table--platforminfo--dc99fd50a7", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "platform_info", - "address", - "date", - "extra", - "firmware_type", - "revision", - "size", - "vendor", - "version", - "volume_size" - ], - "sectionRelativeRepoPath": "platform_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/platform_info.yml" - }, - { - "url": "/tables/plist", - "title": "plist", - "htmlId": "table--plist--298778c63f", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "plist", - "key", - "path", - "subkey", - "value" - ], - "sectionRelativeRepoPath": "plist", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/plist.yml" - }, - { - "url": "/tables/pmset", - "title": "pmset", - "htmlId": "table--pmset--89e3b6e6fe", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "pmset", - "getting", - "json_result" - ], - "sectionRelativeRepoPath": "pmset", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pmset.yml" - }, - { - "url": "/tables/portage_keywords", - "title": "portage_keywords", - "htmlId": "table--portagekeywords--272edb0eff", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "portage_keywords", - "keyword", - "mask", - "package", - "unmask", - "version" - ], - "sectionRelativeRepoPath": "portage_keywords", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fportage_keywords.yml&value=name%3A%20portage_keywords%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/portage_packages", - "title": "portage_packages", - "htmlId": "table--portagepackages--d3dce49932", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "portage_packages", - "build_time", - "eapi", - "package", - "repository", - "size", - "slot", - "version", - "world" - ], - "sectionRelativeRepoPath": "portage_packages", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fportage_packages.yml&value=name%3A%20portage_packages%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/portage_use", - "title": "portage_use", - "htmlId": "table--portageuse--37db25dd6e", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "portage_use", - "package", - "use", - "version" - ], - "sectionRelativeRepoPath": "portage_use", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fportage_use.yml&value=name%3A%20portage_use%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/power_sensors", - "title": "power_sensors", - "htmlId": "table--powersensors--3da04e685d", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "power_sensors", - "category", - "key", - "name", - "value" - ], - "sectionRelativeRepoPath": "power_sensors", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/power_sensors.yml" - }, - { - "url": "/tables/powershell_events", - "title": "powershell_events", - "htmlId": "table--powershellevents--fc7237769d", - "evented": true, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "powershell_events", - "cosine_similarity", - "datetime", - "script_block_count", - "script_block_id", - "script_name", - "script_path", - "script_text", - "time" - ], - "sectionRelativeRepoPath": "powershell_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fpowershell_events.yml&value=name%3A%20powershell_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/preferences", - "title": "preferences", - "htmlId": "table--preferences--e75a728511", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "preferences", - "domain", - "forced", - "host", - "key", - "subkey", - "username", - "value" - ], - "sectionRelativeRepoPath": "preferences", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/preferences.yml" - }, - { - "url": "/tables/prefetch", - "title": "prefetch", - "htmlId": "table--prefetch--453fbf013a", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "prefetch", - "accessed_directories", - "accessed_directories_count", - "accessed_files", - "accessed_files_count", - "filename", - "hash", - "last_run_time", - "other_run_times", - "path", - "run_count", - "size", - "volume_creation", - "volume_serial" - ], - "sectionRelativeRepoPath": "prefetch", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprefetch.yml&value=name%3A%20prefetch%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/privacy_preferences", - "title": "privacy_preferences", - "htmlId": "table--privacypreferences--7b06d84dd1", - "evented": false, - "platforms": [ - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "privacy_preferences", - "ad_measurement_enabled", - "autofill_address_enabled", - "autofill_credit_card_enabled", - "autofill_enabled", - "do_not_track_enabled", - "fledge_enabled", - "hyperlink_auditing_enabled", - "network_prediction_enabled", - "privacy_sandbox_enabled", - "protected_content_enabled", - "referrers_enabled", - "safe_browsing_enabled", - "safe_browsing_extended_reporting_enabled", - "save_passwords_enabled", - "search_suggest_enabled", - "spelling_service_enabled", - "third_party_cookies_allowed", - "topics_enabled", - "translation_service_enabled", - "web_rtc_ip_handling_policy" - ], - "sectionRelativeRepoPath": "privacy_preferences", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/privacy_preferences.yml" - }, - { - "url": "/tables/process_envs", - "title": "process_envs", - "htmlId": "table--processenvs--6652489264", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "process_envs", - "key", - "pid", - "value" - ], - "sectionRelativeRepoPath": "process_envs", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_envs.yml" - }, - { - "url": "/tables/process_etw_events", - "title": "process_etw_events", - "htmlId": "table--processetwevents--209331c6a0", - "evented": true, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "process_etw_events", - "cmdline", - "datetime", - "eid", - "exit_code", - "flags", - "header_pid", - "mandatory_label", - "parent_process_sequence_number", - "path", - "pid", - "ppid", - "process_sequence_number", - "session_id", - "time", - "time_windows", - "token_elevation_status", - "token_elevation_type", - "type", - "username" - ], - "sectionRelativeRepoPath": "process_etw_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_etw_events.yml&value=name%3A%20process_etw_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/process_events", - "title": "process_events", - "htmlId": "table--processevents--ad0c5ef7a0", - "evented": true, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "process_events", - "atime", - "auid", - "btime", - "cmdline", - "cmdline_size", - "ctime", - "cwd", - "egid", - "eid", - "env", - "env_count", - "env_size", - "euid", - "fsgid", - "fsuid", - "gid", - "mode", - "mtime", - "overflows", - "owner_gid", - "owner_uid", - "parent", - "path", - "pid", - "sgid", - "status", - "suid", - "syscall", - "time", - "uid", - "uptime" - ], - "sectionRelativeRepoPath": "process_events", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_events.yml" - }, - { - "url": "/tables/process_file_events", - "title": "process_file_events", - "htmlId": "table--processfileevents--18c555fe80", - "evented": true, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "process_file_events", - "auid", - "cwd", - "dest_path", - "egid", - "eid", - "euid", - "executable", - "fsgid", - "fsuid", - "gid", - "operation", - "partial", - "path", - "pid", - "ppid", - "sgid", - "suid", - "time", - "uid", - "uptime" - ], - "sectionRelativeRepoPath": "process_file_events", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_file_events.yml" - }, - { - "url": "/tables/process_memory_map", - "title": "process_memory_map", - "htmlId": "table--processmemorymap--84fa47d61c", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "process_memory_map", - "device", - "end", - "inode", - "offset", - "path", - "permissions", - "pid", - "pseudo", - "start" - ], - "sectionRelativeRepoPath": "process_memory_map", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_memory_map.yml" - }, - { - "url": "/tables/process_namespaces", - "title": "process_namespaces", - "htmlId": "table--processnamespaces--8b20ff20ba", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "process_namespaces", - "cgroup_namespace", - "ipc_namespace", - "mnt_namespace", - "net_namespace", - "pid", - "pid_namespace", - "user_namespace", - "uts_namespace" - ], - "sectionRelativeRepoPath": "process_namespaces", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_namespaces.yml&value=name%3A%20process_namespaces%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/process_open_files", - "title": "process_open_files", - "htmlId": "table--processopenfiles--d400c1e606", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "process_open_files", - "fd", - "path", - "pid" - ], - "sectionRelativeRepoPath": "process_open_files", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_open_files.yml" - }, - { - "url": "/tables/process_open_pipes", - "title": "process_open_pipes", - "htmlId": "table--processopenpipes--94719aab4e", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "process_open_pipes", - "fd", - "inode", - "mode", - "partner_fd", - "partner_mode", - "partner_pid", - "pid", - "type" - ], - "sectionRelativeRepoPath": "process_open_pipes", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprocess_open_pipes.yml&value=name%3A%20process_open_pipes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/process_open_sockets", - "title": "process_open_sockets", - "htmlId": "table--processopensockets--e163b1f60b", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "process_open_sockets", - "family", - "fd", - "local_address", - "local_port", - "net_namespace", - "path", - "pid", - "protocol", - "remote_address", - "remote_port", - "socket", - "state" - ], - "sectionRelativeRepoPath": "process_open_sockets", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/process_open_sockets.yml" - }, - { - "url": "/tables/processes", - "title": "processes", - "htmlId": "table--processes--a3dfddcd52", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "processes", - "cgroup_path", - "cmdline", - "cpu_subtype", - "cpu_type", - "cwd", - "disk_bytes_read", - "disk_bytes_written", - "egid", - "elapsed_time", - "elevated_token", - "euid", - "gid", - "handle_count", - "name", - "nice", - "on_disk", - "parent", - "path", - "percent_processor_time", - "pgroup", - "pid", - "protection_type", - "resident_size", - "root", - "secure_process", - "sgid", - "start_time", - "state", - "suid", - "system_time", - "threads", - "total_size", - "translated", - "uid", - "upid", - "uppid", - "user_time", - "virtual_process", - "wired_size" - ], - "sectionRelativeRepoPath": "processes", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/processes.yml" - }, - { - "url": "/tables/programs", - "title": "programs", - "htmlId": "table--programs--bd20b1c857", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "programs", - "identifying_number", - "install_date", - "install_location", - "install_source", - "language", - "name", - "publisher", - "uninstall_string", - "version" - ], - "sectionRelativeRepoPath": "programs", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/programs.yml" - }, - { - "url": "/tables/prometheus_metrics", - "title": "prometheus_metrics", - "htmlId": "table--prometheusmetrics--810cfe9c1f", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "prometheus_metrics", - "metric_name", - "metric_value", - "target_name", - "timestamp_ms" - ], - "sectionRelativeRepoPath": "prometheus_metrics", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fprometheus_metrics.yml&value=name%3A%20prometheus_metrics%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/puppet_info", - "title": "puppet_info", - "htmlId": "table--puppetinfo--9c28500bf5", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "puppet_info", - "cached_catalog_status", - "catalog_uuid", - "code_id", - "configuration_version", - "corrective_change", - "environment", - "host", - "kind", - "master_used", - "noop", - "noop_pending", - "puppet_version", - "report_format", - "status", - "time", - "transaction_completed", - "transaction_uuid" - ], - "sectionRelativeRepoPath": "puppet_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_info.yml" - }, - { - "url": "/tables/puppet_logs", - "title": "puppet_logs", - "htmlId": "table--puppetlogs--1bb88be1ec", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "puppet_logs", - "file", - "level", - "line", - "message", - "source", - "time" - ], - "sectionRelativeRepoPath": "puppet_logs", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_logs.yml" - }, - { - "url": "/tables/puppet_state", - "title": "puppet_state", - "htmlId": "table--puppetstate--7ea179db18", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "puppet_state", - "change_count", - "changed", - "corrective_change", - "evaluation_time", - "failed", - "file", - "line", - "out_of_sync", - "out_of_sync_count", - "resource", - "resource_type", - "skipped", - "title" - ], - "sectionRelativeRepoPath": "puppet_state", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/puppet_state.yml" - }, - { - "url": "/tables/pwd_policy", - "title": "pwd_policy", - "htmlId": "table--pwdpolicy--a8d277dc32", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "pwd_policy", - "days_to_expiration", - "expires_every_n_days", - "history_depth", - "max_failed_attempts", - "min_mixed_case_characters" - ], - "sectionRelativeRepoPath": "pwd_policy", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/pwd_policy.yml" - }, - { - "url": "/tables/python_packages", - "title": "python_packages", - "htmlId": "table--pythonpackages--3418965b2d", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "python_packages", - "author", - "directory", - "license", - "name", - "path", - "pid_with_namespace", - "summary", - "version" - ], - "sectionRelativeRepoPath": "python_packages", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/python_packages.yml" - }, - { - "url": "/tables/quicklook_cache", - "title": "quicklook_cache", - "htmlId": "table--quicklookcache--bbd52f27e6", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "quicklook_cache", - "cache_path", - "fs_id", - "hit_count", - "icon_mode", - "inode", - "label", - "last_hit_date", - "mtime", - "path", - "rowid", - "size", - "volume_id" - ], - "sectionRelativeRepoPath": "quicklook_cache", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fquicklook_cache.yml&value=name%3A%20quicklook_cache%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/registry", - "title": "registry", - "htmlId": "table--registry--1dd369b263", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "registry", - "data", - "key", - "mtime", - "name", - "path", - "type" - ], - "sectionRelativeRepoPath": "registry", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/registry.yml" - }, - { - "url": "/tables/routes", - "title": "routes", - "htmlId": "table--routes--e1f3ee7062", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "routes", - "destination", - "flags", - "gateway", - "hopcount", - "interface", - "metric", - "mtu", - "netmask", - "source", - "type" - ], - "sectionRelativeRepoPath": "routes", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/routes.yml" - }, - { - "url": "/tables/rpm_package_files", - "title": "rpm_package_files", - "htmlId": "table--rpmpackagefiles--987985a5f0", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "rpm_package_files", - "groupname", - "mode", - "package", - "path", - "sha256", - "size", - "username" - ], - "sectionRelativeRepoPath": "rpm_package_files", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Frpm_package_files.yml&value=name%3A%20rpm_package_files%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/rpm_packages", - "title": "rpm_packages", - "htmlId": "table--rpmpackages--b5248f26ae", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "rpm_packages", - "arch", - "epoch", - "install_time", - "mount_namespace_id", - "name", - "package_group", - "pid_with_namespace", - "release", - "sha1", - "size", - "source", - "vendor", - "version" - ], - "sectionRelativeRepoPath": "rpm_packages", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/rpm_packages.yml" - }, - { - "url": "/tables/running_apps", - "title": "running_apps", - "htmlId": "table--runningapps--cd6ead8455", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "running_apps", - "bundle_identifier", - "is_active", - "pid" - ], - "sectionRelativeRepoPath": "running_apps", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/running_apps.yml" - }, - { - "url": "/tables/safari_extensions", - "title": "safari_extensions", - "htmlId": "table--safariextensions--6250d10adf", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "safari_extensions", - "author", - "bundle_version", - "copyright", - "description", - "developer_id", - "extension_type", - "identifier", - "name", - "path", - "sdk", - "uid", - "update_url", - "version" - ], - "sectionRelativeRepoPath": "safari_extensions", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/safari_extensions.yml" - }, - { - "url": "/tables/sandboxes", - "title": "sandboxes", - "htmlId": "table--sandboxes--4dfe5fde32", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "sandboxes", - "build_id", - "bundle_path", - "enabled", - "label", - "path", - "user" - ], - "sectionRelativeRepoPath": "sandboxes", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsandboxes.yml&value=name%3A%20sandboxes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/scheduled_tasks", - "title": "scheduled_tasks", - "htmlId": "table--scheduledtasks--9f6fd172c3", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "scheduled_tasks", - "action", - "enabled", - "hidden", - "last_run_code", - "last_run_message", - "last_run_time", - "name", - "next_run_time", - "path", - "state" - ], - "sectionRelativeRepoPath": "scheduled_tasks", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/scheduled_tasks.yml" - }, - { - "url": "/tables/screenlock", - "title": "screenlock", - "htmlId": "table--screenlock--ad6884fb04", - "evented": false, - "platforms": [ - "darwin", - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "screenlock", - "enabled", - "grace_period" - ], - "sectionRelativeRepoPath": "screenlock", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/screenlock.yml" - }, - { - "url": "/tables/seccomp_events", - "title": "seccomp_events", - "htmlId": "table--seccompevents--746b10d1fe", - "evented": true, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "seccomp_events", - "arch", - "auid", - "code", - "comm", - "compat", - "exe", - "gid", - "ip", - "pid", - "ses", - "sig", - "syscall", - "time", - "uid", - "uptime" - ], - "sectionRelativeRepoPath": "seccomp_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fseccomp_events.yml&value=name%3A%20seccomp_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/secureboot", - "title": "secureboot", - "htmlId": "table--secureboot--2fdb69f2da", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "secureboot", - "description", - "kernel_extensions", - "mdm_operations", - "secure_boot", - "secure_mode", - "setup_mode" - ], - "sectionRelativeRepoPath": "secureboot", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/secureboot.yml" - }, - { - "url": "/tables/security_profile_info", - "title": "security_profile_info", - "htmlId": "table--securityprofileinfo--66379dbd45", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "security_profile_info", - "audit_account_logon", - "audit_account_manage", - "audit_ds_access", - "audit_logon_events", - "audit_object_access", - "audit_policy_change", - "audit_privilege_use", - "audit_process_tracking", - "audit_system_events", - "clear_text_password", - "enable_admin_account", - "enable_guest_account", - "force_logoff_when_expire", - "lockout_bad_count", - "logon_to_change_password", - "lsa_anonymous_name_lookup", - "maximum_password_age", - "minimum_password_age", - "minimum_password_length", - "new_administrator_name", - "new_guest_name", - "password_complexity", - "password_history_size" - ], - "sectionRelativeRepoPath": "security_profile_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsecurity_profile_info.yml&value=name%3A%20security_profile_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/selinux_events", - "title": "selinux_events", - "htmlId": "table--selinuxevents--2da3fa9426", - "evented": true, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "selinux_events", - "eid", - "message", - "time", - "type", - "uptime" - ], - "sectionRelativeRepoPath": "selinux_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fselinux_events.yml&value=name%3A%20selinux_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/selinux_settings", - "title": "selinux_settings", - "htmlId": "table--selinuxsettings--00d49fe417", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "selinux_settings", - "key", - "scope", - "value" - ], - "sectionRelativeRepoPath": "selinux_settings", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fselinux_settings.yml&value=name%3A%20selinux_settings%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/services", - "title": "services", - "htmlId": "table--services--7fd725a72c", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "services", - "description", - "display_name", - "module_path", - "name", - "path", - "pid", - "service_exit_code", - "service_type", - "start_type", - "status", - "user_account", - "win32_exit_code" - ], - "sectionRelativeRepoPath": "services", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fservices.yml&value=name%3A%20services%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/shadow", - "title": "shadow", - "htmlId": "table--shadow--600e9768a3", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "shadow", - "expire", - "flag", - "hash_alg", - "inactive", - "last_change", - "max", - "min", - "password_status", - "username", - "warning" - ], - "sectionRelativeRepoPath": "shadow", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fshadow.yml&value=name%3A%20shadow%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/shared_folders", - "title": "shared_folders", - "htmlId": "table--sharedfolders--80d9e4dd57", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "shared_folders", - "name", - "path" - ], - "sectionRelativeRepoPath": "shared_folders", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shared_folders.yml" - }, - { - "url": "/tables/shared_memory", - "title": "shared_memory", - "htmlId": "table--sharedmemory--03832cd7cc", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "shared_memory", - "atime", - "attached", - "creator_pid", - "creator_uid", - "ctime", - "dtime", - "locked", - "owner_uid", - "permissions", - "pid", - "shmid", - "size", - "status" - ], - "sectionRelativeRepoPath": "shared_memory", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fshared_memory.yml&value=name%3A%20shared_memory%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/shared_resources", - "title": "shared_resources", - "htmlId": "table--sharedresources--eb38ecd1f2", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "shared_resources", - "allow_maximum", - "description", - "install_date", - "maximum_allowed", - "name", - "path", - "status", - "type", - "type_name" - ], - "sectionRelativeRepoPath": "shared_resources", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shared_resources.yml" - }, - { - "url": "/tables/sharing_preferences", - "title": "sharing_preferences", - "htmlId": "table--sharingpreferences--9f16698fa4", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "sharing_preferences", - "bluetooth_sharing", - "content_caching", - "disc_sharing", - "file_sharing", - "internet_sharing", - "printer_sharing", - "remote_apple_events", - "remote_login", - "remote_management", - "screen_sharing" - ], - "sectionRelativeRepoPath": "sharing_preferences", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sharing_preferences.yml" - }, - { - "url": "/tables/shell_history", - "title": "shell_history", - "htmlId": "table--shellhistory--dc2e14c01c", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "shell_history", - "command", - "history_file", - "time", - "uid" - ], - "sectionRelativeRepoPath": "shell_history", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shell_history.yml" - }, - { - "url": "/tables/shellbags", - "title": "shellbags", - "htmlId": "table--shellbags--c0e6d5a169", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "shellbags", - "accessed_time", - "created_time", - "mft_entry", - "mft_sequence", - "modified_time", - "path", - "sid", - "source" - ], - "sectionRelativeRepoPath": "shellbags", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fshellbags.yml&value=name%3A%20shellbags%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/shimcache", - "title": "shimcache", - "htmlId": "table--shimcache--bbe2a80661", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "shimcache", - "entry", - "execution_flag", - "modified_time", - "path" - ], - "sectionRelativeRepoPath": "shimcache", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/shimcache.yml" - }, - { - "url": "/tables/signature", - "title": "signature", - "htmlId": "table--signature--5b4399a6ce", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "signature", - "arch", - "authority", - "cdhash", - "hash_resources", - "identifier", - "path", - "signed", - "team_identifier" - ], - "sectionRelativeRepoPath": "signature", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/signature.yml" - }, - { - "url": "/tables/sip_config", - "title": "sip_config", - "htmlId": "table--sipconfig--2a1b4b38a7", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "sip_config", - "config_flag", - "enabled", - "enabled_nvram" - ], - "sectionRelativeRepoPath": "sip_config", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sip_config.yml" - }, - { - "url": "/tables/smbios_tables", - "title": "smbios_tables", - "htmlId": "table--smbiostables--e819efcca9", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "smbios_tables", - "description", - "handle", - "header_size", - "md5", - "number", - "size", - "type" - ], - "sectionRelativeRepoPath": "smbios_tables", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/smbios_tables.yml" - }, - { - "url": "/tables/smc_keys", - "title": "smc_keys", - "htmlId": "table--smckeys--1093645ab1", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "smc_keys", - "hidden", - "key", - "size", - "type", - "value" - ], - "sectionRelativeRepoPath": "smc_keys", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/smc_keys.yml" - }, - { - "url": "/tables/sntp_request", - "title": "sntp_request", - "htmlId": "table--sntprequest--90e80230b2", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "sntp_request", - "clock_offset_ms", - "server", - "timestamp_ms" - ], - "sectionRelativeRepoPath": "sntp_request", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sntp_request.yml" - }, - { - "url": "/tables/socket_events", - "title": "socket_events", - "htmlId": "table--socketevents--6bcd868d03", - "evented": true, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "socket_events", - "action", - "auid", - "eid", - "family", - "fd", - "local_address", - "local_port", - "path", - "pid", - "protocol", - "remote_address", - "remote_port", - "socket", - "status", - "success", - "time", - "uptime" - ], - "sectionRelativeRepoPath": "socket_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsocket_events.yml&value=name%3A%20socket_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/sofa_security_release_info", - "title": "sofa_security_release_info", - "htmlId": "table--sofasecurityreleaseinfo--50c9037b36", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "sofa_security_release_info", - "days_since_previous_release", - "os_version", - "product_version", - "release_date", - "security_info", - "unique_cves_count", - "update_name" - ], - "sectionRelativeRepoPath": "sofa_security_release_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sofa_security_release_info.yml" - }, - { - "url": "/tables/sofa_unpatched_cves", - "title": "sofa_unpatched_cves", - "htmlId": "table--sofaunpatchedcves--7e2cd697a3", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "sofa_unpatched_cves", - "actively_exploited", - "cve", - "os_version", - "patched_version" - ], - "sectionRelativeRepoPath": "sofa_unpatched_cves", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sofa_unpatched_cves.yml" - }, - { - "url": "/tables/software_update", - "title": "software_update", - "htmlId": "table--softwareupdate--e41de55074", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "software_update", - "software_update_required" - ], - "sectionRelativeRepoPath": "software_update", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/software_update.yml" - }, - { - "url": "/tables/ssh_configs", - "title": "ssh_configs", - "htmlId": "table--sshconfigs--0ac7f772f2", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "ssh_configs", - "block", - "option", - "ssh_config_file", - "uid" - ], - "sectionRelativeRepoPath": "ssh_configs", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ssh_configs.yml" - }, - { - "url": "/tables/startup_items", - "title": "startup_items", - "htmlId": "table--startupitems--01c26852c3", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "startup_items", - "args", - "name", - "path", - "source", - "status", - "type", - "username" - ], - "sectionRelativeRepoPath": "startup_items", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/startup_items.yml" - }, - { - "url": "/tables/sudo_info", - "title": "sudo_info", - "htmlId": "table--sudoinfo--9e3e5840b9", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "sudo_info", - "json_result" - ], - "sectionRelativeRepoPath": "sudo_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sudo_info.yml" - }, - { - "url": "/tables/sudoers", - "title": "sudoers", - "htmlId": "table--sudoers--41d65ef3de", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "sudoers", - "header", - "rule_details", - "source" - ], - "sectionRelativeRepoPath": "sudoers", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/sudoers.yml" - }, - { - "url": "/tables/suid_bin", - "title": "suid_bin", - "htmlId": "table--suidbin--a9aecacdf7", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "suid_bin", - "groupname", - "path", - "permissions", - "pid_with_namespace", - "username" - ], - "sectionRelativeRepoPath": "suid_bin", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/suid_bin.yml" - }, - { - "url": "/tables/syslog_events", - "title": "syslog_events", - "htmlId": "table--syslogevents--f1e81ac053", - "evented": true, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "syslog_events", - "datetime", - "eid", - "facility", - "host", - "message", - "severity", - "tag", - "time" - ], - "sectionRelativeRepoPath": "syslog_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsyslog_events.yml&value=name%3A%20syslog_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/system_controls", - "title": "system_controls", - "htmlId": "table--systemcontrols--4fb24f6308", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "system_controls", - "config_value", - "current_value", - "field_name", - "name", - "oid", - "subsystem", - "type" - ], - "sectionRelativeRepoPath": "system_controls", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_controls.yml" - }, - { - "url": "/tables/system_extensions", - "title": "system_extensions", - "htmlId": "table--systemextensions--c6bb0fcfb3", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "system_extensions", - "UUID", - "bundle_path", - "category", - "identifier", - "mdm_managed", - "path", - "state", - "team", - "version" - ], - "sectionRelativeRepoPath": "system_extensions", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_extensions.yml" - }, - { - "url": "/tables/system_info", - "title": "system_info", - "htmlId": "table--systeminfo--8d74915f82", - "evented": false, - "platforms": [ - "windows", - "darwin", - "linux", - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "system_info", - "board_model", - "board_serial", - "board_vendor", - "board_version", - "computer_name", - "cpu_brand", - "cpu_logical_cores", - "cpu_microcode", - "cpu_physical_cores", - "cpu_sockets", - "cpu_subtype", - "cpu_type", - "hardware_model", - "hardware_serial", - "hardware_vendor", - "hardware_version", - "hostname", - "local_hostname", - "physical_memory", - "uuid" - ], - "sectionRelativeRepoPath": "system_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_info.yml" - }, - { - "url": "/tables/system_state", - "title": "system_state", - "htmlId": "table--systemstate--6c03b60c4f", - "evented": false, - "platforms": [ - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "system_state", - "idle_state" - ], - "sectionRelativeRepoPath": "system_state", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/system_state.yml" - }, - { - "url": "/tables/systemd_units", - "title": "systemd_units", - "htmlId": "table--systemdunits--92e872ddbb", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "systemd_units", - "active_state", - "description", - "following", - "fragment_path", - "id", - "job_id", - "job_path", - "job_type", - "load_state", - "object_path", - "source_path", - "sub_state", - "unit_file_state", - "user" - ], - "sectionRelativeRepoPath": "systemd_units", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fsystemd_units.yml&value=name%3A%20systemd_units%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/tcc_access", - "title": "tcc_access", - "htmlId": "table--tccaccess--8a475d4133", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "tcc_access", - "auth_reason", - "auth_value", - "client", - "client_type", - "indirect_object_identifier", - "indirect_object_identifier_type", - "last_modified", - "policy_id", - "service", - "source", - "uid" - ], - "sectionRelativeRepoPath": "tcc_access", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/tcc_access.yml" - }, - { - "url": "/tables/temperature_sensors", - "title": "temperature_sensors", - "htmlId": "table--temperaturesensors--94b32a5c69", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "temperature_sensors", - "celsius", - "fahrenheit", - "key", - "name" - ], - "sectionRelativeRepoPath": "temperature_sensors", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/temperature_sensors.yml" - }, - { - "url": "/tables/time", - "title": "time", - "htmlId": "table--time--1b3592cfa3", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "time", - "datetime", - "day", - "hour", - "iso_8601", - "local_timezone", - "minutes", - "month", - "seconds", - "timestamp", - "timezone", - "unix_time", - "weekday", - "win_timestamp", - "year" - ], - "sectionRelativeRepoPath": "time", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time.yml" - }, - { - "url": "/tables/time_machine_backups", - "title": "time_machine_backups", - "htmlId": "table--timemachinebackups--de33aefff1", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "time_machine_backups", - "backup_date", - "destination_id" - ], - "sectionRelativeRepoPath": "time_machine_backups", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time_machine_backups.yml" - }, - { - "url": "/tables/time_machine_destinations", - "title": "time_machine_destinations", - "htmlId": "table--timemachinedestinations--539b98ee91", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "time_machine_destinations", - "alias", - "bytes_available", - "bytes_used", - "consistency_scan_date", - "destination_id", - "encryption", - "root_volume_uuid" - ], - "sectionRelativeRepoPath": "time_machine_destinations", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/time_machine_destinations.yml" - }, - { - "url": "/tables/tpm_info", - "title": "tpm_info", - "htmlId": "table--tpminfo--396d9c578b", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "tpm_info", - "activated", - "enabled", - "manufacturer_id", - "manufacturer_name", - "manufacturer_version", - "owned", - "physical_presence_version", - "product_name", - "spec_version" - ], - "sectionRelativeRepoPath": "tpm_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Ftpm_info.yml&value=name%3A%20tpm_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/ulimit_info", - "title": "ulimit_info", - "htmlId": "table--ulimitinfo--5a239b79bc", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "ulimit_info", - "hard_limit", - "soft_limit", - "type" - ], - "sectionRelativeRepoPath": "ulimit_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/ulimit_