added osquery 4.1.2 schema

2026-06-08 14:44:11 +00:00 · 2020-02-09 21:05:28 +00:00
parent c314d0b6db
commit 2d22b25cdc
973 changed files with 41892 additions and 211 deletions
@@ -7,6 +7,7 @@ This part of the OSSEM project contains specific information about several secur
 |Data Set|Description|
 |---|---|
 |[macOS](macos/)|Data dictionaries for macOS based events.|
+|[FreeBSD](freebsd/)|Data dictionaries for FreeBSD based events.|
 |[Linux](linux/)|Data dictionaries for Linux based events.|
 |[Zeek Event Logs](zeek/)|Zeek provides, network, metadata on over 40+ different applications and protocols. Additionally, Zeek provides a framework that enables the community to extend various functionality, protocol analzers/parsers, and or add additional (meta)data. The data is broken up into a log for each application/protocol. For example, all DNS data is stored in dns.log and all HTTP data is stored in http.log. Across all of the logs is over 1,000 fields that contain data ranging from common netflow (ie: bytes, packets, etc..) to application layer data (ie: HTTP headers, TLS Certificate info, etc..). To name just a few of the log types: Connection/Flow, HTTP, SSL/TLS, DNS, RDP, SMB, Kerberos, ModBus, Intel, FTP, SSH, GQUIC, SQL, etc.. It also hashes files and can extract them too. Zeek logs have a unique ability to pivot between logs the various logs via uid fields. For example: an HTTP connection results in a http.log and conn.log. Also, if a file was transferred/downloaded during the connection then there would be an additional files.log. Therefore, you not only obtain HTTP (header) fields, duration of connection, bytes sent/received, packets, hash of the file, size of the file, etc.. but you can pivot between the three logs too! The main field to pivot across will be normalized to event_uid and all other UIDs that can be pivoted/joined across will be set in any_event_uid|
 |[Windows](windows/)|Data dictionaries for Windows based events.|
@@ -0,0 +1,9 @@
+# FreeBSD
+
+## Description
+Data dictionaries for FreeBSD based events.
+
+## Sub Data Sets
+|Data Set|Description|
+|---|---|
+|[FreeBSD Osquery Event Logs](osquery/)|Osquery schema is defined in tables by osquery engineers.|
@@ -0,0 +1,100 @@
+# FreeBSD Osquery Event Logs
+
+## Description
+Osquery schema is defined in tables by osquery engineers.
+
+## Sub Data Sets
+|events|Description|Tags|
+|---|---|---|
+|[apt_sources](events/apt_sources.md)|Current list of APT repositories or software channels.|version_4.4.2|
+|[augeas](events/augeas.md)|Configuration files parsed by augeas.|version_4.4.2|
+|[authorized_keys](events/authorized_keys.md)|A line-delimited authorized_keys table.|version_4.4.2|
+|[azure_instance_metadata](events/azure_instance_metadata.md)|Azure instance metadata.|version_4.4.2|
+|[azure_instance_tags](events/azure_instance_tags.md)|Azure instance tags.|version_4.4.2|
+|[carbon_black_info](events/carbon_black_info.md)|Returns info about a Carbon Black sensor install.|version_4.4.2|
+|[carves](events/carves.md)|Forensic Carves.|version_4.4.2|
+|[chrome_extensions](events/chrome_extensions.md)|Chrome browser extensions.|version_4.4.2|
+|[cpu_time](events/cpu_time.md)|Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.|version_4.4.2|
+|[cpuid](events/cpuid.md)|Useful CPU features from the cpuid ASM call.|version_4.4.2|
+|[crontab](events/crontab.md)|Line parsed values from system and user cron/tab.|version_4.4.2|
+|[curl](events/curl.md)|Perform an http request and return stats about it.|version_4.4.2|
+|[curl_certificate](events/curl_certificate.md)|Inspect TLS certificates by connecting to input hostnames.|version_4.4.2|
+|[device_file](events/device_file.md)|Similar to the file table, but use TSK and allow block address access.|version_4.4.2|
+|[device_hash](events/device_hash.md)|Similar to the hash table, but use TSK and allow block address access.|version_4.4.2|
+|[device_partitions](events/device_partitions.md)|Use TSK to enumerate details about partitions on a disk device.|version_4.4.2|
+|[dns_resolvers](events/dns_resolvers.md)|Resolvers used by this host.|version_4.4.2|
+|[docker_container_labels](events/docker_container_labels.md)|Docker container labels.|version_4.4.2|
+|[docker_container_mounts](events/docker_container_mounts.md)|Docker container mounts.|version_4.4.2|
+|[docker_container_networks](events/docker_container_networks.md)|Docker container networks.|version_4.4.2|
+|[docker_container_ports](events/docker_container_ports.md)|Docker container ports.|version_4.4.2|
+|[docker_container_processes](events/docker_container_processes.md)|Docker container processes.|version_4.4.2|
+|[docker_container_stats](events/docker_container_stats.md)|Docker container statistics. Queries on this table take at least one second.|version_4.4.2|
+|[docker_containers](events/docker_containers.md)|Docker containers information.|version_4.4.2|
+|[docker_image_labels](events/docker_image_labels.md)|Docker image labels.|version_4.4.2|
+|[docker_image_layers](events/docker_image_layers.md)|Docker image layers information.|version_4.4.2|
+|[docker_images](events/docker_images.md)|Docker images information.|version_4.4.2|
+|[docker_info](events/docker_info.md)|Docker system information.|version_4.4.2|
+|[docker_network_labels](events/docker_network_labels.md)|Docker network labels.|version_4.4.2|
+|[docker_networks](events/docker_networks.md)|Docker networks information.|version_4.4.2|
+|[docker_version](events/docker_version.md)|Docker version information.|version_4.4.2|
+|[docker_volume_labels](events/docker_volume_labels.md)|Docker volume labels.|version_4.4.2|
+|[docker_volumes](events/docker_volumes.md)|Docker volumes information.|version_4.4.2|
+|[etc_hosts](events/etc_hosts.md)|Line-parsed /etc/hosts.|version_4.4.2|
+|[etc_protocols](events/etc_protocols.md)|Line-parsed /etc/protocols.|version_4.4.2|
+|[etc_services](events/etc_services.md)|Line-parsed /etc/services.|version_4.4.2|
+|[example](events/example.md)|This is an example table spec.|version_4.4.2|
+|[fbsd_kmods](events/fbsd_kmods.md)|Loaded FreeBSD kernel modules.|version_4.4.2|
+|[file](events/file.md)|Interactive filesystem attributes and metadata.|version_4.4.2|
+|[firefox_addons](events/firefox_addons.md)|Firefox browser extensions, webapps, and addons.|version_4.4.2|
+|[groups](events/groups.md)|Local system groups.|version_4.4.2|
+|[hash](events/hash.md)|Filesystem hash data.|version_4.4.2|
+|[hvci_status](events/hvci_status.md)|Retrieve HVCI info of the machine.|version_4.4.2|
+|[interface_addresses](events/interface_addresses.md)|Network interfaces and relevant metadata.|version_4.4.2|
+|[interface_details](events/interface_details.md)|Detailed information and stats of network interfaces.|version_4.4.2|
+|[interface_ipv6](events/interface_ipv6.md)|IPv6 configuration and stats of network interfaces.|version_4.4.2|
+|[known_hosts](events/known_hosts.md)|A line-delimited known_hosts table.|version_4.4.2|
+|[last](events/last.md)|System logins and logouts.|version_4.4.2|
+|[listening_ports](events/listening_ports.md)|Processes with listening (bound) network sockets/ports.|version_4.4.2|
+|[lldp_neighbors](events/lldp_neighbors.md)|LLDP neighbors of interfaces.|version_4.4.2|
+|[load_average](events/load_average.md)|Displays information about the system wide load averages.|version_4.4.2|
+|[logged_in_users](events/logged_in_users.md)|Users with an active shell on the system.|version_4.4.2|
+|[magic](events/magic.md)|Magic number recognition library table.|version_4.4.2|
+|[mounts](events/mounts.md)|System mounted devices and filesystems (not process specific).|version_4.4.2|
+|[opera_extensions](events/opera_extensions.md)|Opera browser extensions.|version_4.4.2|
+|[os_version](events/os_version.md)|A single row containing the operating system name and version.|version_4.4.2|
+|[osquery_events](events/osquery_events.md)|Information about the event publishers and subscribers.|version_4.4.2|
+|[osquery_extensions](events/osquery_extensions.md)|List of active osquery extensions.|version_4.4.2|
+|[osquery_flags](events/osquery_flags.md)|Configurable flags that modify osquery's behavior.|version_4.4.2|
+|[osquery_info](events/osquery_info.md)|Top level information about the running version of osquery.|version_4.4.2|
+|[osquery_packs](events/osquery_packs.md)|Information about the current query packs that are loaded in osquery.|version_4.4.2|
+|[osquery_registry](events/osquery_registry.md)|List the osquery registry plugins.|version_4.4.2|
+|[osquery_schedule](events/osquery_schedule.md)|Information about the current queries that are scheduled in osquery.|version_4.4.2|
+|[pkg_packages](events/pkg_packages.md)|pkgng packages that are currently installed on the host system.|version_4.4.2|
+|[platform_info](events/platform_info.md)|Information about EFI/UEFI/ROM and platform/boot.|version_4.4.2|
+|[process_envs](events/process_envs.md)|A key/value table of environment variables for each process.|version_4.4.2|
+|[process_events](events/process_events.md)|Track time/action process executions.|version_4.4.2|
+|[process_memory_map](events/process_memory_map.md)|Process memory mapped files and pseudo device/regions.|version_4.4.2|
+|[process_open_files](events/process_open_files.md)|File descriptors for each process.|version_4.4.2|
+|[process_open_sockets](events/process_open_sockets.md)|Processes which have open network sockets on the system.|version_4.4.2|
+|[processes](events/processes.md)|All running processes on the host system.|version_4.4.2|
+|[prometheus_metrics](events/prometheus_metrics.md)|Retrieve metrics from a Prometheus server.|version_4.4.2|
+|[python_packages](events/python_packages.md)|Python packages installed in a system.|version_4.4.2|
+|[routes](events/routes.md)|The active route table for the host system.|version_4.4.2|
+|[shell_history](events/shell_history.md)|A line-delimited (command) table of per-user .*_history data.|version_4.4.2|
+|[ssh_configs](events/ssh_configs.md)|A table of parsed ssh_configs.|version_4.4.2|
+|[sudoers](events/sudoers.md)|Rules for running commands as other users via sudo.|version_4.4.2|
+|[suid_bin](events/suid_bin.md)|suid binaries in common locations.|version_4.4.2|
+|[system_controls](events/system_controls.md)|sysctl names, values, and settings information.|version_4.4.2|
+|[system_info](events/system_info.md)|System information for identification.|version_4.4.2|
+|[time](events/time.md)|Track current date and time in the system.|version_4.4.2|
+|[ulimit_info](events/ulimit_info.md)|System resource usage limits.|version_4.4.2|
+|[uptime](events/uptime.md)|Track time passed since last boot.|version_4.4.2|
+|[user_events](events/user_events.md)|Track user events from the audit framework.|version_4.4.2|
+|[user_ssh_keys](events/user_ssh_keys.md)|Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.|version_4.4.2|
+|[users](events/users.md)|Local user accounts (including domain accounts that have logged on locally (Windows)).|version_4.4.2|
+|[yara](events/yara.md)|Track YARA matches for files or PIDs.|version_4.4.2|
+|[yum_sources](events/yum_sources.md)|Current list of Yum repositories or software channels.|version_4.4.2|
+
+## References
+* [osquery schema 4.1.2 (website)](https://osquery.io/schema/4.1.2)
+* [osquery schema linux specs (GitHub)](https://github.com/facebook/osquery/tree/master/specs/windows)
@@ -0,0 +1,22 @@
+# Apt_sources Table
+
+## Description
+Current list of APT repositories or software channels.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Repository name|`TBD`|
+|TBD|source|TEXT|Source file|`TBD`|
+|TBD|base_uri|TEXT|Repository base URI|`TBD`|
+|TBD|release|TEXT|Release name|`TBD`|
+|TBD|version|TEXT|Repository source version|`TBD`|
+|TBD|maintainer|TEXT|Repository maintainer|`TBD`|
+|TBD|components|TEXT|Repository components|`TBD`|
+|TBD|architectures|TEXT|Repository architectures|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#apt_sources)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Augeas Table
+
+## Description
+Configuration files parsed by augeas.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|node|TEXT|The node path of the configuration item|`TBD`|