info.yml" - }, - { - "url": "/tables/unified_log", - "title": "unified_log", - "htmlId": "table--unifiedlog--9794c5d6f5", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "unified_log", - "activity", - "category", - "level", - "max_rows", - "message", - "pid", - "predicate", - "process", - "sender", - "storage", - "subsystem", - "tid", - "timestamp" - ], - "sectionRelativeRepoPath": "unified_log", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Funified_log.yml&value=name%3A%20unified_log%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/uptime", - "title": "uptime", - "htmlId": "table--uptime--c4c605e6c3", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "uptime", - "days", - "hours", - "minutes", - "seconds", - "total_seconds" - ], - "sectionRelativeRepoPath": "uptime", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/uptime.yml" - }, - { - "url": "/tables/usb_devices", - "title": "usb_devices", - "htmlId": "table--usbdevices--34406afdaf", - "evented": false, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "usb_devices", - "class", - "model", - "model_id", - "protocol", - "removable", - "serial", - "subclass", - "usb_address", - "usb_port", - "vendor", - "vendor_id", - "version" - ], - "sectionRelativeRepoPath": "usb_devices", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/usb_devices.yml" - }, - { - "url": "/tables/user_events", - "title": "user_events", - "htmlId": "table--userevents--79413d7f5c", - "evented": true, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "user_events", - "address", - "auid", - "eid", - "message", - "path", - "pid", - "terminal", - "time", - "type", - "uid", - "uptime" - ], - "sectionRelativeRepoPath": "user_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fuser_events.yml&value=name%3A%20user_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/user_groups", - "title": "user_groups", - "htmlId": "table--usergroups--76a18355bd", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "user_groups", - "gid", - "uid" - ], - "sectionRelativeRepoPath": "user_groups", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fuser_groups.yml&value=name%3A%20user_groups%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/user_interaction_events", - "title": "user_interaction_events", - "htmlId": "table--userinteractionevents--1810ff3487", - "evented": true, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "user_interaction_events", - "time" - ], - "sectionRelativeRepoPath": "user_interaction_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fuser_interaction_events.yml&value=name%3A%20user_interaction_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/user_login_settings", - "title": "user_login_settings", - "htmlId": "table--userloginsettings--f880540fae", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "user_login_settings", - "password_hint_enabled" - ], - "sectionRelativeRepoPath": "user_login_settings", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/user_login_settings.yml" - }, - { - "url": "/tables/user_ssh_keys", - "title": "user_ssh_keys", - "htmlId": "table--usersshkeys--538ec922b6", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "user_ssh_keys", - "encrypted", - "key_type", - "path", - "pid_with_namespace", - "uid" - ], - "sectionRelativeRepoPath": "user_ssh_keys", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/user_ssh_keys.yml" - }, - { - "url": "/tables/userassist", - "title": "userassist", - "htmlId": "table--userassist--08542b9d51", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "userassist", - "count", - "last_execution_time", - "path", - "sid" - ], - "sectionRelativeRepoPath": "userassist", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/userassist.yml" - }, - { - "url": "/tables/users", - "title": "users", - "htmlId": "table--users--e74270fb84", - "evented": false, - "platforms": [ - "darwin", - "windows", - "linux", - "chrome" - ], - "keywordsForSyntaxHighlighting": [ - "users", - "description", - "directory", - "email", - "gid", - "gid_signed", - "is_hidden", - "pid_with_namespace", - "shell", - "type", - "uid", - "uid_signed", - "username", - "uuid" - ], - "sectionRelativeRepoPath": "users", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/users.yml" - }, - { - "url": "/tables/video_info", - "title": "video_info", - "htmlId": "table--videoinfo--9eb3ce33ac", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "video_info", - "color_depth", - "driver", - "driver_date", - "driver_version", - "manufacturer", - "model", - "series", - "video_mode" - ], - "sectionRelativeRepoPath": "video_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fvideo_info.yml&value=name%3A%20video_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/virtual_memory_info", - "title": "virtual_memory_info", - "htmlId": "table--virtualmemoryinfo--93cc423397", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "virtual_memory_info", - "active", - "anonymous", - "compressed", - "compressor", - "copy", - "decompressed", - "faults", - "file_backed", - "free", - "inactive", - "page_ins", - "page_outs", - "purgeable", - "purged", - "reactivated", - "speculative", - "swap_ins", - "swap_outs", - "throttled", - "uncompressed", - "wired", - "zero_fill" - ], - "sectionRelativeRepoPath": "virtual_memory_info", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/virtual_memory_info.yml" - }, - { - "url": "/tables/vscode_extensions", - "title": "vscode_extensions", - "htmlId": "table--vscodeextensions--2737d7de85", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "vscode_extensions", - "installed_at", - "name", - "path", - "prerelease", - "publisher", - "publisher_id", - "uid", - "uuid", - "version" - ], - "sectionRelativeRepoPath": "vscode_extensions", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/vscode_extensions.yml" - }, - { - "url": "/tables/wifi_networks", - "title": "wifi_networks", - "htmlId": "table--wifinetworks--dbf9e8c630", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "wifi_networks", - "add_reason", - "added_at", - "auto_join", - "auto_login", - "captive_login_date", - "captive_portal", - "disabled", - "last_connected", - "network_name", - "passpoint", - "personal_hotspot", - "possibly_hidden", - "roaming", - "roaming_profile", - "security_type", - "ssid", - "temporarily_disabled", - "was_captive_network" - ], - "sectionRelativeRepoPath": "wifi_networks", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_networks.yml" - }, - { - "url": "/tables/wifi_status", - "title": "wifi_status", - "htmlId": "table--wifistatus--f420ee60fb", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "wifi_status", - "bssid", - "channel", - "channel_band", - "channel_width", - "country_code", - "interface", - "mode", - "network_name", - "noise", - "rssi", - "security_type", - "ssid", - "transmit_rate" - ], - "sectionRelativeRepoPath": "wifi_status", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_status.yml" - }, - { - "url": "/tables/wifi_survey", - "title": "wifi_survey", - "htmlId": "table--wifisurvey--78509e80b7", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "wifi_survey", - "bssid", - "channel", - "channel_band", - "channel_width", - "country_code", - "interface", - "network_name", - "noise", - "rssi", - "ssid" - ], - "sectionRelativeRepoPath": "wifi_survey", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/wifi_survey.yml" - }, - { - "url": "/tables/winbaseobj", - "title": "winbaseobj", - "htmlId": "table--winbaseobj--880aabbcbb", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "winbaseobj", - "object_name", - "object_type", - "session_id" - ], - "sectionRelativeRepoPath": "winbaseobj", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwinbaseobj.yml&value=name%3A%20winbaseobj%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/windows_crashes", - "title": "windows_crashes", - "htmlId": "table--windowscrashes--2e304082e6", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "windows_crashes", - "build_number", - "command_line", - "crash_path", - "current_directory", - "datetime", - "exception_address", - "exception_code", - "exception_message", - "machine_name", - "major_version", - "minor_version", - "module", - "path", - "pid", - "process_uptime", - "registers", - "stack_trace", - "tid", - "type", - "username", - "version" - ], - "sectionRelativeRepoPath": "windows_crashes", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_crashes.yml&value=name%3A%20windows_crashes%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/windows_eventlog", - "title": "windows_eventlog", - "htmlId": "table--windowseventlog--a5b61bb092", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "windows_eventlog", - "channel", - "computer_name", - "data", - "datetime", - "eventid", - "keywords", - "level", - "pid", - "provider_guid", - "provider_name", - "task", - "tid", - "time_range", - "timestamp", - "xpath" - ], - "sectionRelativeRepoPath": "windows_eventlog", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_eventlog.yml" - }, - { - "url": "/tables/windows_events", - "title": "windows_events", - "htmlId": "table--windowsevents--fe0564c923", - "evented": true, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "windows_events", - "computer_name", - "data", - "datetime", - "eid", - "eventid", - "keywords", - "level", - "provider_guid", - "provider_name", - "source", - "task", - "time" - ], - "sectionRelativeRepoPath": "windows_events", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_events.yml&value=name%3A%20windows_events%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/windows_firewall_rules", - "title": "windows_firewall_rules", - "htmlId": "table--windowsfirewallrules--03777ff61f", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "windows_firewall_rules", - "action", - "app_name", - "direction", - "enabled", - "grouping", - "icmp_types_codes", - "local_addresses", - "local_ports", - "name", - "profile_domain", - "profile_private", - "profile_public", - "protocol", - "remote_addresses", - "remote_ports", - "service_name" - ], - "sectionRelativeRepoPath": "windows_firewall_rules", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_firewall_rules.yml" - }, - { - "url": "/tables/windows_optional_features", - "title": "windows_optional_features", - "htmlId": "table--windowsoptionalfeatures--551b5e1d80", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "windows_optional_features", - "caption", - "name", - "state", - "statename" - ], - "sectionRelativeRepoPath": "windows_optional_features", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_optional_features.yml" - }, - { - "url": "/tables/windows_search", - "title": "windows_search", - "htmlId": "table--windowssearch--aecbd5584f", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "windows_search", - "additional_properties", - "date_created", - "date_modified", - "max_results", - "name", - "owner", - "path", - "properties", - "query", - "size", - "sort", - "type" - ], - "sectionRelativeRepoPath": "windows_search", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_search.yml&value=name%3A%20windows_search%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/windows_security_center", - "title": "windows_security_center", - "htmlId": "table--windowssecuritycenter--9e610c0b00", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "windows_security_center", - "antispyware", - "antivirus", - "autoupdate", - "firewall", - "internet_settings", - "user_account_control", - "windows_security_center_service" - ], - "sectionRelativeRepoPath": "windows_security_center", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_security_center.yml&value=name%3A%20windows_security_center%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/windows_security_products", - "title": "windows_security_products", - "htmlId": "table--windowssecurityproducts--9c04a14fbe", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "windows_security_products", - "name", - "remediation_path", - "signatures_up_to_date", - "state", - "state_timestamp", - "type" - ], - "sectionRelativeRepoPath": "windows_security_products", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_security_products.yml&value=name%3A%20windows_security_products%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/windows_update_history", - "title": "windows_update_history", - "htmlId": "table--windowsupdatehistory--39d94868df", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "windows_update_history", - "client_app_id", - "date", - "description", - "hresult", - "operation", - "result_code", - "server_selection", - "service_id", - "support_url", - "title", - "update_id", - "update_revision" - ], - "sectionRelativeRepoPath": "windows_update_history", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwindows_update_history.yml&value=name%3A%20windows_update_history%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/windows_updates", - "title": "windows_updates", - "htmlId": "table--windowsupdates--002065ccf3", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "windows_updates", - "fullkey", - "is_default", - "key", - "locale", - "parent", - "query", - "value" - ], - "sectionRelativeRepoPath": "windows_updates", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/windows_updates.yml" - }, - { - "url": "/tables/wmi_bios_info", - "title": "wmi_bios_info", - "htmlId": "table--wmibiosinfo--5a34e0ddaf", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "wmi_bios_info", - "name", - "value" - ], - "sectionRelativeRepoPath": "wmi_bios_info", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_bios_info.yml&value=name%3A%20wmi_bios_info%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/wmi_cli_event_consumers", - "title": "wmi_cli_event_consumers", - "htmlId": "table--wmiclieventconsumers--bba3dde014", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "wmi_cli_event_consumers", - "class", - "command_line_template", - "executable_path", - "name", - "relative_path" - ], - "sectionRelativeRepoPath": "wmi_cli_event_consumers", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_cli_event_consumers.yml&value=name%3A%20wmi_cli_event_consumers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/wmi_event_filters", - "title": "wmi_event_filters", - "htmlId": "table--wmieventfilters--2f3af06452", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "wmi_event_filters", - "class", - "name", - "query", - "query_language", - "relative_path" - ], - "sectionRelativeRepoPath": "wmi_event_filters", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_event_filters.yml&value=name%3A%20wmi_event_filters%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/wmi_filter_consumer_binding", - "title": "wmi_filter_consumer_binding", - "htmlId": "table--wmifilterconsumerbinding--9eaa6581a1", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "wmi_filter_consumer_binding", - "class", - "consumer", - "filter", - "relative_path" - ], - "sectionRelativeRepoPath": "wmi_filter_consumer_binding", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_filter_consumer_binding.yml&value=name%3A%20wmi_filter_consumer_binding%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/wmi_script_event_consumers", - "title": "wmi_script_event_consumers", - "htmlId": "table--wmiscripteventconsumers--36a6a2005c", - "evented": false, - "platforms": [ - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "wmi_script_event_consumers", - "class", - "name", - "relative_path", - "script_file_name", - "script_text", - "scripting_engine" - ], - "sectionRelativeRepoPath": "wmi_script_event_consumers", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fwmi_script_event_consumers.yml&value=name%3A%20wmi_script_event_consumers%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/xprotect_entries", - "title": "xprotect_entries", - "htmlId": "table--xprotectentries--a7e094d93d", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "xprotect_entries", - "filename", - "filetype", - "identity", - "launch_type", - "name", - "optional", - "uses_pattern" - ], - "sectionRelativeRepoPath": "xprotect_entries", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_entries.yml" - }, - { - "url": "/tables/xprotect_meta", - "title": "xprotect_meta", - "htmlId": "table--xprotectmeta--5e905ccfd7", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "xprotect_meta", - "developer_id", - "identifier", - "min_version", - "type" - ], - "sectionRelativeRepoPath": "xprotect_meta", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_meta.yml" - }, - { - "url": "/tables/xprotect_reports", - "title": "xprotect_reports", - "htmlId": "table--xprotectreports--d55daafb4a", - "evented": false, - "platforms": [ - "darwin" - ], - "keywordsForSyntaxHighlighting": [ - "xprotect_reports", - "name", - "time", - "user_action" - ], - "sectionRelativeRepoPath": "xprotect_reports", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/xprotect_reports.yml" - }, - { - "url": "/tables/yara", - "title": "yara", - "htmlId": "table--yara--6473c921d1", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "yara", - "count", - "matches", - "path", - "pid_with_namespace", - "sig_group", - "sigfile", - "sigrule", - "sigurl", - "strings", - "tags" - ], - "sectionRelativeRepoPath": "yara", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yara.yml" - }, - { - "url": "/tables/yara_events", - "title": "yara_events", - "htmlId": "table--yaraevents--8757715056", - "evented": true, - "platforms": [ - "darwin", - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "yara_events", - "action", - "category", - "count", - "eid", - "matches", - "strings", - "tags", - "target_path", - "time", - "transaction_id" - ], - "sectionRelativeRepoPath": "yara_events", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yara_events.yml" - }, - { - "url": "/tables/ycloud_instance_metadata", - "title": "ycloud_instance_metadata", - "htmlId": "table--ycloudinstancemetadata--3716d6f478", - "evented": false, - "platforms": [ - "darwin", - "linux", - "windows" - ], - "keywordsForSyntaxHighlighting": [ - "ycloud_instance_metadata", - "cloud_id", - "description", - "folder_id", - "hostname", - "instance_id", - "metadata_endpoint", - "name", - "serial_port_enabled", - "ssh_public_key", - "zone" - ], - "sectionRelativeRepoPath": "ycloud_instance_metadata", - "githubUrl": "https://github.com/fleetdm/fleet/new/main/schema?filename=tables%2Fycloud_instance_metadata.yml&value=name%3A%20ycloud_instance_metadata%0Adescription%3A%20%7C-%20%23%20(required)%20string%20-%20The%20description%20for%20this%20table.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%23%20Add%20description%20here%0Aexamples%3A%20%7C-%20%23%20(optional)%20string%20-%20An%20example%20query%20for%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown%0A%09%23%20Add%20examples%20here%0Anotes%3A%20%7C-%20%23%20(optional)%20string%20-%20Notes%20about%20this%20table.%20Note%3A%20This%20field%20supports%20Markdown.%0A%09%23%20Add%20notes%20here%0Acolumns%3A%20%23%20(required)%0A%09-%20name%3A%20%23%20(required)%20string%20-%20The%20name%20of%20the%20column%0A%09%20%20description%3A%20%23%20(required)%20string%20-%20The%20column's%20description.%20Note%3A%20this%20field%20supports%20Markdown%0A%09%20%20type%3A%20%23%20(required)%20string%20-%20the%20column's%20data%20type%0A%09%20%20required%3A%20%23%20(required)%20boolean%20-%20whether%20or%20not%20this%20column%20is%20required%20to%20query%20this%20table." - }, - { - "url": "/tables/yum_sources", - "title": "yum_sources", - "htmlId": "table--yumsources--df3b0957df", - "evented": false, - "platforms": [ - "linux" - ], - "keywordsForSyntaxHighlighting": [ - "yum_sources", - "baseurl", - "enabled", - "gpgcheck", - "gpgkey", - "mirrorlist", - "name", - "pid_with_namespace" - ], - "sectionRelativeRepoPath": "yum_sources", - "githubUrl": "https://github.com/fleetdm/fleet/blob/main/schema/tables/yum_sources.yml" - } - ], - "appLibrary": [ - { - "identifier": "cloudflare-warp", - "bundleIdentifier": "com.cloudflare.1dot1dot1dot1.macos", - "installerFormat": "pkg", - "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.cloudflare.1dot1dot1dot1.macos.loginlauncherapp' && remove_launchctl_service 'com.cloudflare.1dot1dot1dot1.macos.warp.daemon' && quit_application 'com.cloudflare.1dot1dot1dot1.macos' && sudo pkgutil --forget 'com.cloudflare.1dot1dot1dot1.macos' && /Applications/Cloudflare\\ WARP.app/Contents/Resources/uninstall.sh && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.cloudflare.1dot1dot1dot1.macos.loginlauncherapp' && trash $LOGGED_IN_USER '~/Library/Application Support/com.cloudflare.1dot1dot1dot1.macos' && trash $LOGGED_IN_USER '~/Library/Caches/com.cloudflare.1dot1dot1dot1.macos' && trash $LOGGED_IN_USER '~/Library/Caches/com.plausiblelabs.crashreporter.data/com.cloudflare.1dot1dot1dot1.macos' && trash $LOGGED_IN_USER '~/Library/Containers/com.cloudflare.1dot1dot1dot1.macos.loginlauncherapp' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.cloudflare.1dot1dot1dot1.macos' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.cloudflare.1dot1dot1dot1.macos.binarycookies' && trash $LOGGED_IN_USER '~/Library/Preferences/com.cloudflare.1dot1dot1dot1.macos.plist'", - "version": "2024.6.474.0", - "description": "Free app that makes your Internet safer", - "name": "Cloudflare WARP" - }, - { - "identifier": "brave-browser", - "bundleIdentifier": "com.brave.Browser", - "installerFormat": "dmg:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/Brave Browser.app\" && trash $LOGGED_IN_USER '~/Library/Application Support/BraveSoftware' && trash $LOGGED_IN_USER '~/Library/Caches/BraveSoftware' && trash $LOGGED_IN_USER '~/Library/Caches/com.brave.Browser' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.brave.Browser' && trash $LOGGED_IN_USER '~/Library/Preferences/com.brave.Browser.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.brave.Browser.savedState'", - "version": "1.69.162.0", - "description": "Web browser focusing on privacy", - "name": "Brave" - }, - { - "identifier": "firefox", - "bundleIdentifier": "org.mozilla.firefox", - "installerFormat": "dmg:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && quit_application 'org.mozilla.firefox' && sudo rm -rf \"$APPDIR/Firefox.app\" && sudo rm -rf 'firefox' && sudo rmdir '~/Library/Application Support/Mozilla' && sudo rmdir '~/Library/Caches/Mozilla' && sudo rmdir '~/Library/Caches/Mozilla/updates' && sudo rmdir '~/Library/Caches/Mozilla/updates/Applications' && trash $LOGGED_IN_USER '/Library/Logs/DiagnosticReports/firefox_*' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/org.mozilla.firefox.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/CrashReporter/firefox_*' && trash $LOGGED_IN_USER '~/Library/Application Support/Firefox' && trash $LOGGED_IN_USER '~/Library/Caches/Firefox' && trash $LOGGED_IN_USER '~/Library/Caches/Mozilla/updates/Applications/Firefox' && trash $LOGGED_IN_USER '~/Library/Caches/org.mozilla.crashreporter' && trash $LOGGED_IN_USER '~/Library/Caches/org.mozilla.firefox' && trash $LOGGED_IN_USER '~/Library/Preferences/org.mozilla.crashreporter.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/org.mozilla.firefox.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/org.mozilla.firefox.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/org.mozilla.firefox'", - "version": "130.0", - "description": "Web browser", - "name": "Mozilla Firefox" - }, - { - "identifier": "figma", - "bundleIdentifier": "com.figma.Desktop", - "installerFormat": "zip:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/Figma.app\" && trash $LOGGED_IN_USER '~/Library/Application Support/Figma' && trash $LOGGED_IN_USER '~/Library/Application Support/figma-desktop' && trash $LOGGED_IN_USER '~/Library/Caches/com.figma.agent' && trash $LOGGED_IN_USER '~/Library/Caches/com.figma.Desktop' && trash $LOGGED_IN_USER '~/Library/Preferences/com.figma.Desktop.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.figma.Desktop.savedState'", - "version": "124.3.2", - "description": "Collaborative team software", - "name": "Figma" - }, - { - "identifier": "google-chrome", - "bundleIdentifier": "com.google.Chrome", - "installerFormat": "dmg:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/Google Chrome.app\" && remove_launchctl_service 'com.google.keystone.agent' && remove_launchctl_service 'com.google.keystone.daemon' && sudo rmdir '/Library/Google' && sudo rmdir '~/Library/Application Support/Google' && sudo rmdir '~/Library/Caches/Google' && sudo rmdir '~/Library/Google' && trash $LOGGED_IN_USER '/Library/Caches/com.google.SoftwareUpdate.*' && trash $LOGGED_IN_USER '/Library/Google/Google Chrome Brand.plist' && trash $LOGGED_IN_USER '/Library/Google/GoogleSoftwareUpdate' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.google.chrome.app.*.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.google.chrome.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/Google/Chrome' && trash $LOGGED_IN_USER '~/Library/Caches/com.google.Chrome' && trash $LOGGED_IN_USER '~/Library/Caches/com.google.Chrome.helper.*' && trash $LOGGED_IN_USER '~/Library/Caches/com.google.Keystone' && trash $LOGGED_IN_USER '~/Library/Caches/com.google.Keystone.Agent' && trash $LOGGED_IN_USER '~/Library/Caches/com.google.SoftwareUpdate' && trash $LOGGED_IN_USER '~/Library/Caches/Google/Chrome' && trash $LOGGED_IN_USER '~/Library/Google/Google Chrome Brand.plist' && trash $LOGGED_IN_USER '~/Library/Google/GoogleSoftwareUpdate' && trash $LOGGED_IN_USER '~/Library/LaunchAgents/com.google.keystone.agent.plist' && trash $LOGGED_IN_USER '~/Library/LaunchAgents/com.google.keystone.xpcservice.plist' && trash $LOGGED_IN_USER '~/Library/Logs/GoogleSoftwareUpdateAgent.log' && trash $LOGGED_IN_USER '~/Library/Preferences/com.google.Chrome.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.google.Keystone.Agent.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.google.Chrome.app.*.savedState' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.google.Chrome.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/com.google.Chrome'", - "version": "128.0.6613.120", - "description": "Web browser", - "name": "Google Chrome" - }, - { - "identifier": "microsoft-excel", - "bundleIdentifier": "com.microsoft.Excel", - "installerFormat": "pkg", - "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.microsoft.office.licensingV2.helper' && quit_application 'com.microsoft.autoupdate2' && sudo pkgutil --forget 'com.microsoft.package.Microsoft_Excel.app' && sudo pkgutil --forget 'com.microsoft.pkg.licensing' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.Excel' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.microsoft.excel.sfl*' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.Excel' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.Excel' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.Excel.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.Excel.savedState' && trash $LOGGED_IN_USER '~/Library/Webkit/com.microsoft.Excel'", - "version": "16.88.24081116", - "description": "Spreadsheet software", - "name": "Microsoft Excel" - }, - { - "identifier": "microsoft-edge", - "bundleIdentifier": "com.microsoft.edgemac", - "installerFormat": "pkg", - "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.microsoft.EdgeUpdater.update-internal.109.0.1518.89.system' && remove_launchctl_service 'com.microsoft.EdgeUpdater.update.system' && remove_launchctl_service 'com.microsoft.EdgeUpdater.wake.system' && sudo pkgutil --forget 'com.microsoft.edgemac' && sudo rm -rf '/Library/Application Support/Microsoft/EdgeUpdater' && sudo rmdir '/Library/Application Support/Microsoft' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.edgemac.wdgExtension' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft Edge' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft/EdgeUpdater' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.edgemac' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.EdgeUpdater' && trash $LOGGED_IN_USER '~/Library/Caches/Microsoft Edge' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.edgemac.wdgExtension' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.microsoft.edge*' && trash $LOGGED_IN_USER '~/Library/LaunchAgents/com.microsoft.EdgeUpdater.*.plist' && trash $LOGGED_IN_USER '~/Library/Microsoft/EdgeUpdater' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.edgemac.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.edgemac.*' && trash $LOGGED_IN_USER '~/Library/WebKit/com.microsoft.edgemac'", - "version": "128.0.2739.67", - "description": "Web browser", - "name": "Microsoft Edge" - }, - { - "identifier": "microsoft-word", - "bundleIdentifier": "com.microsoft.Word", - "installerFormat": "pkg", - "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.microsoft.office.licensingV2.helper' && quit_application 'com.microsoft.autoupdate2' && sudo pkgutil --forget 'com.microsoft.package.Microsoft_Word.app' && sudo pkgutil --forget 'com.microsoft.pkg.licensing' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.Word' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.microsoft.word.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/CrashReporter/Microsoft Word_*.plist' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.Word' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.Word.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.Word.savedState'", - "version": "16.88.24081116", - "description": "Word processor", - "name": "Microsoft Word" - }, - { - "identifier": "box-drive", - "bundleIdentifier": "com.box.desktop", - "installerFormat": "pkg", - "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && (cd /Users/$LOGGED_IN_USER; sudo -u $LOGGED_IN_USER fileproviderctl domain remove -A com.box.desktop.boxfileprovider) && (cd /Users/$LOGGED_IN_USER; sudo -u $LOGGED_IN_USER /Applications/Box.app/Contents/MacOS/fpe/streem --remove-fpe-domain-and-archive-unsynced-content Box) && (cd /Users/$LOGGED_IN_USER; sudo -u $LOGGED_IN_USER /Applications/Box.app/Contents/MacOS/fpe/streem --remove-fpe-domain-and-preserve-unsynced-content Box) && (cd /Users/$LOGGED_IN_USER; defaults delete com.box.desktop) && echo \"${LOGGED_IN_USER} ALL = (root) NOPASSWD: /Library/Application\\ Support/Box/uninstall_box_drive_r\" >> /etc/sudoers.d/box_uninstall && remove_launchctl_service 'com.box.desktop.helper' && quit_application 'com.box.Box-Local-Com-Server' && quit_application 'com.box.desktop' && quit_application 'com.box.desktop.findersyncext' && quit_application 'com.box.desktop.helper' && quit_application 'com.box.desktop.ui' && (cd /Users/$LOGGED_IN_USER && sudo -u \"$LOGGED_IN_USER\" '/Library/Application Support/Box/uninstall_box_drive') && sudo pkgutil --forget 'com.box.desktop.installer.*' && rm /etc/sudoers.d/box_uninstall && trash $LOGGED_IN_USER '~/.Box_*' && trash $LOGGED_IN_USER '~/Library/Application Support/Box/Box' && trash $LOGGED_IN_USER '~/Library/Application Support/FileProvider/com.box.desktop.boxfileprovider' && trash $LOGGED_IN_USER '~/Library/Containers/com.box.desktop.findersyncext' && trash $LOGGED_IN_USER '~/Library/Logs/Box/Box' && trash $LOGGED_IN_USER '~/Library/Preferences/com.box.desktop.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.box.desktop.ui.plist'", - "version": "2.40.345", - "description": "Client for the Box cloud storage service", - "name": "Box Drive" - }, - { - "identifier": "microsoft-teams", - "bundleIdentifier": "com.microsoft.teams2", - "installerFormat": "pkg", - "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.microsoft.teams.TeamsUpdaterDaemon' && quit_application 'com.microsoft.autoupdate2' && sudo pkgutil --forget 'com.microsoft.MSTeamsAudioDevice' && sudo pkgutil --forget 'com.microsoft.package.Microsoft_AutoUpdate.app' && sudo pkgutil --forget 'com.microsoft.teams2' && sudo rm -rf '/Applications/Microsoft Teams.app' && sudo rm -rf '/Library/Application Support/Microsoft/TeamsUpdaterDaemon' && sudo rm -rf '/Library/Logs/Microsoft/MSTeams' && sudo rm -rf '/Library/Logs/Microsoft/Teams' && sudo rm -rf '/Library/Preferences/com.microsoft.teams.plist' && sudo rmdir '~/Library/Application Support/Microsoft' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.teams2' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.teams2.launcher' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.microsoft.teams2.notificationcenter' && trash $LOGGED_IN_USER '~/Library/Application Support/com.microsoft.teams' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft/Teams' && trash $LOGGED_IN_USER '~/Library/Application Support/Teams' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.teams' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.teams2' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.teams2.launcher' && trash $LOGGED_IN_USER '~/Library/Containers/com.microsoft.teams2.notificationcenter' && trash $LOGGED_IN_USER '~/Library/Cookies/com.microsoft.teams.binarycookies' && trash $LOGGED_IN_USER '~/Library/Group Containers/*.com.microsoft.teams' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.microsoft.teams' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.microsoft.teams.binarycookies' && trash $LOGGED_IN_USER '~/Library/Logs/Microsoft Teams Helper (Renderer)' && trash $LOGGED_IN_USER '~/Library/Logs/Microsoft Teams' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.teams.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.teams.savedState' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.teams2.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/com.microsoft.teams'", - "version": "24215.1002.3039.5089", - "description": "Meet, chat, call, and collaborate in just one place", - "name": "Microsoft Teams" - }, - { - "identifier": "notion", - "bundleIdentifier": "notion.id", - "installerFormat": "dmg:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/Notion.app\" && trash $LOGGED_IN_USER '~/Library/Application Support/Caches/notion-updater' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/notion.id.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/Notion' && trash $LOGGED_IN_USER '~/Library/Caches/notion.id*' && trash $LOGGED_IN_USER '~/Library/Logs/Notion' && trash $LOGGED_IN_USER '~/Library/Preferences/ByHost/notion.id.*' && trash $LOGGED_IN_USER '~/Library/Preferences/notion.id.*' && trash $LOGGED_IN_USER '~/Library/Saved Application State/notion.id.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/notion.id'", - "version": "3.14.0", - "description": "App to write, plan, collaborate, and get organised", - "name": "Notion" - }, - { - "identifier": "slack", - "bundleIdentifier": "com.tinyspeck.slackmacgap", - "installerFormat": "dmg:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && quit_application 'com.tinyspeck.slackmacgap' && sudo rm -rf \"$APPDIR/Slack.app\" && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.tinyspeck.slackmacgap' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.tinyspeck.slackmacgap.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/Slack' && trash $LOGGED_IN_USER '~/Library/Caches/com.tinyspeck.slackmacgap*' && trash $LOGGED_IN_USER '~/Library/Containers/com.tinyspeck.slackmacgap*' && trash $LOGGED_IN_USER '~/Library/Cookies/com.tinyspeck.slackmacgap.binarycookies' && trash $LOGGED_IN_USER '~/Library/Group Containers/*.com.tinyspeck.slackmacgap' && trash $LOGGED_IN_USER '~/Library/Group Containers/*.slack' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.tinyspeck.slackmacgap*' && trash $LOGGED_IN_USER '~/Library/Logs/Slack' && trash $LOGGED_IN_USER '~/Library/Preferences/ByHost/com.tinyspeck.slackmacgap.ShipIt.*.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.tinyspeck.slackmacgap*' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.tinyspeck.slackmacgap.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/com.tinyspeck.slackmacgap'", - "version": "4.40.126", - "description": "Team communication and collaboration software", - "name": "Slack" - }, - { - "identifier": "teamviewer", - "bundleIdentifier": "com.teamviewer.TeamViewer", - "installerFormat": "pkg", - "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.teamviewer.desktop' && remove_launchctl_service 'com.teamviewer.Helper' && remove_launchctl_service 'com.teamviewer.service' && remove_launchctl_service 'com.teamviewer.teamviewer' && remove_launchctl_service 'com.teamviewer.teamviewer_desktop' && remove_launchctl_service 'com.teamviewer.teamviewer_service' && remove_launchctl_service 'com.teamviewer.UninstallerHelper' && remove_launchctl_service 'com.teamviewer.UninstallerWatcher' && quit_application 'com.teamviewer.TeamViewer' && quit_application 'com.teamviewer.TeamViewerUninstaller' && sudo pkgutil --forget 'com.teamviewer.AuthorizationPlugin' && sudo pkgutil --forget 'com.teamviewer.remoteaudiodriver' && sudo pkgutil --forget 'com.teamviewer.teamviewer.