+|TBD|value|TEXT|The value of the configuration item|`TBD`|
+|TBD|label|TEXT|The label of the configuration item|`TBD`|
+|TBD|path|TEXT|The path to the configuration file|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#augeas)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Authorized_keys Table
+
+## Description
+A line-delimited authorized_keys table.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|The local owner of authorized_keys file|`TBD`|
+|TBD|key|TEXT|parsed authorized keys line|`TBD`|
+|TBD|key_file|TEXT|Path to the authorized_keys file|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#authorized_keys)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,30 @@
+# Azure_instance_metadata Table
+
+## Description
+Azure instance metadata.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|location|TEXT|Azure Region the VM is running in|`TBD`|
+|TBD|name|TEXT|Name of the VM|`TBD`|
+|TBD|offer|TEXT|Offer information for the VM image (Azure image gallery VMs only)|`TBD`|
+|TBD|publisher|TEXT|Publisher of the VM image|`TBD`|
+|TBD|sku|TEXT|SKU for the VM image|`TBD`|
+|TBD|version|TEXT|Version of the VM image|`TBD`|
+|TBD|os_type|TEXT|Linux or Windows|`TBD`|
+|TBD|platform_update_domain|TEXT|Update domain the VM is running in|`TBD`|
+|TBD|platform_fault_domain|TEXT|Fault domain the VM is running in|`TBD`|
+|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`|
+|TBD|vm_size|TEXT|VM size|`TBD`|
+|TBD|subscription_id|TEXT|Azure subscription for the VM|`TBD`|
+|TBD|resource_group_name|TEXT|Resource group for the VM|`TBD`|
+|TBD|placement_group_id|TEXT|Placement group for the VM scale set|`TBD`|
+|TBD|vm_scale_set_name|TEXT|VM scale set name|`TBD`|
+|TBD|zone|TEXT|Availability zone of the VM|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_metadata)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Azure_instance_tags Table
+
+## Description
+Azure instance tags.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`|
+|TBD|key|TEXT|The tag key|`TBD`|
+|TBD|value|TEXT|The tag value|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_tags)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,35 @@
+# Carbon_black_info Table
+
+## Description
+Returns info about a Carbon Black sensor install.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|sensor_id|INTEGER|Sensor ID of the Carbon Black sensor|`TBD`|
+|TBD|config_name|TEXT|Sensor group|`TBD`|
+|TBD|collect_store_files|INTEGER|If the sensor is configured to send back binaries to the Carbon Black server|`TBD`|
+|TBD|collect_module_loads|INTEGER|If the sensor is configured to capture module loads|`TBD`|
+|TBD|collect_module_info|INTEGER|If the sensor is configured to collect metadata of binaries|`TBD`|
+|TBD|collect_file_mods|INTEGER|If the sensor is configured to collect file modification events|`TBD`|
+|TBD|collect_reg_mods|INTEGER|If the sensor is configured to collect registry modification events|`TBD`|
+|TBD|collect_net_conns|INTEGER|If the sensor is configured to collect network connections|`TBD`|
+|TBD|collect_processes|INTEGER|If the sensor is configured to process events|`TBD`|
+|TBD|collect_cross_processes|INTEGER|If the sensor is configured to cross process events|`TBD`|
+|TBD|collect_emet_events|INTEGER|If the sensor is configured to EMET events|`TBD`|
+|TBD|collect_data_file_writes|INTEGER|If the sensor is configured to collect non binary file writes|`TBD`|
+|TBD|collect_process_user_context|INTEGER|If the sensor is configured to collect the user running a process|`TBD`|
+|TBD|collect_sensor_operations|INTEGER|Unknown|`TBD`|
+|TBD|log_file_disk_quota_mb|INTEGER|Event file disk quota in MB|`TBD`|
+|TBD|log_file_disk_quota_percentage|INTEGER|Event file disk quota in a percentage|`TBD`|
+|TBD|protection_disabled|INTEGER|If the sensor is configured to report tamper events|`TBD`|
+|TBD|sensor_ip_addr|TEXT|IP address of the sensor|`TBD`|
+|TBD|sensor_backend_server|TEXT|Carbon Black server|`TBD`|
+|TBD|event_queue|INTEGER|Size in bytes of Carbon Black event files on disk|`TBD`|
+|TBD|binary_queue|INTEGER|Size in bytes of binaries waiting to be sent to Carbon Black server|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#carbon_black_info)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,21 @@
+# Carves Table
+
+## Description
+Forensic Carves.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|time|BIGINT|Time at which the carve was kicked off|`TBD`|
+|TBD|sha256|TEXT|A SHA256 sum of the carved archive|`TBD`|
+|TBD|size|INTEGER|Size of the carved archive|`TBD`|
+|TBD|path|TEXT|The path of the requested carve|`TBD`|
+|TBD|status|TEXT|Status of the carve, can be STARTING, PENDING, SUCCESS, or FAILED|`TBD`|
+|TBD|carve_guid|TEXT|Identifying value of the carve session|`TBD`|
+|TBD|carve|INTEGER|Set this value to '1' to start a file carve|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#carves)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,26 @@
+# Chrome_extensions Table
+
+## Description
+Chrome browser extensions.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|The local user that owns the extension|`TBD`|
+|TBD|name|TEXT|Extension display name|`TBD`|
+|TBD|profile|TEXT|The Chrome profile that contains this extension|`TBD`|
+|TBD|identifier|TEXT|Extension identifier|`TBD`|
+|TBD|version|TEXT|Extension-supplied version|`TBD`|
+|TBD|description|TEXT|Extension-optional description|`TBD`|
+|TBD|locale|TEXT|Default locale supported by extension|`TBD`|
+|TBD|update_url|TEXT|Extension-supplied update URI|`TBD`|
+|TBD|author|TEXT|Optional extension author|`TBD`|
+|TBD|path|TEXT|Path to extension folder|`TBD`|
+|TBD|permissions|TEXT|The permissions required by the extension|`TBD`|
+|TBD|optional_permissions|TEXT|The permissions optionally required by the extensions|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#chrome_extensions)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,25 @@
+# Cpu_time Table
+
+## Description
+Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|core|INTEGER|Name of the cpu (core)|`TBD`|