*' && sudo pkgutil --forget 'TeamViewerUninstaller' && sudo rm -rf '/Applications/TeamViewer.app' && sudo rm -rf '/Library/Preferences/com.teamviewer*' && trash $LOGGED_IN_USER '~/Library/Application Support/TeamViewer' && trash $LOGGED_IN_USER '~/Library/Caches/com.teamviewer.TeamViewer' && trash $LOGGED_IN_USER '~/Library/Caches/TeamViewer' && trash $LOGGED_IN_USER '~/Library/Cookies/com.teamviewer.TeamViewer.binarycookies' && trash $LOGGED_IN_USER '~/Library/Logs/TeamViewer' && trash $LOGGED_IN_USER '~/Library/Preferences/com.teamviewer*' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.teamviewer.TeamViewer.savedState'", - "version": "15.57.5", - "description": "Remote access and connectivity software focused on security", - "name": "TeamViewer" - }, - { - "identifier": "postman", - "bundleIdentifier": "com.postmanlabs.mac", - "installerFormat": "zip:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/Postman.app\" && trash $LOGGED_IN_USER '~/Library/Application Support/com.postmanlabs.mac.ShipIt' && trash $LOGGED_IN_USER '~/Library/Application Support/Postman' && trash $LOGGED_IN_USER '~/Library/Caches/com.postmanlabs.mac' && trash $LOGGED_IN_USER '~/Library/Caches/com.postmanlabs.mac.ShipIt' && trash $LOGGED_IN_USER '~/Library/Caches/Postman' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.postmanlabs.mac' && trash $LOGGED_IN_USER '~/Library/Preferences/ByHost/com.postmanlabs.mac.ShipIt.*.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.postmanlabs.mac.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.postmanlabs.mac.savedState'", - "version": "11.12.0", - "description": "Collaboration platform for API development", - "name": "Postman" - }, - { - "identifier": "visual-studio-code", - "bundleIdentifier": "com.microsoft.VSCode", - "installerFormat": "zip:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.microsoft.VSCode.ShipIt' && quit_application 'com.microsoft.VSCode' && sudo rm -rf \"$APPDIR/Visual Studio Code.app\" && trash $LOGGED_IN_USER '~/.vscode' && trash $LOGGED_IN_USER '~/Library/Application Support/Code' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.microsoft.vscode.sfl*' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.VSCode' && trash $LOGGED_IN_USER '~/Library/Caches/com.microsoft.VSCode.ShipIt' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.microsoft.VSCode' && trash $LOGGED_IN_USER '~/Library/Preferences/ByHost/com.microsoft.VSCode.ShipIt.*.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.VSCode.helper.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.microsoft.VSCode.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.microsoft.VSCode.savedState'", - "version": "1.93.0", - "description": "Open-source code editor", - "name": "Microsoft Visual Studio Code" - }, - { - "identifier": "whatsapp", - "bundleIdentifier": "net.whatsapp.WhatsApp", - "installerFormat": "zip:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/WhatsApp.app\" && trash $LOGGED_IN_USER '~/Library/Application Scripts/net.whatsapp.WhatsApp*' && trash $LOGGED_IN_USER '~/Library/Caches/net.whatsapp.WhatsApp' && trash $LOGGED_IN_USER '~/Library/Containers/net.whatsapp.WhatsApp*' && trash $LOGGED_IN_USER '~/Library/Group Containers/group.com.facebook.family' && trash $LOGGED_IN_USER '~/Library/Group Containers/group.net.whatsapp*' && trash $LOGGED_IN_USER '~/Library/Saved Application State/net.whatsapp.WhatsApp.savedState'", - "version": "2.24.16.80", - "description": "Native desktop client for WhatsApp", - "name": "WhatsApp" - }, - { - "identifier": "1password", - "bundleIdentifier": "com.1password.1password", - "installerFormat": "zip:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && sudo rm -rf \"$APPDIR/1Password.app\" && trash $LOGGED_IN_USER '~/Library/Application Scripts/2BUA8C4S2C.com.1password*' && trash $LOGGED_IN_USER '~/Library/Application Scripts/2BUA8C4S2C.com.agilebits' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.1password.1password-launcher' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.1password.browser-support' && trash $LOGGED_IN_USER '~/Library/Application Support/1Password' && trash $LOGGED_IN_USER '~/Library/Application Support/Arc/User Data/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.1password.1password.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/CrashReporter/1Password*' && trash $LOGGED_IN_USER '~/Library/Application Support/Google/Chrome Beta/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Google/Chrome Canary/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Google/Chrome Dev/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Google/Chrome/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft Edge Beta/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft Edge Canary/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft Edge Dev/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Microsoft Edge/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Mozilla/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Application Support/Vivaldi/NativeMessagingHosts/com.1password.1password.json' && trash $LOGGED_IN_USER '~/Library/Containers/2BUA8C4S2C.com.1password.browser-helper' && trash $LOGGED_IN_USER '~/Library/Containers/com.1password.1password*' && trash $LOGGED_IN_USER '~/Library/Containers/com.1password.browser-support' && trash $LOGGED_IN_USER '~/Library/Group Containers/2BUA8C4S2C.com.1password' && trash $LOGGED_IN_USER '~/Library/Group Containers/2BUA8C4S2C.com.agilebits' && trash $LOGGED_IN_USER '~/Library/Logs/1Password' && trash $LOGGED_IN_USER '~/Library/Preferences/com.1password.1password.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/group.com.1password.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.1password.1password.savedState'", - "version": "8.10.44", - "description": "Password manager that keeps all passwords secure behind one password", - "name": "1Password" - }, - { - "identifier": "adobe-acrobat-reader", - "bundleIdentifier": "com.adobe.Reader", - "installerFormat": "dmg:pkg", - "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.adobe.ARMDC.Communicator' && remove_launchctl_service 'com.adobe.ARMDC.SMJobBlessHelper' && remove_launchctl_service 'com.adobe.ARMDCHelper.cc24aef4a1b90ed56a725c38014c95072f92651fb65e1bf9c8e43c37a23d420d' && quit_application 'com.adobe.AdobeRdrCEF' && quit_application 'com.adobe.AdobeRdrCEFHelper' && quit_application 'com.adobe.Reader' && sudo pkgutil --forget 'com.adobe.acrobat.DC.reader.*' && sudo pkgutil --forget 'com.adobe.armdc.app.pkg' && sudo pkgutil --forget 'com.adobe.RdrServicesUpdater' && sudo rm -rf '/Applications/Adobe Acrobat Reader.app' && sudo rm -rf '/Library/Preferences/com.adobe.reader.DC.WebResource.plist' && trash $LOGGED_IN_USER '~/Library/Caches/com.adobe.Reader' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.adobe.Reader.binarycookies' && trash $LOGGED_IN_USER '~/Library/Preferences/com.adobe.AdobeRdrCEFHelper.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.adobe.crashreporter.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.adobe.Reader.plist'", - "version": "24.002.21005", - "description": "View, print, and comment on PDF documents", - "name": "Adobe Acrobat Reader" - }, - { - "identifier": "zoom-for-it-admins", - "bundleIdentifier": "us.zoom.xos", - "installerFormat": "pkg", - "uninstallScript": "LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && send_signal() { local signal=\"$1\"; local bundle_id=\"$2\"; local logged_in_user=\"$3\"; local logged_in_uid pids; if [ -z \"$signal\" ] || [ -z \"$bundle_id\" ] || [ -z \"$logged_in_user\" ]; then echo \"Usage: uninstall_signal \"; return 1 fi; logged_in_uid=$(id -u \"$logged_in_user\"); if [ -z \"$logged_in_uid\" ]; then echo \"Could not find UID for user '$logged_in_user'.\"; return 1 fi; echo \"Signalling '$signal' to application ID '$bundle_id' for user '$logged_in_user'\"; pids=$(/bin/launchctl asuser \"$logged_in_uid\" sudo -iu \"$logged_in_user\" /bin/launchctl list | awk -v bundle_id=\"$bundle_id\" '; $3 ~ bundle_id { print $1 }'); if [ -z \"$pids\" ]; then echo \"No processes found for bundle ID '$bundle_id'.\"; return 0 fi; echo \"Unix PIDs are $pids for processes with bundle identifier $bundle_id\"; for pid in $pids; do if kill -s \"$signal\" \"$pid\" 2>/dev/null; then echo \"Successfully signaled PID $pid with signal $signal.\"; else echo \"Failed to kill PID $pid with signal $signal. Check permissions.\"; fi; done sleep 3 } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'us.zoom.ZoomDaemon' && send_signal 'KILL' 'us.zoom.xos' \"$LOGGED_IN_USER\" && sudo pkgutil --forget 'us.zoom.pkg.videomeeting' && sudo rm -rf '/Applications/zoom.us.app' && sudo rm -rf '/Library/Audio/Plug-Ins/HAL/ZoomAudioDevice.driver' && sudo rm -rf '/Library/Internet Plug-Ins/ZoomUsPlugIn.plugin' && sudo rm -rf '/Library/Logs/DiagnosticReports/zoom.us*' && sudo rm -rf '/Library/PrivilegedHelperTools/us.zoom.ZoomDaemon' && trash $LOGGED_IN_USER '/Library/Preferences/us.zoom.config.plist' && trash $LOGGED_IN_USER '~/.zoomus' && trash $LOGGED_IN_USER '~/Desktop/Zoom' && trash $LOGGED_IN_USER '~/Documents/Zoom' && trash $LOGGED_IN_USER '~/Library/Application Scripts/*.ZoomClient3rd' && trash $LOGGED_IN_USER '~/Library/Application Support/CloudDocs/session/containers/iCloud.us.zoom.videomeetings' && trash $LOGGED_IN_USER '~/Library/Application Support/CloudDocs/session/containers/iCloud.us.zoom.videomeetings.plist' && trash $LOGGED_IN_USER '~/Library/Application Support/CrashReporter/zoom.us*' && trash $LOGGED_IN_USER '~/Library/Application Support/zoom.us' && trash $LOGGED_IN_USER '~/Library/Caches/us.zoom.xos' && trash $LOGGED_IN_USER '~/Library/Cookies/us.zoom.xos.binarycookies' && trash $LOGGED_IN_USER '~/Library/Group Containers/*.ZoomClient3rd' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/us.zoom.xos' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/us.zoom.xos.binarycookies' && trash $LOGGED_IN_USER '~/Library/Internet Plug-Ins/ZoomUsPlugIn.plugin' && trash $LOGGED_IN_USER '~/Library/Logs/zoom.us' && trash $LOGGED_IN_USER '~/Library/Logs/zoominstall.log' && trash $LOGGED_IN_USER '~/Library/Logs/ZoomPhone' && trash $LOGGED_IN_USER '~/Library/Mobile Documents/iCloud~us~zoom~videomeetings' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.airhost.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.caphost.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.Transcode.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.xos.Hotkey.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.xos.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/us.zoom.ZoomAutoUpdater.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/ZoomChat.plist' && trash $LOGGED_IN_USER '~/Library/Safari/PerSiteZoomPreferences.plist' && trash $LOGGED_IN_USER '~/Library/SafariTechnologyPreview/PerSiteZoomPreferences.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/us.zoom.xos.savedState' && trash $LOGGED_IN_USER '~/Library/WebKit/us.zoom.xos'", - "version": "6.2.11.43613", - "description": "Video communication and virtual meeting platform", - "name": "Zoom for IT Admins" - }, - { - "identifier": "docker", - "bundleIdentifier": "com.docker.docker", - "installerFormat": "dmg:app", - "uninstallScript": "APPDIR=\"/Applications/\" && LOGGED_IN_USER=$(scutil <<< \"show State:/Users/ConsoleUser\" | awk '/Name :/ { print $3 }') && quit_application() { local bundle_id=\"$1\"; local timeout_duration=10; if ! osascript -e \"application id \\\"$bundle_id\\\" is running\" 2>/dev/null; then return fi; local console_user; console_user=$(stat -f \"%Su\" /dev/console); if [[ $EUID -eq 0 && \"$console_user\" == \"root\" ]]; then echo \"Not logged into a non-root GUI; skipping quitting application ID '$bundle_id'.\"; return fi; echo \"Quitting application '$bundle_id'...\"; local quit_success=false; SECONDS=0; while (( SECONDS < timeout_duration )); do if osascript -e \"tell application id \\\"$bundle_id\\\" to quit\" >/dev/null 2>&1; then if ! pgrep -f \"$bundle_id\" >/dev/null 2>&1; then echo \"Application '$bundle_id' quit successfully.\"; quit_success=true; break; fi; fi; sleep 1; done if [[ \"$quit_success\" = false ]]; then echo \"Application '$bundle_id' did not quit.\"; fi } && remove_launchctl_service() { local service=\"$1\"; local booleans=(\"true\" \"false\"); local plist_status; local paths; local should_sudo; echo \"Removing launchctl service ${service}\"; for should_sudo in \"${booleans[@]}\"; do plist_status=$(launchctl list \"${service}\" 2>/dev/null); if [[ $plist_status == \\{* ]]; then if [[ $should_sudo == \"true\" ]]; then sudo launchctl remove \"${service}\"; else launchctl remove \"${service}\"; fi; sleep 1; fi; paths=(; \"/Library/LaunchAgents/${service}.plist\"; \"/Library/LaunchDaemons/${service}.plist\"; ); if [[ $should_sudo == \"false\" ]]; then for i in \"${!paths[@]}\"; do paths[i]=\"${HOME}${paths[i]}\"; done fi; for path in \"${paths[@]}\"; do if [[ -e \"$path\" ]]; then if [[ $should_sudo == \"true\" ]]; then sudo rm -f -- \"$path\"; else rm -f -- \"$path\"; fi; fi; done done } && trash() { local logged_in_user=\"$1\"; local target_file=\"$2\"; local timestamp=\"$(date +%Y-%m-%d-%s)\"; local rand=\"$(jot -r 1 0 99999)\"; if [[ \"$target_file\" == ~* ]]; then target_file=\"/Users/$logged_in_user${target_file:1}\"; fi; local trash=\"/Users/$logged_in_user/.Trash\"; local file_name=\"$(basename \"${target_file}\")\"; if [[ -e \"$target_file\" ]]; then echo \"removing $target_file.\"; mv -f \"$target_file\" \"$trash/${file_name}_${timestamp}_${rand}\"; else echo \"$target_file doesn't exist.\"; fi } && remove_launchctl_service 'com.docker.helper' && remove_launchctl_service 'com.docker.socket' && remove_launchctl_service 'com.docker.vmnetd' && quit_application 'com.docker.docker' && sudo rm -rf '/Library/PrivilegedHelperTools/com.docker.socket' && sudo rm -rf '/Library/PrivilegedHelperTools/com.docker.vmnetd' && sudo rmdir '~/.docker/bin' && sudo rm -rf \"$APPDIR/Docker.app\" && sudo rm -rf '/usr/local/bin/docker' && sudo rm -rf '/usr/local/bin/docker-credential-desktop' && sudo rm -rf '/usr/local/bin/docker-credential-ecr-login' && sudo rm -rf '/usr/local/bin/docker-credential-osxkeychain' && sudo rm -rf '/usr/local/bin/docker-index' && sudo rm -rf '/usr/local/bin/kubectl.docker' && sudo rm -rf '/usr/local/cli-plugins/docker-compose' && sudo rm -rf '/usr/local/bin/hub-tool' && sudo rmdir '~/Library/Caches/com.plausiblelabs.crashreporter.data' && sudo rmdir '~/Library/Caches/KSCrashReports' && trash $LOGGED_IN_USER '/usr/local/bin/docker-compose.backup' && trash $LOGGED_IN_USER '/usr/local/bin/docker.backup' && trash $LOGGED_IN_USER '~/.docker' && trash $LOGGED_IN_USER '~/Library/Application Scripts/com.docker.helper' && trash $LOGGED_IN_USER '~/Library/Application Scripts/group.com.docker' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.docker.helper.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/com.apple.sharedfilelist/com.apple.LSSharedFileList.ApplicationRecentDocuments/com.electron.dockerdesktop.sfl*' && trash $LOGGED_IN_USER '~/Library/Application Support/com.bugsnag.Bugsnag/com.docker.docker' && trash $LOGGED_IN_USER '~/Library/Application Support/Docker Desktop' && trash $LOGGED_IN_USER '~/Library/Caches/com.docker.docker' && trash $LOGGED_IN_USER '~/Library/Caches/com.plausiblelabs.crashreporter.data/com.docker.docker' && trash $LOGGED_IN_USER '~/Library/Caches/KSCrashReports/Docker' && trash $LOGGED_IN_USER '~/Library/Containers/com.docker.docker' && trash $LOGGED_IN_USER '~/Library/Containers/com.docker.helper' && trash $LOGGED_IN_USER '~/Library/Group Containers/group.com.docker' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.docker.docker' && trash $LOGGED_IN_USER '~/Library/HTTPStorages/com.docker.docker.binarycookies' && trash $LOGGED_IN_USER '~/Library/Logs/Docker Desktop' && trash $LOGGED_IN_USER '~/Library/Preferences/com.docker.docker.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.electron.docker-frontend.plist' && trash $LOGGED_IN_USER '~/Library/Preferences/com.electron.dockerdesktop.plist' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.electron.docker-frontend.savedState' && trash $LOGGED_IN_USER '~/Library/Saved Application State/com.electron.dockerdesktop.savedState'", - "version": "4.34.0", - "description": "App to build and share containerised applications and microservices", - "name": "Docker Desktop" - } - ], - "rituals": { - "handbook/engineering/engineering.rituals.yml": [ - { - "task": "Rotate the TUF root keys", - "startedOn": "2024-09-01", - "frequency": "Annually", - "description": "https://fleetdm.com/handbook/engineering/tuf#rotate-the-root-keys", - "moreInfoUrl": "https://fleetdm.com/handbook/engineering/tuf#rotate-the-root-keys", - "dri": "lukeheath", - "autoIssue": { - "labels": [ - "~engineering-initiated", - "P2" - ], - "repo": "fleet" - } - }, - { - "task": "Renew Apple certificate signing request (CSR)", - "startedOn": "2024-09-01", - "frequency": "Annually", - "description": "https://fleetdm.com/handbook/engineering#renew-mdm-certificate-signing-request-csr", - "moreInfoUrl": "https://fleetdm.com/handbook/engineering#renew-mdm-certificate-signing-request-csr", - "dri": "lukeheath", - "autoIssue": { - "labels": [ - "~engineering-initiated" - ], - "repo": "fleet" - } - }, - { - "task": "Oncall handoff", - "startedOn": "2023-08-09", - "frequency": "Weekly", - "description": "Hand off the oncall engineering responsibilities to the next oncall engineer.", - "moreInfoUrl": null, - "dri": "lukeheath" - }, - { - "task": "Vulnerability alerts (fleetdm.com)", - "startedOn": "2023-08-09", - "frequency": "Weekly", - "description": "Review and remediate or dismiss vulnerability alerts for the fleetdm.com codebase on GitHub.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/security", - "dri": "eashaw" - }, - { - "task": "Vulnerability alerts (frontend)", - "startedOn": "2023-08-09", - "frequency": "Weekly", - "description": "Review and remediate or dismiss vulnerability alerts for the Fleet frontend codebase (and related JS) on GitHub.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/security", - "dri": "lukeheath" - }, - { - "task": "Vulnerability alerts (backend)", - "startedOn": "2023-08-09", - "frequency": "Weekly", - "description": "Review and remediate or dismiss vulnerability alerts for the Fleet backend codebase (and all Go code) on GitHub.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/security", - "dri": "lukeheath" - }, - { - "task": "Release candidate ritual", - "startedOn": "2023-08-09", - "frequency": "Triweekly", - "description": "Go through the process of creating a release candidate.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/blob/main/tools/release/README.md#minor-release-typically-end-of-sprint", - "dri": "lukeheath" - }, - { - "task": "Release ritual", - "startedOn": "2023-08-09", - "frequency": "Triweekly", - "description": "Go through the process of releasing the next iteration of Fleet.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md", - "dri": "lukeheath" - }, - { - "task": "Create patch release branch", - "startedOn": "2023-08-09", - "frequency": "Every patch release", - "description": "Go through the process of creating a patch release branch, cherry picking commits, and pushing the branch to github.com/fleetdm/fleet.", - "moreInfoUrl": "https://github.com/fleetdm/fleet/blob/main/docs/Contributing/Releasing-Fleet.md#patch-releases", - "dri": "lukeheath" - }, - { - "task": "Bug review", - "startedOn": "2023-08-09", - "frequency": "Weekly", - "description": "Review bugs that are in QA's inbox.", - "moreInfoUrl": "https://www.fleetdm.com/handbook/company/product-groups#inbox", - "dri": "xpkoala" - }, - { - "task": "QA report", - "startedOn": "2023-08-09", - "frequency": "Triweekly", - "description": "Every release cycle, on the Monday of release week, update the DRI for the release ritual on status of testing.", - "moreInfoUrl": null, - "dri": "xpkoala" - }, - { - "task": "Release QA", - "startedOn": "2023-08-09", - "frequency": "Triweekly", - "description": "Every release cycle, by end of day Friday of release week, move all issues to the ”✅ Ready for release” column on the #g-mdm and #g-endpoint-ops sprint boards.", - "moreInfoUrl": null, - "dri": "xpkoala" - }, - { - "task": "Review ongoing articles", - "startedOn": "2023-10-02", - "frequency": "Daily", - "description": "Check 📃 Planned articles and complete steps in each issue", - "moreInfoUrl": "https://fleetdm.com/handbook/demand#review-ongoing-articles", - "dri": "rachaelshaw" - } - ], - "handbook/finance/finance.rituals.yml": [ - { - "task": "Communicate the status of customer financial actions", - "startedOn": "2024-02-12", - "frequency": "Weekly", - "description": "At the start of every week, check the Salesforce reports for past due invoices, non-invoiced opportunities, and past due renewals. Report findings to in the `#g-sales` channel.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#communicate-the-status-of-customer-financial-actions", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "AP invoice monitoring", - "startedOn": "2024-04-01", - "frequency": "Weekly", - "description": "Look for new accounts payable invoices and make sure that Fleet's suppliers are paid.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#process-a-new-vendor-invoice", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Complete Finance KPI inputs", - "startedOn": "2024-02-16", - "frequency": "Weekly", - "description": "Create the weekly team KPI issue, complete the finance update.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#update-weekly-kpis", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Key review prep", - "startedOn": "2024-02-14", - "frequency": "Triweekly", - "description": "Prepare for this sprint's Key review meeting.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/leadership#key-reviews", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Prioritize for next sprint", - "startedOn": "2023-08-09", - "frequency": "Triweekly", - "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Reconcile monthly recurring expenses", - "startedOn": "2024-02-28", - "frequency": "Monthly", - "description": "Each month, update the inputs in “The numbers” spreadsheet to reflect the actuals for recurring non-personnel spend, and identify any unexpected increase or decrease in spend.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#reconcile-monthly-recurring-expenses", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Monthly accounting", - "startedOn": "2024-02-28", - "frequency": "Monthly", - "description": "Create the monthly close GitHub issue and walk through the steps. This process includes fulfilling the monthly reporting requirement for SVB.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#process-monthly-accounting", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Run regular payroll", - "startedOn": "2024-02-24", - "frequency": "Monthly", - "description": "Verify auto-populated payroll for all full time employees is accurate, and approve for processing.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-payroll", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Monthly mail review", - "startedOn": "2024-04-15", - "frequency": "Monthly", - "description": "Review and clear mail incurring storage fees", - "moreInfoUrl": null, - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Run US contractor payroll", - "startedOn": "2024-02-27", - "frequency": "Monthly", - "description": "Manually process US contractor payroll by verifying and syncing time contractor worked, then processing payment.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-us-contractor-payroll", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Run US commission payroll", - "startedOn": "2024-01-31", - "frequency": "Monthly", - "description": "Verify closed-won deal amounts, use commission calculators to determine commissions owed, and process payroll.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-us-commission-payroll", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Run bonus payroll", - "startedOn": "2024-01-31", - "frequency": "Quarterly", - "description": "Verify completion of any objective or outcome based bonus plans, and process payroll.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#run-us-commission-payroll", - "dri": "ireedy" - }, - { - "task": "Review state filings for the previous quarter", - "startedOn": "2024-07-19", - "frequency": "Quarterly", - "description": "Verify that state filings have been successfully submitted for the previous quarter", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#review-state-employment-tax-filings-for-the-previous-quarter", - "dri": "ireedy" - }, - { - "task": "Investor reporting", - "startedOn": "2024-03-31", - "frequency": "Quarterly", - "description": "Provide updated metrics for CRV in Chronograph.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#report-quarterly-numbers-in-chronograph", - "dri": "ireedy" - }, - { - "task": "Quartlery finance check", - "startedOn": "2024-03-31", - "frequency": "Quarterly", - "description": "Every quarter, we check Quickbooks Online (QBO) for discrepancies and follow up with accounting providers for any quirks found.", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#check-finances-for-quirks", - "dri": "ireedy" - }, - { - "task": "Deliver annual report for venture line", - "startedOn": "2024-12-01", - "frequency": "Annually", - "description": "Within 60 days of the new year, provide financial statements to SVB, along with board-approved projections for the new year", - "moreInfoUrl": "https://fleetdm.com/handbook/finance#deliver-annual-report-for-venture-line", - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - }, - { - "task": "Tax preparation", - "startedOn": "2024-02-01", - "frequency": "Annually", - "description": "Provide information to tax team with Deloitte and assist with filing and paying state and federal returns", - "moreInfoUrl": null, - "dri": "ireedy", - "autoIssue": { - "labels": [ - "#g-finance" - ], - "repo": "confidential" - } - } - ], - "handbook/sales/sales.rituals.yml": [ - { - "task": "Prioritize for next sprint", - "startedOn": "2023-09-04", - "frequency": "Triweekly", - "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible", - "dri": "alexmitchelliii", - "autoIssue": { - "labels": [ - "#g-sales" - ], - "repo": "confidential" - } - }, - { - "task": "Review Salesforce opportunities", - "startedOn": "2024-12-02", - "frequency": "Weekly", - "description": "https://fleetdm.com/handbook/sales#review-salesforce-opportunities", - "moreInfoUrl": "https://fleetdm.com/handbook/sales#review-salesforce-opportunities", - "dri": "alexmitchelliii", - "autoIssue": { - "labels": [ - "#g-sales" - ], - "repo": "confidential" - } - } - ], - "handbook/product-design/product-design.rituals.yml": [ - { - "task": "🦢📊 Design sprint review", - "startedOn": "2024-03-07", - "frequency": "Triweekly", - "description": "1. For all stories that are not estimated, add their respective customer requests to the feature fest board. For stories that we're no longer working on, remove them from the drafting board, remove their respective customer requests from the 💝 Customer requests board, and notify stakeholders. 2. Record the number of dropped stories for KPIs (all user stories that did not meet the 3 week drafting timeline). 3. Retro: What went well? What could go better? What to remember for next time?", - "moreInfoUrl": null, - "dri": "noahtalerman" - }, - { - "task": "🎁 Feature fest", - "startedOn": "2024-03-07", - "frequency": "Triweekly", - "description": "We make a decision regarding which feature requests can be prioritized.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/product-groups#feature-fest", - "dri": "noahtalerman" - }, - { - "task": "Design sprint kickoff", - "startedOn": "2024-03-07", - "frequency": "Triweekly", - "description": "Add stories prioritized during Feature fest to Drafting board, assign stories to product designers, create upcoming reference docs release branch, and align on priorities.", - "moreInfoUrl": null, - "dri": "noahtalerman" - }, - { - "task": "Sprint kickoff review", - "startedOn": "2024-03-07", - "frequency": "Triweekly", - "description": "Review stories that made it into this sprint and stories that didn't make it into this sprint. Ensure stories/bugs have been effectively prioritized across teams. After the call, the Head of Product Design @ mentions the API design DRI in #help-design about stories that didn't make it into the sprint so that they can update the reference docs release branches.", - "moreInfoUrl": null, - "dri": "noahtalerman" - }, - { - "task": "🦢🗣 Design review", - "startedOn": "2024-03-07", - "frequency": "Daily", - "description": "On Mondays, contributors present wireframes in 'Feedback' mode and anyone can give feedback. 'Final review' mode during all other days and only Head of Product Design + CTO + Product Designers give feedback.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/product-groups#design-reviews", - "dri": "noahtalerman" - }, - { - "task": "🦢📨 Unpacking the 'why'", - "startedOn": "2024-09-30", - "frequency": "Daily", - "description": "Break down the 'why' for new customer requests in the 'Inbox' column on the drafting board.", - "moreInfoUrl": "https://fleetdm.com/handbook/product-design#unpacking-the-why", - "dri": "noahtalerman" - }, - { - "task": "Quarterly roadmap blog post", - "startedOn": "2024-11-05", - "frequency": "Monthly", - "description": "Every quarter, Head of Product Design (HPD) writes a short blog post with the theme and an embedded YouTube video in which HPD walks through this.", - "moreInfoUrl": "", - "dri": "noahtalerman", - "autoIssue": { - "labels": [ - ":product" - ], - "repo": "fleet" - } - }, - { - "task": "🦢👁️ Product design check-in", - "startedOn": "2023-07-11", - "frequency": "Weekly", - "description": "The Head of Product Design summarizes the current week's design reviews to discuss with the CEO", - "moreInfoUrl": "https://fleetdm.com/handbook/product-design#product-design-check-in", - "dri": "noahtalerman" - }, - { - "task": "🦢🗣 Product office hours", - "startedOn": "2023-07-11", - "frequency": "Weekly", - "description": "Head of Product Design + any other contributors who would like to attend. 30 minutes reserved to talk about any product.", - "moreInfoUrl": "https://docs.google.com/document/d/1Znyp2a9qcM9JdYHrzLudvcPwEdhnCg7RiKi22s8yGWw/edit", - "dri": "noahtalerman" - }, - { - "task": "Maintenance", - "startedOn": "2024-03-01", - "frequency": "Weekly", - "description": "Head of Product Design checks the latest versions of relevant platforms, updates the maintenance tracker, and notifies the #g-mdm and #g-endpoint-ops Slack channel.", - "moreInfoUrl": "https://docs.google.com/spreadsheets/d/1IWfQtSkOQgm_JIQZ0i2y3A8aaK5vQW1ayWRk6-4FOp0/edit?gid=0#gid=0", - "dri": "noahtalerman" - }, - { - "task": "🦢✅🎉Product confirm and celebrate", - "startedOn": "2024-02-27", - "frequency": "Triweekly", - "description": "Review the checkboxes in user stories we shipped but haven't closed. Are they done? If not notify relevant contributor to help get them done.", - "moreInfoUrl": null, - "dri": "noahtalerman" - }, - { - "task": "Pre-sprint prioritization", - "startedOn": "2024-02-27", - "frequency": "Triweekly", - "description": "Align on priorities for upcoming sprint.", - "dri": "noahtalerman" - } - ], - "handbook/customer-success/customer-success.rituals.yml": [ - { - "task": "Prioritize for next sprint", - "startedOn": "2023-09-04", - "frequency": "Triweekly", - "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible", - "dri": "zayhanlon", - "autoIssue": { - "labels": [ - "#g-customer-success" - ], - "repo": "confidential" - } - }, - { - "task": "Process new requests", - "startedOn": "2023-09-04", - "frequency": "Daily", - "description": "Prioritize all new requests including issues and PRs within one business day.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/communications#process-new-requests", - "dri": "zayhanlon" - }, - { - "task": "Overnight customer feedback", - "startedOn": "2024-02-08", - "frequency": "Daily", - "description": "Respond to messages and alerts", - "moreInfoUrl": "https://fleetdm.com/handbook/customer-success#respond-to-messages-and-alerts", - "dri": "ksatter" - }, - { - "task": "Monitor customer Slack channels ", - "startedOn": "2024-02-08", - "frequency": "Daily", - "description": "Continuously monitor Slack for customer feedback, feature requests, reported bugs, etc., and respond in less than an hour.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/communications#customer-support-service-level-agreements-slas", - "dri": "ksatter" - }, - { - "task": "Follow-up on unresolved customer questions and concerns", - "startedOn": "2024-02-08", - "frequency": "Daily", - "description": "Follow-up with and tag appropriate personnel on customer issues and bugs in progress and items that remain unresolved.