+|TBD|user|BIGINT|Time spent in user mode|`TBD`|
+|TBD|nice|BIGINT|Time spent in user mode with low priority (nice)|`TBD`|
+|TBD|system|BIGINT|Time spent in system mode|`TBD`|
+|TBD|idle|BIGINT|Time spent in the idle task|`TBD`|
+|TBD|iowait|BIGINT|Time spent waiting for I/O to complete|`TBD`|
+|TBD|irq|BIGINT|Time spent servicing interrupts|`TBD`|
+|TBD|softirq|BIGINT|Time spent servicing softirqs|`TBD`|
+|TBD|steal|BIGINT|Time spent in other operating systems when running in a virtualized environment|`TBD`|
+|TBD|guest|BIGINT|Time spent running a virtual CPU for a guest OS under the control of the Linux kernel|`TBD`|
+|TBD|guest_nice|BIGINT|Time spent running a niced guest |`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#cpu_time)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Cpuid Table
+
+## Description
+Useful CPU features from the cpuid ASM call.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|feature|TEXT|Present feature flags|`TBD`|
+|TBD|value|TEXT|Bit value or string|`TBD`|
+|TBD|output_register|TEXT|Register used to for feature value|`TBD`|
+|TBD|output_bit|INTEGER|Bit in register value for feature value|`TBD`|
+|TBD|input_eax|TEXT|Value of EAX used|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#cpuid)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,22 @@
+# Crontab Table
+
+## Description
+Line parsed values from system and user cron/tab.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|event|TEXT|The job @event name (rare)|`TBD`|
+|TBD|minute|TEXT|The exact minute for the job|`TBD`|
+|TBD|hour|TEXT|The hour of the day for the job|`TBD`|
+|TBD|day_of_month|TEXT|The day of the month for the job|`TBD`|
+|TBD|month|TEXT|The month of the year for the job|`TBD`|
+|TBD|day_of_week|TEXT|The day of the week for the job|`TBD`|
+|TBD|command|TEXT|Raw command string|`TBD`|
+|TBD|path|TEXT|File parsed|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#crontab)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,21 @@
+# Curl Table
+
+## Description
+Perform an http request and return stats about it.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|url|TEXT|The url for the request|`TBD`|
+|TBD|method|TEXT|The HTTP method for the request|`TBD`|
+|TBD|user_agent|TEXT|The user-agent string to use for the request|`TBD`|
+|TBD|response_code|INTEGER|The HTTP status code for the response|`TBD`|
+|TBD|round_trip_time|BIGINT|Time taken to complete the request|`TBD`|
+|TBD|bytes|BIGINT|Number of bytes in the response|`TBD`|
+|TBD|result|TEXT|The HTTP response body|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#curl)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,26 @@
+# Curl_certificate Table
+
+## Description
+Inspect TLS certificates by connecting to input hostnames.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|hostname|TEXT|Hostname (domain[:port]) to CURL|`TBD`|
+|TBD|common_name|TEXT|Common name of company issued to|`TBD`|
+|TBD|organization|TEXT|Organization issued to|`TBD`|
+|TBD|organization_unit|TEXT|Organization unit issued to|`TBD`|
+|TBD|serial_number|TEXT|Certificate serial number|`TBD`|
+|TBD|issuer_common_name|TEXT|Issuer common name|`TBD`|
+|TBD|issuer_organization|TEXT|Issuer organization|`TBD`|
+|TBD|issuer_organization_unit|TEXT|Issuer organization unit|`TBD`|
+|TBD|valid_from|TEXT|Period of validity start date|`TBD`|
+|TBD|valid_to|TEXT|Period of validity end date|`TBD`|
+|TBD|sha256_fingerprint|TEXT|SHA-256 fingerprint|`TBD`|
+|TBD|sha1_fingerprint|TEXT|SHA1 fingerprint|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#curl_certificate)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,29 @@
+# Device_file Table
+
+## Description
+Similar to the file table, but use TSK and allow block address access.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|device|TEXT|Absolute file path to device node|`TBD`|
+|TBD|partition|TEXT|A partition number|`TBD`|
+|TBD|path|TEXT|A logical path within the device node|`TBD`|
+|TBD|filename|TEXT|Name portion of file path|`TBD`|
+|TBD|inode|BIGINT|Filesystem inode number|`TBD`|
+|TBD|uid|BIGINT|Owning user ID|`TBD`|
+|TBD|gid|BIGINT|Owning group ID|`TBD`|
+|TBD|mode|TEXT|Permission bits|`TBD`|
+|TBD|size|BIGINT|Size of file in bytes|`TBD`|
+|TBD|block_size|INTEGER|Block size of filesystem|`TBD`|
+|TBD|atime|BIGINT|Last access time|`TBD`|
+|TBD|mtime|BIGINT|Last modification time|`TBD`|
+|TBD|ctime|BIGINT|Creation time|`TBD`|
+|TBD|hard_links|INTEGER|Number of hard links|`TBD`|
+|TBD|type|TEXT|File status|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#device_file)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,20 @@
+# Device_hash Table
+
+## Description
+Similar to the hash table, but use TSK and allow block address access.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|device|TEXT|Absolute file path to device node|`TBD`|
+|TBD|partition|TEXT|A partition number|`TBD`|
+|TBD|inode|BIGINT|Filesystem inode number|`TBD`|
+|TBD|md5|TEXT|MD5 hash of provided inode data|`TBD`|
+|TBD|sha1|TEXT|SHA1 hash of provided inode data|`TBD`|
+|TBD|sha256|TEXT|SHA256 hash of provided inode data|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#device_hash)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,23 @@
+# Device_partitions Table
+
+## Description
+Use TSK to enumerate details about partitions on a disk device.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|device|TEXT|Absolute file path to device node|`TBD`|
+|TBD|partition|INTEGER|A partition number or description|`TBD`|
+|TBD|label|TEXT||`TBD`|
+|TBD|type|TEXT||`TBD`|
+|TBD|offset|BIGINT||`TBD`|
+|TBD|blocks_size|BIGINT|Byte size of each block|`TBD`|
+|TBD|blocks|BIGINT|Number of blocks|`TBD`|
+|TBD|inodes|BIGINT|Number of meta nodes|`TBD`|
+|TBD|flags|INTEGER||`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#device_partitions)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Dns_resolvers Table
+
+## Description
+Resolvers used by this host.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|INTEGER|Address type index or order|`TBD`|
+|TBD|type|TEXT|Address type: sortlist, nameserver, search|`TBD`|
+|TBD|address|TEXT|Resolver IP/IPv6 address|`TBD`|
+|TBD|netmask|TEXT|Address (sortlist) netmask length|`TBD`|
+|TBD|options|BIGINT|Resolver options|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#dns_resolvers)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Docker_container_labels Table
+
+## Description
+Docker container labels.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Container ID|`TBD`|
+|TBD|key|TEXT|Label key|`TBD`|
+|TBD|value|TEXT|Optional label value|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_labels)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,23 @@
+# Docker_container_mounts Table
+
+## Description
+Docker container mounts.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Container ID|`TBD`|
+|TBD|type|TEXT|Type of mount (bind, volume)|`TBD`|
+|TBD|name|TEXT|Optional mount name|`TBD`|
+|TBD|source|TEXT|Source path on host|`TBD`|
+|TBD|destination|TEXT|Destination path inside container|`TBD`|
+|TBD|driver|TEXT|Driver providing the mount|`TBD`|
+|TBD|mode|TEXT|Mount options (rw, ro)|`TBD`|
+|TBD|rw|INTEGER|1 if read/write. 0 otherwise|`TBD`|
+|TBD|propagation|TEXT|Mount propagation|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_mounts)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,25 @@
+# Docker_container_networks Table
+
+## Description
+Docker container networks.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Container ID|`TBD`|
+|TBD|name|TEXT|Network name|`TBD`|
+|TBD|network_id|TEXT|Network ID|`TBD`|
+|TBD|endpoint_id|TEXT|Endpoint ID|`TBD`|
+|TBD|gateway|TEXT|Gateway|`TBD`|
+|TBD|ip_address|TEXT|IP address|`TBD`|
+|TBD|ip_prefix_len|INTEGER|IP subnet prefix length|`TBD`|
+|TBD|ipv6_gateway|TEXT|IPv6 gateway|`TBD`|
+|TBD|ipv6_address|TEXT|IPv6 address|`TBD`|
+|TBD|ipv6_prefix_len|INTEGER|IPv6 subnet prefix length|`TBD`|
+|TBD|mac_address|TEXT|MAC address|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_networks)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Docker_container_ports Table
+
+## Description
+Docker container ports.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Container ID|`TBD`|
+|TBD|type|TEXT|Protocol (tcp, udp)|`TBD`|
+|TBD|port|INTEGER|Port inside the container|`TBD`|
+|TBD|host_ip|TEXT|Host IP address on which public port is listening|`TBD`|
+|TBD|host_port|INTEGER|Host port|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_ports)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,36 @@
+# Docker_container_processes Table
+
+## Description
+Docker container processes.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Container ID|`TBD`|
+|TBD|pid|BIGINT|Process ID|`TBD`|
+|TBD|name|TEXT|The process path or shorthand argv[0]|`TBD`|
+|TBD|cmdline|TEXT|Complete argv|`TBD`|
+|TBD|state|TEXT|Process state|`TBD`|
+|TBD|uid|BIGINT|User ID|`TBD`|
+|TBD|gid|BIGINT|Group ID|`TBD`|
+|TBD|euid|BIGINT|Effective user ID|`TBD`|
+|TBD|egid|BIGINT|Effective group ID|`TBD`|
+|TBD|suid|BIGINT|Saved user ID|`TBD`|
+|TBD|sgid|BIGINT|Saved group ID|`TBD`|
+|TBD|wired_size|BIGINT|Bytes of unpagable memory used by process|`TBD`|
+|TBD|resident_size|BIGINT|Bytes of private memory used by process|`TBD`|
+|TBD|total_size|BIGINT|Total virtual memory size|`TBD`|
+|TBD|parent|BIGINT|Process parent's PID|`TBD`|
+|TBD|pgroup|BIGINT|Process group|`TBD`|
+|TBD|threads|INTEGER|Number of threads used by process|`TBD`|
+|TBD|nice|INTEGER|Process nice level (-20 to 20, default 0)|`TBD`|
+|TBD|user|TEXT|User name|`TBD`|
+|TBD|time|TEXT|Cumulative CPU time. [DD-]HH:MM:SS format|`TBD`|
+|TBD|cpu|DOUBLE|CPU utilization as percentage|`TBD`|
+|TBD|mem|DOUBLE|Memory utilization as percentage|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_processes)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,38 @@
+# Docker_container_stats Table
+
+## Description
+Docker container statistics. Queries on this table take at least one second.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Container ID|`TBD`|
+|TBD|name|TEXT|Container name|`TBD`|
+|TBD|pids|INTEGER|Number of processes|`TBD`|
+|TBD|read|BIGINT|UNIX time when stats were read|`TBD`|
+|TBD|preread|BIGINT|UNIX time when stats were last read|`TBD`|
+|TBD|interval|BIGINT|Difference between read and preread in nano-seconds|`TBD`|
+|TBD|disk_read|BIGINT|Total disk read bytes|`TBD`|
+|TBD|disk_write|BIGINT|Total disk write bytes|`TBD`|
+|TBD|num_procs|INTEGER|Number of processors|`TBD`|
+|TBD|cpu_total_usage|BIGINT|Total CPU usage|`TBD`|
+|TBD|cpu_kernelmode_usage|BIGINT|CPU kernel mode usage|`TBD`|
+|TBD|cpu_usermode_usage|BIGINT|CPU user mode usage|`TBD`|
+|TBD|system_cpu_usage|BIGINT|CPU system usage|`TBD`|
+|TBD|online_cpus|INTEGER|Online CPUs|`TBD`|
+|TBD|pre_cpu_total_usage|BIGINT|Last read total CPU usage|`TBD`|
+|TBD|pre_cpu_kernelmode_usage|BIGINT|Last read CPU kernel mode usage|`TBD`|
+|TBD|pre_cpu_usermode_usage|BIGINT|Last read CPU user mode usage|`TBD`|
+|TBD|pre_system_cpu_usage|BIGINT|Last read CPU system usage|`TBD`|
+|TBD|pre_online_cpus|INTEGER|Last read online CPUs|`TBD`|
+|TBD|memory_usage|BIGINT|Memory usage|`TBD`|
+|TBD|memory_max_usage|BIGINT|Memory maximum usage|`TBD`|
+|TBD|memory_limit|BIGINT|Memory limit|`TBD`|
+|TBD|network_rx_bytes|BIGINT|Total network bytes read|`TBD`|
+|TBD|network_tx_bytes|BIGINT|Total network bytes transmitted|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_container_stats)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,38 @@
+# Docker_containers Table
+
+## Description
+Docker containers information.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Container ID|`TBD`|
+|TBD|name|TEXT|Container name|`TBD`|
+|TBD|image|TEXT|Docker image (name) used to launch this container|`TBD`|
+|TBD|image_id|TEXT|Docker image ID|`TBD`|
+|TBD|command|TEXT|Command with arguments|`TBD`|
+|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`|
+|TBD|state|TEXT|Container state (created, restarting, running, removing, paused, exited, dead)|`TBD`|
+|TBD|status|TEXT|Container status information|`TBD`|
+|TBD|pid|BIGINT|Identifier of the initial process|`TBD`|