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/communications#customer-support-service-level-agreements-slas", - "dri": "ksatter" - }, - { - "task": "Prepare for customer voice", - "startedOn": "2024-02-23", - "frequency": "Weekly", - "description": "Prepare and review the health and latest updates from Fleet's key customers and active proof of concepts (POCs).", - "moreInfoUrl": "", - "dri": "patagonia121" - }, - { - "task": "Prepare customer requests for feature fest", - "startedOn": "2024-02-12", - "frequency": "Triweekly", - "description": "Check-in before the 🗣️ Product Feature Requests meeting to make sure that all information necessary has been gathered before presenting customer requests and feedback to the Product team.", - "moreInfoUrl": "", - "dri": "nonpunctual" - }, - { - "task": "Present customer requests at feature fest", - "startedOn": "2024-02-15", - "frequency": "Triweekly", - "description": "Present and advocate for requests and ideas brought to Fleet's attention by customers that are interesting from a product perspective.", - "moreInfoUrl": "", - "dri": "nonpunctual" - }, - { - "task": "Communicate release notes to stakeholders", - "startedOn": "2024-02-21", - "frequency": "Triweekly", - "description": "Update customers on new features and resolved bugs in an upcoming release.", - "moreInfoUrl": "", - "dri": "patagonia121" - }, - { - "task": "Upgrade Managed Cloud", - "startedOn": "2024-02-08", - "frequency": "Weekly", - "description": "Upgrade each Managed Cloud instance to the latest version of Fleet", - "moreInfoUrl": "https://github.com/fleetdm/fleet/releases", - "dri": "rfairburn" - } - ], - "handbook/digital-experience/digital-experience.rituals.yml": [ - { - "task": "Complete Digital Experience KPIs and send weekly update", - "startedOn": "2024-08-30", - "frequency": "Weekly", - "description": "Complete Digital Experience KPIs for this week", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#send-the-weekly-update", - "dri": "SFriendLee", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "fleet" - } - }, - { - "task": "Confirm consultant hours", - "startedOn": "2024-09-30", - "frequency": "Weekly", - "description": "Perform step three in “Inform managers about hours worked” responsibility", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#inform-managers-about-hours-worked", - "dri": "SFriendLee", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "fleet" - } - }, - { - "task": "Prep 1:1s for OKR planning", - "startedOn": "2024-09-09", - "frequency": "Monthly", - "description": "Add ”DISCUSS: Mike: Expectations of OKR planning“ to each e-group member's 1:1 document", - "moreInfoUrl": "https://docs.google.com/spreadsheets/d/1Hso0LxqwrRVINCyW_n436bNHmoqhoLhC8bcbvLPOs9A/edit", - "dri": "SFriendLee", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "fleet" - } - }, - { - "task": "Check browser compatibility for fleetdm.com", - "startedOn": "2024-03-06", - "frequency": "Monthly", - "description": "Use Browserstack to manually QA pages on fleetdm.com in each of the earliest supported browser versions", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-browser-compatibility-for-fleetdm-com", - "dri": "eashaw", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "fleet" - } - }, - { - "task": "Regenerate messaging framework", - "startedOn": "2024-07-15", - "frequency": "Quarterly", - "description": "Run through the entire website in `?utm_content=clear` mode and build a fresh outline of the headings to make sure they all still make sense.", - "moreInfoUrl": "", - "dri": "mike-j-thomas" - }, - { - "task": "Check brand fronts are up to date", - "startedOn": "2024-08-01", - "frequency": "Quarterly", - "description": "Check all brand fronts for consistancy and update as needed with the current product pitch and graphics.", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#update-a-company-brand-front", - "dri": "mike-j-thomas" - }, - { - "task": "Check production dependencies of fleetdm.com", - "startedOn": "2023-11-10", - "frequency": "Weekly", - "description": "Check for vulnerabilities on the production dependencies of fleetdm.com.", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-production-dependencies-of-fleetdm-com", - "dri": "eashaw", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "fleet" - } - }, - { - "task": "Check osquery Slack invitation", - "startedOn": "2023-11-10", - "frequency": "Monthly", - "description": "Check the osquery Slack invitation that is linked to from Fleet and the Fleet website to make sure it is valid.", - "moreInfoUrl": "https://fleetdm.com/slack", - "dri": "eashaw", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "fleet" - } - }, - { - "task": "Prepare for CEO office minutes", - "startedOn": "2023-12-18", - "frequency": "Daily", - "description": "Prepare the CEO office minutes calendar event and meeting agenda", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#prepare-for-ceo-office-minutes", - "dri": "SFriendLee" - }, - { - "task": "Prioritize for next sprint", - "startedOn": "2023-08-09", - "frequency": "Triweekly", - "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible", - "dri": "sampfluger88", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "confidential" - } - }, - { - "task": "Process the CEO's inbox", - "startedOn": "2023-07-29", - "frequency": "Daily ⏰", - "description": "Process the CEO's inbox", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-the-ceos-email", - "dri": "SFriendLee" - }, - { - "task": "Process all \"New requests\" on the #g-digital-experience kanban board", - "startedOn": "2023-07-29", - "frequency": "Daily ⏰", - "description": "Process and prioritize all new issues and PRs", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-new-requests-from-the-g-ceo-kanban-board", - "dri": "sampfluger88" - }, - { - "task": "Process the CEO's calendar", - "startedOn": "2023-07-29", - "frequency": "Daily ⏰", - "description": "Process the CEO's calendar", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-the-ceos-calendar", - "dri": "SFriendLee" - }, - { - "task": "Process and backup E-group agenda", - "startedOn": "2023-09-20", - "frequency": "Weekly", - "description": "Process and backup E-group agenda", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-and-backup-sid-agenda", - "dri": "SFriendLee", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "confidential" - } - }, - { - "task": "Process and backup Sid agenda", - "startedOn": "2023-09-25", - "frequency": "Monthly", - "description": "Process and backup Sid agenda", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#process-and-backup-e-group-agenda", - "dri": "SFriendLee", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "confidential" - } - }, - { - "task": "Share recording of all hands meeting", - "startedOn": "2023-07-01", - "frequency": "Monthly", - "description": "Sharing the all hands recording", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#share-recording-of-all-hands-meeting", - "dri": "SFriendLee", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "confidential" - } - }, - { - "task": "Prepare all hands deck", - "startedOn": "2023-07-01", - "frequency": "Monthly", - "description": "Preparing the all hands deck", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#preparing-for-the-all-hands", - "dri": "sampfluger88", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "confidential" - } - }, - { - "task": "Prepare board deck", - "startedOn": "2023-09-25", - "frequency": "Quarterly", - "description": "Prepare slide deck for the next board meeting", - "dri": "sampfluger88" - }, - { - "task": "Process CEO GitHub review requests, mentions, and outstanding PRs", - "startedOn": "2023-07-29", - "frequency": "Daily", - "description": "Filter all action items from CEO's GitHub notifications", - "dri": "SFriendLee" - }, - { - "task": "Check LinkedIn for unread messages", - "startedOn": "2023-09-25", - "frequency": "Daily", - "description": "Prevent connections from slipping through the cracks", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-linkedin-for-unread-messages", - "dri": "SFriendLee" - }, - { - "task": "Downgrade unused license seats", - "startedOn": "2024-03-31", - "frequency": "Quarterly", - "description": "Downgrade unused or questionable license seats on the first Wednesday of every quarter", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#downgrade-an-unused-license-seat", - "dri": "sampfluger88" - }, - { - "task": "Communicate Fleet's potential energy to stakeholders", - "startedOn": "2024-05-01", - "frequency": "Monthly", - "description": "Via hand or automation, send a monthly update email to all investors that hold 4% equity or greater in Fleet who have opted in to receive emails on the company's progress.", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#communicate-fleets-potential-energy-to-stakeholders", - "dri": "SFriendLee", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "confidential" - } - }, - { - "task": "Vanta check", - "startedOn": "2024-04-01", - "frequency": "Monthly", - "description": "Look for any new actions in Vanta due in the upcoming months and create issues to ensure they're done on time.", - "moreInfoUrl": null, - "dri": "sampfluger88", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "confidential" - } - }, - { - "task": "Recognize and benchmark workiversaries", - "startedOn": "2024-07-15", - "frequency": "Monthly", - "description": "Identify workiversaries coming up in the next two months and follow the steps to ensure they're recognized and benchmarked", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#recognize-employee-workiversaries", - "dri": "SFriendLee", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "confidential" - } - }, - { - "task": "Quarterly grants", - "startedOn": "2024-02-01", - "frequency": "Quarterly", - "description": "Create the equity grants GitHub issue and walk through the steps.", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#grant-equity", - "dri": "hollidayn" - }, - { - "task": "Change password of \"Integrations admin\" Salesforce account", - "startedOn": "2024-09-10", - "frequency": "Quarterly", - "description": "Log into the \"Integrations admin\" account in Salesforce and change the password to prevent a password change being required by Salesforce.", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#change-the-integrations-admin-salesforce-account-password", - "dri": "eashaw" - }, - { - "task": "Check GitHub/GitLab terms", - "startedOn": "2023-10-24", - "frequency": "Annually", - "description": "Check GitHub's terms to make sure the “inbound=outbound” clause is unchanged.", - "moreInfoUrl": "https://fleetdm.com/handbook/digital-experience#check-github-terms", - "dri": "hollidayn", - "autoIssue": { - "labels": [ - "#g-digital-experience" - ], - "repo": "confidential" - } - }, - { - "task": "Check that there is sufficient availability for scheduling demos via fleetdm.com/contact", - "startedOn": "2024-10-25", - "frequency": "Weekly", - "description": "Check out the meeting booking flow that you get when you schedule a demo from Fleet's contact form, and make sure there is plenty of availability for the rest of the day in US PT thru ET, with significant spots open in the morning (US time) for folks in EMEA and at least one or two spots open in the evening (US time) for folks in APAC / Hawaii.", - "moreInfoUrl": "", - "dri": "onasismunro" - } - ], - "handbook/demand/demand.rituals.yml": [ - { - "task": "Refresh event calendar", - "startedOn": "2023-12-31", - "frequency": "Quarterly", - "description": "https://fleetdm.com/handbook/demand#refresh-event-calendar", - "moreInfoUrl": "https://fleetdm.com/handbook/demand#refresh-event-calendar", - "dri": "Drew-P-drawers" - }, - { - "task": "Prioritize for next sprint", - "startedOn": "2023-09-04", - "frequency": "Triweekly", - "description": "Using your departmental kanban board, prioritize and finalize next sprint's goals for your team by draging the appropriate issues to the top of the 'Not yet' column.", - "moreInfoUrl": "https://fleetdm.com/handbook/company/why-this-way#why-make-work-visible", - "dri": "mikermcneil", - "autoIssue": { - "labels": [ - "#g-demand" - ], - "repo": "confidential" - } - }, - { - "task": "Settle event strategy", - "startedOn": "2024-01-02", - "frequency": "Quarterly (first Tuesday)", - "description": "https://fleetdm.com/handbook/demand#settle-event-strategy", - "moreInfoUrl": "https://fleetdm.com/handbook/demand#settle-event-strategy", - "dri": "Drew-P-drawers" - }, - { - "task": "🫧 Pipeline sync", - "startedOn": "2024-08-29", - "frequency": "Weekly", - "description": "Allign with CRO and AEs on pipeline processes and incoming leads", - "moreInfoUrl": "", - "dri": "Drew-P-drawers" - }, - { - "task": "Optimize ads", - "startedOn": "2024-02-26", - "frequency": "Weekly", - "description": "Remove all but the top 5 perfoming ads in each evergreen campaign. Make sure ABM campaigns are using top performing evergreen ads.", - "moreInfoUrl": "https://fleetdm.com/handbook/demand#optimize-ads-through-experimentation", - "dri": "Drew-P-drawers" - }, - { - "task": "Process pending swag requests from the website", - "startedOn": "2023-09-20", - "frequency": "Weekly", - "description": "Complete draft orders.", - "moreInfoUrl": "https://fleetdm.com/handbook/demand#process-pending-swag-requests-from-the-website", - "dri": "Drew-P-drawers" - }, - { - "task": "Engage with the community", - "startedOn": "2023-09-20", - "frequency": "Daily", - "description": "Find relevant conversations with the community and contribute", - "moreInfoUrl": "https://fleetdm.com/handbook/demand#engage-with-the-community", - "dri": "Drew-P-drawers" - }, - { - "task": "Publish ☁️🌈 Sprint demos", - "startedOn": "2023-11-03", - "frequency": "Triweekly", - "description": "Every release cycle, upload the ☁️🌈 Sprint demos video to YouTube", - "moreInfoUrl": "https://fleetdm.com/handbook/demand#upload-to-youtube", - "dri": "Drew-P-drawers" - }, - { - "task": "Measure intent signals", - "startedOn": "2024-08-09", - "frequency": "Daily", - "description": "Measure intent signals and update Salesforce", - "moreInfoUrl": "https://fleetdm.com/handbook/demand#measure-intent-signals", - "dri": "Drew-P-drawers" - }, - { - "task": "Research accounts", - "startedOn": "2024-08-09", - "frequency": "Daily", - "description": "Research any research-ready accounts in this Salesforce report (https://fleetdm.lightning.force.com/lightning/r/Report/00OUG000001PUIT2A4/view) and advance them to 'Ads running'", - "moreInfoUrl": "https://fleetdm.com/handbook/demand#research-an-account", - "dri": "Drew-P-drawers" - }, - { - "task": "Check ongoing events", - "startedOn": "2024-10-21", - "frequency": "Daily", - "description": "Check event issues and complete steps.", - "moreInfoUrl": "https://fleetdm.com/handbook/engineering#book-an-event", - "dri": "Drew-P-drawers" - }, - { - "task": "Propose a Fleet event", - "startedOn": "2023-10-21", - "frequency": "Weekly", - "description": "Populate ideas for future events", - "moreInfoUrl": "https://fleetdm.com/handbook/demand#settle-event-strategy", - "dri": "Drew-P-drawers" - } - ] - }, - "testimonials": [ - { - "quote": "Yes Sir. Great tools for the everyday open-source geeks 💯", - "quoteAuthorName": "Alvaro Gutierrez", - "quoteAuthorProfileImageFilename": "testimonial-authour-alvaro-gutierrez-100x100@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/aantoniogutierrez/", - "quoteAuthorJobTitle": "Technology Evangelist", - "productCategories": [ - "Observability", - "Software management" - ] - }, - { - "quote": "Fleet / osquery are some of my favorite open source detection tooling.", - "quoteAuthorName": "Joe Pistone", - "quoteAuthorProfileImageFilename": "testimonial-author-joe-pistone-100x100@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/josephpistone/", - "quoteAuthorJobTitle": "Manager, Security Operations", - "productCategories": [ - "Observability" - ] - }, - { - "quote": "Fleet's extremely wide and diverse set of data allows us to answer questions that we didn't even know we had. On top of that, the experience is near instantaneous. Seconds to sort through billions of data points and return the exact handful that we need, with complete auditing and transparency. We're able to address reliability and compliance concerns without sacrificing a single point-of-a-percent of performance for our servers. All of this done consistently and continuously.", - "quoteAuthorName": "Charles Zaffery", - "quoteAuthorProfileImageFilename": "testimonial-author-charles-zaffery-48x48@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/charleszaffery/", - "quoteAuthorJobTitle": "Principle Computer Janitor", - "productCategories": [ - "Observability" - ] - }, - { - "quote": "The visibility down into the assets covered by the agent is phenomenal. Fleet has become the central source for a lot of things.", - "quoteAuthorName": "Andre Shields", - "quoteAuthorProfileImageFilename": "testimonial-author-andre-shields-48x48@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/andre-shields/", - "quoteImageFilename": "social-proof-rivian-107x24@2x.png", - "quoteAuthorJobTitle": "Staff Cybersecurity Engineer, Vulnerability Management", - "youtubeVideoUrl": "https://www.youtube.com/watch?v=siXy9aanOu4", - "productCategories": [ - "Observability", - "Software management" - ], - "videoIdForEmbed": "siXy9aanOu4", - "imageHeight": 24 - }, - { - "quote": "I love the steady and consistent delivery of features that help teams work how they want to work, not how your product dictates they work.", - "quoteImageFilename": "social-proof-logo-atlassian-192x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/danielgrzelak/", - "quoteAuthorName": "Dan Grzelak", - "quoteAuthorProfileImageFilename": "testimonial-author-daniel-grzelak-48x48@2x.png", - "quoteAuthorJobTitle": "Security Chief of Staff", - "productCategories": [ - "Observability", - "Software management", - "Device management" - ], - "imageHeight": 32 - }, - { - "quote": "We can build it exactly the way we want it. Which is just not possible on other platforms.", - "quoteAuthorName": "Austin Anderson", - "quoteAuthorProfileImageFilename": "testimonial-author-austin-anderson-48x48@2x.png", - "quoteAuthorJobTitle": "Cybersecurity team senior manager", - "quoteLinkUrl": "https://www.linkedin.com/in/austin-anderson-73172185/", - "youtubeVideoUrl": "https://www.youtube.com/watch?v=G5Ry_vQPaYc", - "productCategories": [ - "Observability", - "Software management" - ], - "videoIdForEmbed": "G5Ry_vQPaYc" - }, - { - "quote": "Exciting. This is a team that listens to feedback.", - "quoteImageFilename": "social-proof-logo-uber-71x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/eriknicolasgomez/", - "quoteAuthorName": "Erik Gomez", - "quoteAuthorProfileImageFilename": "testimonial-author-erik-gomez-48x48@2x.png", - "quoteAuthorJobTitle": "Staff Client Platform Engineer", - "productCategories": [ - "Observability", - "Device management", - "Software management" - ], - "imageHeight": 32 - }, - { - "quote": "Context is king for device data, and Fleet provides a way to surface that information to our other teams and partners.", - "quoteAuthorName": "Nick Fohs", - "quoteAuthorProfileImageFilename": "testimonial-author-nick-fohs-24x24@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/nickfohs/", - "quoteAuthorJobTitle": "Systems and infrastructure manager", - "youtubeVideoUrl": "https://www.youtube.com/watch?v=fs5ULAR4e4A", - "productCategories": [ - "Observability", - "Device management", - "Software management" - ], - "videoIdForEmbed": "fs5ULAR4e4A" - }, - { - "quote": "Keeping up with the latest issues in endpoint security is a never-ending task, because engineers have to regularly ensure every laptop and server is still sufficiently patched and securely configured. The problem is, software vendors release new versions all the time, and no matter how much you lock it down, end users find ways to change things.", - "quoteImageFilename": "social-proof-logo-lyft-47x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/nwaisman/", - "quoteAuthorName": "Nico Waisman", - "quoteAuthorProfileImageFilename": "testimonial-author-nico-waisman-48x48@2x.png", - "quoteAuthorJobTitle": "CISO of Lyft", - "productCategories": [ - "Observability", - "Software management" - ], - "imageHeight": 32 - }, - { - "quote": "Having the freedom to take full advantage of the product is one of the reasons why I always support open-source products with a commercially-backed company, like Fleet.", - "quoteImageFilename": "social-proof-logo-lyft-47x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/posts/nwaisman_movingtofleet-activity-7156319785981509632-bk_W", - "quoteAuthorName": "Nico Waisman", - "quoteAuthorProfileImageFilename": "testimonial-author-nico-waisman-48x48@2x.png", - "quoteAuthorJobTitle": "CISO of Lyft", - "productCategories": [ - "Device management" - ], - "imageHeight": 32 - }, - { - "quote": "I had to answer some really complex questions for a compliance audit, and I was able to do it in about 15 minutes by munging some data together via a few queries into a csv. It took me longer to remember how to use `xsv` than to actually put together the report. If you aren't using osquery in your environment, you should be.", - "quoteAuthorName": "Charles Zaffery", - "quoteAuthorProfileImageFilename": "testimonial-author-charles-zaffery-48x48@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/charleszaffery/", - "quoteAuthorJobTitle": "Principle Computer Janitor", - "productCategories": [ - "Software management" - ] - }, - { - "quote": "Fleet has been highly effective for our needs. We appreciate your team for always being so open to hearing our feedback.", - "quoteAuthorName": "Kenny Botelho", - "quoteAuthorProfileImageFilename": "testimonial-author-kenny-botelho-48x48@2x.png", - "quoteAuthorJobTitle": "Client Platform IT Engineer / Leader", - "quoteLinkUrl": "https://www.linkedin.com/in/kennybotelho/", - "productCategories": [ - "Observability", - "Device management", - "Software management" - ] - }, - { - "quote": "Mad props to how easy making a deploy pkg of the agent was. I wish everyone made stuff that easy.", - "quoteImageFilename": "social-proof-logo-stripe-67x32@2x.png", - "quoteAuthorName": "Wes Whetstone", - "quoteAuthorProfileImageFilename": "testimonial-author-wes-whetstone-48x48@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/jckwhet/", - "quoteAuthorJobTitle": "Staff CPE at Stripe", - "productCategories": [ - "Observability", - "Device management", - "Software management" - ], - "imageHeight": 32 - }, - { - "quote": "Fleet’s come a long way - to now being the top open-source osquery manager.", - "quoteImageFilename": "social-proof-logo-atlassian-192x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/bshak/", - "quoteAuthorName": "Brendan Shaklovitz", - "quoteAuthorProfileImageFilename": "testimonial-author-brendan-shaklovitz-48x48@2x.png", - "quoteAuthorJobTitle": "Senior SRE", - "productCategories": [ - "Observability" - ], - "imageHeight": 32 - }, - { - "quote": "It’s great to see the new release of Fleet containing some really cool new features that make osquery much more usable in practical environments. I’m really impressed with the work that Zach Wasserman and the crew are doing at Fleet.", - "quoteImageFilename": "social-proof-logo-osquery-124x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/marpaia/", - "quoteAuthorName": "Mike Arpaia", - "quoteAuthorProfileImageFilename": "testimonial-author-mike-arpaia-48x48@2x.png", - "quoteAuthorJobTitle": "Creator of osquery", - "productCategories": [ - "Observability" - ], - "imageHeight": 32 - }, - { - "quote": "Osquery is one of the best tools out there and Fleet makes it even better. Highly recommend it if you want to monitor, detect and investigate threats on a scale and also for infra/sys admin. I have used it on 15k servers and it’s really scalable.", - "quoteImageFilename": "social-proof-logo-salesforce-48x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/anelshaer/", - "quoteAuthorName": "Ahmed Elshaer", - "quoteAuthorProfileImageFilename": "testimonial-author-ahmed-elshaer-48x48@2x.png", - "quoteAuthorJobTitle": "DFIR, Blue Teaming, SecOps", - "productCategories": [ - "Observability" - ], - "imageHeight": 32 - }, - { - "quote": "With the power of osquery, you need a scalable & resilient platform to manage your workloads. Fleet is the \"just right\" open-source, enterprise grade solution.", - "quoteImageFilename": "social-proof-logo-comcast-91x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/abubakar-yousafzai-b7213659/", - "quoteAuthorName": "Abubakar Yousafzai", - "quoteAuthorProfileImageFilename": "testimonial-author-abubakar-yousafzai-48x48@2x.png", - "quoteAuthorJobTitle": "Security Software Development & Engineering", - "productCategories": [ - "Observability" - ], - "imageHeight": 32 - }, - { - "quote": "One of the best teams out there to go work for and help shape security platforms.", - "quoteImageFilename": "social-proof-logo-deloitte-130x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/neondhruv/", - "quoteAuthorName": "Dhruv Majumdar", - "quoteAuthorProfileImageFilename": "testimonial-author-dhruv-majumdar-48x48@2x.png", - "quoteAuthorJobTitle": "Director Of Cyber Risk & Advisory", - "productCategories": [ - "Software management", - "Observability" - ], - "imageHeight": 32 - }, - { - "quote": "Fleet has such a huge amount of use cases. My goal was to get telemetry on endpoints, but then our IR team, our TBM team, and multiple other folks in security started heavily utilizing the system in ways I didn’t expect. It spread so naturally, even our corporate and infrastructure teams want to run it.", - "quoteAuthorName": "charles zaffery", - "quoteLinkUrl": "https://www.linkedin.com/in/charleszaffery/", - "quoteAuthorJobTitle": "Principle computer janitor", - "quoteAuthorProfileImageFilename": "testimonial-author-charles-zaffery-48x48@2x.png", - "youtubeVideoUrl": "https://www.youtube.com/watch?v=nRbZJflWqCo", - "productCategories": [ - "Observability" - ], - "videoIdForEmbed": "nRbZJflWqCo" - }, - { - "quote": "I don't want one bad actor to brick my fleet, I want them to make a pull request first.", - "quoteAuthorName": "Matt Carr", - "quoteAuthorJobTitle": "CPE manager", - "quoteAuthorProfileImageFilename": "testimonial-author-matt-carr-48x48@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/mathewcarr/", - "productCategories": [ - "Device management" - ] - }, - { - "quote": "I wanted an easy way to control osquery configurations, and I wanted to stream data as fast as possible into Snowflake. No other solution jumped out to solve those things except for Fleet.", - "quoteAuthorName": "Tom Larkin", - "quoteAuthorJobTitle": "IT Engineering Manager", - "quoteAuthorProfileImageFilename": "testimonial-author-tom-larkin-48x48@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/thlarkin/", - "youtubeVideoUrl": "https://www.youtube.com/watch?v=nkjg_hNe86Q", - "productCategories": [ - "Observability" - ], - "videoIdForEmbed": "nkjg_hNe86Q" - }, - { - "quote": "Something I really appreciate about working with you guys is that it doesn't feel like I'm talking to a vendor. It actually feels like I'm talking to my team, and I really appreciate it.", - "quoteImageFilename": "social-proof-logo-deloitte-130x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/cmajumdar/", - "quoteAuthorName": "Chandra Majumdar", - "quoteAuthorProfileImageFilename": "testimonial-author-chandra-majumdar-48x48@2x.png", - "quoteAuthorJobTitle": "Partner - Cyber and Strategic Risk", - "productCategories": [ - "Software management", - "Observability", - "Device management" - ], - "imageHeight": 32 - }, - { - "quote": "This is not just production osquery, but actually a way bigger opportunity than even something like Airwatch or Jamf.", - "quoteImageFilename": "logo-flock-safety-907x132@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/mrerictan/", - "quoteAuthorName": "Eric Tan", - "quoteAuthorProfileImageFilename": "testimonial-author-eric-tan-99x99@2x.png", - "quoteAuthorJobTitle": "CIO & CSO at Flock Safety", - "productCategories": [ - "Device management", - "Observability", - "Software management" - ], - "imageHeight": 132 - }, - { - "quote": "We've been using Fleet for a few years at Stripe and we couldn't be happier. The fact that it's also open-source made it easy for us to try it out, customise it to our needs, and seamlessly integrate it into our existing environment.", - "quoteImageFilename": "social-proof-logo-stripe-67x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/posts/scottmacvicar_fleet-expands-its-gitops-focused-device-management-activity-7245288577876566017-vAHG?utm_source=share&utm_medium=member_desktop", - "quoteAuthorName": "Scott MacVicar", - "quoteAuthorProfileImageFilename": "testimonial-author-scott-macvicar-100x100@2x.png", - "quoteAuthorJobTitle": "Head of Developer Infrastructure & Corporate Technology", - "productCategories": [ - "Device management", - "Observability" - ], - "imageHeight": 32 - }, - { - "quote": "Fleet helped us determine that Norton antivirus (pre-installed on some machines) was interfering with Crowdstrike's ability to detect downloaded malware.", - "quoteImageFilename": "social-proof-knowbe4-124x32@2x.png", - "quoteLinkUrl": "https://www.linkedin.com/in/arsenio-figueroa-81a56198/", - "quoteAuthorName": "Arsenio Figueroa", - "quoteAuthorProfileImageFilename": "testimonial-author-arsenio-figueroa-48x48@2x.png", - "quoteAuthorJobTitle": "Senior Systems Security Engineer", - "productCategories": [ - "Observability", - "Software management" - ], - "imageHeight": 32 - } - ], - "openPositions": [ - { - "jobTitle": "🚀 Software Engineer", - "url": "/handbook/company/open-positions/software-engineer" - } - ], - "compiledPagePartialsAppPath": "views/partials/built-from-markdown" } } From d406b73ee52e3650235c56df69c040d5f3746e23 Mon Sep 17 00:00:00 2001 From: Noah Talerman Date: Thu, 9 Jan 2025 10:13:50 -0500 Subject: [PATCH 7/7] Add changes --- docs/Configuration/agent-configuration.md | 113 ++++++++-------------- 1 file changed, 41 insertions(+), 72 deletions(-) diff --git a/docs/Configuration/agent-configuration.md b/docs/Configuration/agent-configuration.md index 29fc80f5d7dd..36158f76f0f0 100644 --- a/docs/Configuration/agent-configuration.md +++ b/docs/Configuration/agent-configuration.md @@ -1,6 +1,6 @@ # Agent configuration -Agent configuration options (agent options) update the settings of [Fleet's agent (fleed)](https://fleetdm.com/docs/get-started/anatomy#fleetd) installed on all your hosts. +Agent configuration (agent options) updates the settings of the [Fleet agent (fleed)](https://fleetdm.com/docs/get-started/anatomy#fleetd) installed on all your hosts. You can modify agent options in **Settings > Organization settings > Agent options** or via Fleet's [API](https://fleetdm.com/docs/rest-api/rest-api#modify-configuration) or [YAML files](https://fleetdm.com/docs/configuration/yaml-files). @@ -8,7 +8,7 @@ You can modify agent options in **Settings > Organization settings > Agent optio The `config` section allows you to update settings like performance and and how often the agent checks-in. -####Example +#### Example ```yaml config: @@ -45,10 +45,6 @@ config: - /Users/wxs/sigs/baz.sig ``` -- `decorators` -- `yara` -- `auto_table_contructions` - ### options and command_line_flags - `options` include the agent settings listed under `osqueryOptions` [here](https://github.com/fleetdm/fleet/blob/main/server/fleet/agent_options_generated.go). These can be updated without a fleetd restart. @@ -94,63 +90,16 @@ In the `decorators` key, you can specify queries to include additional informati ### yara -You can use Fleet to configure the `yara` and `yara_events` osquery tables. Fore more information on YARA configuration and continuous monitoring using the `yara_events` table, check out the [YARA-based scanning with osquery section](https://osquery.readthedocs.io/en/stable/deployment/yara/) of the osquery documentation. - -### auto_table_construction - -You can use Fleet to query local SQLite databases as tables. For more information on creating ATC configuration from a SQLite database, check out the [Automatic Table Construction section](https://osquery.readthedocs.io/en/stable/deployment/configuration/#automatic-table-construction) of the osquery documentation. - -If you already know what your ATC configuration needs to look like, you can add it to an options config file: - -```yaml -agent_options: - config: - options: - # ... - overrides: - platforms: - darwin: - auto_table_construction: - tcc_system_entries: - # This query and columns are restricted for compatability. Open TCC.db with sqlite on - # your endpoints to expand this out. - query: "SELECT service, client, last_modified FROM access" - # Note that TCC.db requires fleetd to have full-disk access, ensure that endpoints have - # this enabled. - path: "/Library/Application Support/com.apple.TCC/TCC.db" - columns: - - "service" - - "client" - - "last_modified" -``` - -If you're editing this directly from the UI consider copying and pasting the following at the end of your agent configuration block: - -``` -overrides: - platforms: - darwin: - auto_table_construction: - tcc_system_entries: - # This query and columns are restricted for compatability. Open TCC.db with sqlite on - # your endpoints to expand this out. - query: "SELECT service, client, last_modified FROM access" - # Note that TCC.db requires Orbit to have full-disk access, ensure that endpoints have - # this enabled. - path: "/Library/Application Support/com.apple.TCC/TCC.db" - columns: - - "service" - - "client" - - "last_modified" -``` +You can use Fleet to configure the `yara` and `yara_events` osquery tables. Learn more about YARA configuration and continuous monitoring [here](https://fleetdm.com/guides/remote-yara-rules#basic-article). ## extensions -> This feature requires [Fleetd, the Fleet agent manager](https://fleetdm.com/announcements/introducing-orbit-your-fleet-agent-manager), along with a custom TUF auto-update server (a Fleet Premium feature). +> This feature requires a custom TUF auto-update server (available in Fleet Premium). Learn more [here](https://fleetdm.com/guides/fleetd-updates). The `extensions` key inside of `agent_options` allows you to remotely manage and deploy osquery extensions. Just like other `agent_options` the `extensions` key can be applied either to a team specific one or the global one. -This is best illustrated with an example. Here is an example of using the `extensions` key: +#### Example + ```yaml agent_options: extensions: # requires Fleet's agent (fleetd) @@ -205,7 +154,7 @@ Fleet recommends deploying extensions created with osquery-go or natively with C ### Targeting extensions with labels -_Available in Fleet Premium v4.38.0_ +_Available in Fleet Premium_ Fleet allows you to target extensions to hosts that belong to specific labels. To set these labels, you'll need to define a `labels` list under the extension name. The label names in the list: @@ -213,7 +162,8 @@ The label names in the list: - are case insensitive. - must **all** apply to a host in order to deploy the extension to that host. -Example: +#### Example + ```yaml agent_options: extensions: # requires Fleet's agent (fleetd) @@ -232,17 +182,19 @@ agent_options: channel: 'stable' platform: 'windows' ``` + In the above example: - the `hello_world_macos` extension is deployed to macOS hosts that are members of the 'Zoom installed' label. - the `hello_world_linux` extension is deployed to Linux hosts that are members of the 'Ubuntu Linux' **and** 'Zoom installed' labels. ## update_channels -_Available in Fleet Premium v4.43.0 and fleetd v1.20.0_ +_Available in Fleet Premium_ Users can configure fleetd component TUF auto-update channels from Fleet's agent options. The components that can be configured are `orbit`, `osqueryd` and `desktop` (Fleet Desktop). When one of these components is omitted in `update_channels` then `stable` is assumed as the value for such component. Available options for update channels can be viewed [here](https://fleetdm.com/docs/using-fleet/enroll-hosts#specifying-update-channels). -Examples: +#### Examples + ```yaml agent_options: update_channels: # requires Fleet's agent (fleetd) @@ -250,6 +202,7 @@ agent_options: osqueryd: '5.10.2' desktop: edge ``` + ```yaml agent_options: update_channels: # requires Fleet's agent (fleetd) @@ -281,10 +234,14 @@ B. Upgrading channel `B` to >= `1.20.0`. The `overrides` key allows you to segment hosts, by their platform, and supply these groups with unique osquery configuration options. When you choose to use the overrides option for a specific platform, all options specified in the default configuration will be ignored for that platform. -In the example file below, all Darwin and Ubuntu hosts will **only** receive the options specified in their respective overrides sections. +Note that the `command_line_flags` key is not supported in the `overrides`. + +In the example file below, all macOS hosts will **only** receive the options specified in their respective overrides sections. If a given option is not specified in a platform override section, its default value will be enforced. +#### Example + ```yaml agent_options: overrides: @@ -308,22 +265,34 @@ agent_options: - /Users/%/Documents/%% etc: - /etc/%% + auto_table_construction: + tcc_system_entries: + # This query and columns are restricted for compatability. Open TCC.db with sqlite on + # your endpoints to expand this out. + query: "SELECT service, client, last_modified FROM access" + # Note that TCC.db requires fleetd to have full-disk access, ensure that endpoints have + # this enabled. + path: "/Library/Application Support/com.apple.TCC/TCC.db" + columns: + - "service" + - "client" + - "last_modified" ``` -Note that the `command_line_flags` key is not supported in the `overrides`. +### auto_table_construction + +You can use Fleet to query local SQLite databases as tables. For more information on creating ATC configuration from a SQLite database, check out the [Automatic Table Construction section](https://osquery.readthedocs.io/en/stable/deployment/configuration/#automatic-table-construction) of the osquery documentation. ## script_execution_timeout -The `script_execution_timeout` allows you to change the default script execution timeout. +The `script_execution_timeout` allows you to change the default script execution timeout (default: `300`, maximum: `3600`). + +#### Example -- Optional setting (integer) -- Default value: 300 -- Maximum value: 3600 -- Config file format: - ```yaml - agent_options: - script_execution_timeout: 600 - ``` +```yaml +agent_options: + script_execution_timeout: 600 +```