+|TBD|path|TEXT|Container path|`TBD`|
+|TBD|config_entrypoint|TEXT|Container entrypoint(s)|`TBD`|
+|TBD|started_at|TEXT|Container start time as string|`TBD`|
+|TBD|finished_at|TEXT|Container finish time as string|`TBD`|
+|TBD|privileged|INTEGER|Is the container privileged|`TBD`|
+|TBD|security_options|TEXT|List of container security options|`TBD`|
+|TBD|env_variables|TEXT|Container environmental variables|`TBD`|
+|TBD|readonly_rootfs|INTEGER|Is the root filesystem mounted as read only|`TBD`|
+|TBD|cgroup_namespace|TEXT|cgroup namespace [LINUX]|`TBD`|
+|TBD|ipc_namespace|TEXT|IPC namespace [LINUX]|`TBD`|
+|TBD|mnt_namespace|TEXT|Mount namespace [LINUX]|`TBD`|
+|TBD|net_namespace|TEXT|Network namespace [LINUX]|`TBD`|
+|TBD|pid_namespace|TEXT|PID namespace [LINUX]|`TBD`|
+|TBD|user_namespace|TEXT|User namespace [LINUX]|`TBD`|
+|TBD|uts_namespace|TEXT|UTS namespace [LINUX]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_containers)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Docker_image_labels Table
+
+## Description
+Docker image labels.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Image ID|`TBD`|
+|TBD|key|TEXT|Label key|`TBD`|
+|TBD|value|TEXT|Optional label value|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_image_labels)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Docker_image_layers Table
+
+## Description
+Docker image layers information.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Image ID|`TBD`|
+|TBD|layer_id|TEXT|Layer ID|`TBD`|
+|TBD|layer_order|INTEGER|Layer Order (1 = base layer)|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_image_layers)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Docker_images Table
+
+## Description
+Docker images information.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Image ID|`TBD`|
+|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`|
+|TBD|size_bytes|BIGINT|Size of image in bytes|`TBD`|
+|TBD|tags|TEXT|Comma-separated list of repository tags|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_images)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,46 @@
+# Docker_info Table
+
+## Description
+Docker system information.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Docker system ID|`TBD`|
+|TBD|containers|INTEGER|Total number of containers|`TBD`|
+|TBD|containers_running|INTEGER|Number of containers currently running|`TBD`|
+|TBD|containers_paused|INTEGER|Number of containers in paused state|`TBD`|
+|TBD|containers_stopped|INTEGER|Number of containers in stopped state|`TBD`|
+|TBD|images|INTEGER|Number of images|`TBD`|
+|TBD|storage_driver|TEXT|Storage driver|`TBD`|
+|TBD|memory_limit|INTEGER|1 if memory limit support is enabled. 0 otherwise|`TBD`|
+|TBD|swap_limit|INTEGER|1 if swap limit support is enabled. 0 otherwise|`TBD`|
+|TBD|kernel_memory|INTEGER|1 if kernel memory limit support is enabled. 0 otherwise|`TBD`|
+|TBD|cpu_cfs_period|INTEGER|1 if CPU Completely Fair Scheduler (CFS) period support is enabled. 0 otherwise|`TBD`|
+|TBD|cpu_cfs_quota|INTEGER|1 if CPU Completely Fair Scheduler (CFS) quota support is enabled. 0 otherwise|`TBD`|
+|TBD|cpu_shares|INTEGER|1 if CPU share weighting support is enabled. 0 otherwise|`TBD`|
+|TBD|cpu_set|INTEGER|1 if CPU set selection support is enabled. 0 otherwise|`TBD`|
+|TBD|ipv4_forwarding|INTEGER|1 if IPv4 forwarding is enabled. 0 otherwise|`TBD`|
+|TBD|bridge_nf_iptables|INTEGER|1 if bridge netfilter iptables is enabled. 0 otherwise|`TBD`|
+|TBD|bridge_nf_ip6tables|INTEGER|1 if bridge netfilter ip6tables is enabled. 0 otherwise|`TBD`|
+|TBD|oom_kill_disable|INTEGER|1 if Out-of-memory kill is disabled. 0 otherwise|`TBD`|
+|TBD|logging_driver|TEXT|Logging driver|`TBD`|
+|TBD|cgroup_driver|TEXT|Control groups driver|`TBD`|
+|TBD|kernel_version|TEXT|Kernel version|`TBD`|
+|TBD|os|TEXT|Operating system|`TBD`|
+|TBD|os_type|TEXT|Operating system type|`TBD`|
+|TBD|architecture|TEXT|Hardware architecture|`TBD`|
+|TBD|cpus|INTEGER|Number of CPUs|`TBD`|
+|TBD|memory|BIGINT|Total memory|`TBD`|
+|TBD|http_proxy|TEXT|HTTP proxy|`TBD`|
+|TBD|https_proxy|TEXT|HTTPS proxy|`TBD`|
+|TBD|no_proxy|TEXT|Comma-separated list of domain extensions proxy should not be used for|`TBD`|
+|TBD|name|TEXT|Name of the docker host|`TBD`|
+|TBD|server_version|TEXT|Server version|`TBD`|
+|TBD|root_dir|TEXT|Docker root directory|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_info)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Docker_network_labels Table
+
+## Description
+Docker network labels.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Network ID|`TBD`|
+|TBD|key|TEXT|Label key|`TBD`|
+|TBD|value|TEXT|Optional label value|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_network_labels)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,21 @@
+# Docker_networks Table
+
+## Description
+Docker networks information.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|id|TEXT|Network ID|`TBD`|
+|TBD|name|TEXT|Network name|`TBD`|
+|TBD|driver|TEXT|Network driver|`TBD`|
+|TBD|created|BIGINT|Time of creation as UNIX time|`TBD`|
+|TBD|enable_ipv6|INTEGER|1 if IPv6 is enabled on this network. 0 otherwise|`TBD`|
+|TBD|subnet|TEXT|Network subnet|`TBD`|
+|TBD|gateway|TEXT|Network gateway|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_networks)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,23 @@
+# Docker_version Table
+
+## Description
+Docker version information.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|version|TEXT|Docker version|`TBD`|
+|TBD|api_version|TEXT|API version|`TBD`|
+|TBD|min_api_version|TEXT|Minimum API version supported|`TBD`|
+|TBD|git_commit|TEXT|Docker build git commit|`TBD`|
+|TBD|go_version|TEXT|Go version|`TBD`|
+|TBD|os|TEXT|Operating system|`TBD`|
+|TBD|arch|TEXT|Hardware architecture|`TBD`|
+|TBD|kernel_version|TEXT|Kernel version|`TBD`|
+|TBD|build_time|TEXT|Build time|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_version)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Docker_volume_labels Table
+
+## Description
+Docker volume labels.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Volume name|`TBD`|
+|TBD|key|TEXT|Label key|`TBD`|
+|TBD|value|TEXT|Optional label value|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_volume_labels)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Docker_volumes Table
+
+## Description
+Docker volumes information.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Volume name|`TBD`|
+|TBD|driver|TEXT|Volume driver|`TBD`|
+|TBD|mount_point|TEXT|Mount point|`TBD`|
+|TBD|type|TEXT|Volume type|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#docker_volumes)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,16 @@
+# Etc_hosts Table
+
+## Description
+Line-parsed /etc/hosts.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|address|TEXT|IP address mapping|`TBD`|
+|TBD|hostnames|TEXT|Raw hosts mapping|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#etc_hosts)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Etc_protocols Table
+
+## Description
+Line-parsed /etc/protocols.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Protocol name|`TBD`|
+|TBD|number|INTEGER|Protocol number|`TBD`|
+|TBD|alias|TEXT|Protocol alias|`TBD`|
+|TBD|comment|TEXT|Comment with protocol description|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#etc_protocols)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Etc_services Table
+
+## Description
+Line-parsed /etc/services.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Service name|`TBD`|
+|TBD|port|INTEGER|Service port number|`TBD`|
+|TBD|protocol|TEXT|Transport protocol (TCP/UDP)|`TBD`|
+|TBD|aliases|TEXT|Optional space separated list of other names for a service|`TBD`|
+|TBD|comment|TEXT|Optional comment for a service.|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#etc_services)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,20 @@
+# Example Table
+
+## Description
+This is an example table spec.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Description for name column|`TBD`|
+|TBD|points|INTEGER|This is a signed SQLite int column|`TBD`|
+|TBD|size|BIGINT|This is a signed SQLite bigint column|`TBD`|
+|TBD|action|TEXT|Action performed in generation|`TBD`|
+|TBD|id|INTEGER|An index of some sort|`TBD`|
+|TBD|path|TEXT|Path of example|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#example)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Fbsd_kmods Table
+
+## Description
+Loaded FreeBSD kernel modules.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Module name|`TBD`|
+|TBD|size|INTEGER|Size of module content|`TBD`|
+|TBD|refs|INTEGER|Module reverse dependencies|`TBD`|
+|TBD|address|TEXT|Kernel module address|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#fbsd_kmods)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,31 @@
+# File Table
+
+## Description
+Interactive filesystem attributes and metadata.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|file_path|path|TEXT|Absolute file path|`file_directory`|
+|TBD|directory|TEXT|Directory of file(s)|`TBD`|
+|file_name|filename|TEXT|Name portion of file path|`TBD`|
+|file_inode|inode|BIGINT|Filesystem inode number|`TBD`|
+|user_uid|uid|BIGINT|Owning user ID|`TBD`|
+|user_gid|gid|BIGINT|Owning group ID|`TBD`|
+|user_permissions|mode|TEXT|Permission bits|`TBD`|
+|device_id|device|BIGINT|Device ID (optional)|`TBD`|
+|file_size|size|BIGINT|Size of file in bytes|`TBD`|
+|file_system_block_size|block_size|INTEGER|Block size of filesystem|`TBD`|
+|date_last_access|atime|BIGINT|Last access time|`TBD`|
+|date_last_modification|mtime|BIGINT|Last modification time|`TBD`|
+|date_last_status_change|ctime|BIGINT|Last status change time|`TBD`|
+|date_creation_time|btime|BIGINT|(B)irth or (cr)eate time|`TBD`|
+|file_hard_links|hard_links|INTEGER|Number of hard links|`TBD`|
+|file_symlink|symlink|INTEGER|1 if the path is a symlink, otherwise 0|`TBD`|
+|file_type|type|TEXT|File status|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#file)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,26 @@
+# Firefox_addons Table
+
+## Description
+Firefox browser extensions, webapps, and addons.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|The local user that owns the addon|`TBD`|
+|TBD|name|TEXT|Addon display name|`TBD`|
+|TBD|identifier|TEXT|Addon identifier|`TBD`|
+|TBD|creator|TEXT|Addon-supported creator string|`TBD`|
+|TBD|type|TEXT|Extension, addon, webapp|`TBD`|
+|TBD|version|TEXT|Addon-supplied version string|`TBD`|
+|TBD|description|TEXT|Addon-supplied description string|`TBD`|
+|TBD|source_url|TEXT|URL that installed the addon|`TBD`|
+|TBD|visible|INTEGER|1 If the addon is shown in browser else 0|`TBD`|
+|TBD|active|INTEGER|1 If the addon is active else 0|`TBD`|
+|TBD|location|TEXT|Global, profile location|`TBD`|
+|TBD|path|TEXT|Path to plugin bundle|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#firefox_addons)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,20 @@
+# Groups Table
+
+## Description
+Local system groups.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|gid|BIGINT|Unsigned int64 group ID|`TBD`|
+|TBD|gid_signed|BIGINT|A signed int64 version of gid|`TBD`|
+|TBD|groupname|TEXT|Canonical local group name|`TBD`|
+|TBD|group_sid|TEXT|Unique group ID [WINDOWS]|`TBD`|
+|TBD|comment|TEXT|Remarks or comments associated with the group [WINDOWS]|`TBD`|
+|TBD|is_hidden|INTEGER|IsHidden attribute set in OpenDirectory [DARWIN]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#groups)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,20 @@
+# Hash Table
+
+## Description
+Filesystem hash data.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|path|TEXT|Must provide a path or directory|`TBD`|
+|TBD|directory|TEXT|Must provide a path or directory|`TBD`|
+|TBD|md5|TEXT|MD5 hash of provided filesystem data|`TBD`|
+|TBD|sha1|TEXT|SHA1 hash of provided filesystem data|`TBD`|
+|TBD|sha256|TEXT|SHA256 hash of provided filesystem data|`TBD`|
+|TBD|ssdeep|TEXT|ssdeep hash of provided filesystem data [POSIX]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#hash)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Hvci_status Table
+
+## Description
+Retrieve HVCI info of the machine.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|version|TEXT|The version number of the Device Guard build.|`TBD`|
+|TBD|instance_identifier|TEXT|The instance ID of Device Guard.|`TBD`|
+|TBD|vbs_status|TEXT|The status of the virtualization based security settings. Returns UNKNOWN if an error is encountered.|`TBD`|
+|TBD|code_integrity_policy_enforcement_status|TEXT|The status of the code integrity policy enforcement settings. Returns UNKNOWN if an error is encountered.|`TBD`|
+|TBD|umci_policy_status|TEXT|The status of the User Mode Code Integrity security settings. Returns UNKNOWN if an error is encountered.|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#hvci_status)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,21 @@
+# Interface_addresses Table
+
+## Description
+Network interfaces and relevant metadata.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|interface|TEXT|Interface name|`TBD`|
+|TBD|address|TEXT|Specific address for interface|`TBD`|
+|TBD|mask|TEXT|Interface netmask|`TBD`|
+|TBD|broadcast|TEXT|Broadcast address for the interface|`TBD`|
+|TBD|point_to_point|TEXT|PtP address for the interface|`TBD`|
+|TBD|type|TEXT|Type of address. One of dhcp, manual, auto, other, unknown|`TBD`|
+|TBD|friendly_name|TEXT|The friendly display name of the interface. [WINDOWS]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#interface_addresses)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,49 @@
+# Interface_details Table
+
+## Description
+Detailed information and stats of network interfaces.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|interface|TEXT|Interface name|`TBD`|
+|TBD|mac|TEXT|MAC of interface (optional)|`TBD`|
+|TBD|type|INTEGER|Interface type (includes virtual)|`TBD`|
+|TBD|mtu|INTEGER|Network MTU|`TBD`|
+|TBD|metric|INTEGER|Metric based on the speed of the interface|`TBD`|
+|TBD|flags|INTEGER|Flags (netdevice) for the device|`TBD`|
+|TBD|ipackets|BIGINT|Input packets|`TBD`|
+|TBD|opackets|BIGINT|Output packets|`TBD`|
+|TBD|ibytes|BIGINT|Input bytes|`TBD`|
+|TBD|obytes|BIGINT|Output bytes|`TBD`|
+|TBD|ierrors|BIGINT|Input errors|`TBD`|
+|TBD|oerrors|BIGINT|Output errors|`TBD`|
+|TBD|idrops|BIGINT|Input drops|`TBD`|
+|TBD|odrops|BIGINT|Output drops|`TBD`|
+|TBD|collisions|BIGINT|Packet Collisions detected|`TBD`|
+|TBD|last_change|BIGINT|Time of last device modification (optional)|`TBD`|
+|TBD|link_speed|BIGINT|Interface speed in Mb/s [POSIX]|`TBD`|
+|TBD|pci_slot|TEXT|PCI slot number [LINUX]|`TBD`|
+|TBD|friendly_name|TEXT|The friendly display name of the interface. [WINDOWS]|`TBD`|
+|TBD|description|TEXT|Short description of the object a one-line string. [WINDOWS]|`TBD`|
+|TBD|manufacturer|TEXT|Name of the network adapter's manufacturer. [WINDOWS]|`TBD`|
+|TBD|connection_id|TEXT|Name of the network connection as it appears in the Network Connections Control Panel program. [WINDOWS]|`TBD`|
+|TBD|connection_status|TEXT|State of the network adapter connection to the network. [WINDOWS]|`TBD`|
+|TBD|enabled|INTEGER|Indicates whether the adapter is enabled or not. [WINDOWS]|`TBD`|
+|TBD|physical_adapter|INTEGER|Indicates whether the adapter is a physical or a logical adapter. [WINDOWS]|`TBD`|
+|TBD|speed|INTEGER|Estimate of the current bandwidth in bits per second. [WINDOWS]|`TBD`|
+|TBD|service|TEXT|The name of the service the network adapter uses. [WINDOWS]|`TBD`|
+|TBD|dhcp_enabled|INTEGER|If TRUE, the dynamic host configuration protocol (DHCP) server automatically assigns an IP address to the computer system when establishing a network connection. [WINDOWS]|`TBD`|
+|TBD|dhcp_lease_expires|TEXT|Expiration date and time for a leased IP address that was assigned to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`|
+|TBD|dhcp_lease_obtained|TEXT|Date and time the lease was obtained for the IP address assigned to the computer by the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`|
+|TBD|dhcp_server|TEXT|IP address of the dynamic host configuration protocol (DHCP) server. [WINDOWS]|`TBD`|
+|TBD|dns_domain|TEXT|Organization name followed by a period and an extension that indicates the type of organization, such as 'microsoft.com'. [WINDOWS]|`TBD`|
+|TBD|dns_domain_suffix_search_order|TEXT|Array of DNS domain suffixes to be appended to the end of host names during name resolution. [WINDOWS]|`TBD`|
+|TBD|dns_host_name|TEXT|Host name used to identify the local computer for authentication by some utilities. [WINDOWS]|`TBD`|
+|TBD|dns_server_search_order|TEXT|Array of server IP addresses to be used in querying for DNS servers. [WINDOWS]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#interface_details)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Interface_ipv6 Table
+
+## Description
+IPv6 configuration and stats of network interfaces.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|interface|TEXT|Interface name|`TBD`|
+|TBD|hop_limit|INTEGER|Current Hop Limit|`TBD`|
+|TBD|forwarding_enabled|INTEGER|Enable IP forwarding|`TBD`|
+|TBD|redirect_accept|INTEGER|Accept ICMP redirect messages|`TBD`|
+|TBD|rtadv_accept|INTEGER|Accept ICMP Router Advertisement|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#interface_ipv6)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Known_hosts Table
+
+## Description
+A line-delimited known_hosts table.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|The local user that owns the known_hosts file|`TBD`|
+|TBD|key|TEXT|parsed authorized keys line|`TBD`|
+|TBD|key_file|TEXT|Path to known_hosts file|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#known_hosts)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,20 @@
+# Last Table
+
+## Description
+System logins and logouts.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|username|TEXT|Entry username|`TBD`|
+|TBD|tty|TEXT|Entry terminal|`TBD`|
+|TBD|pid|INTEGER|Process (or thread) ID|`TBD`|
+|TBD|type|INTEGER|Entry type, according to ut_type types (utmp.h)|`TBD`|
+|TBD|time|INTEGER|Entry timestamp|`TBD`|
+|TBD|host|TEXT|Entry hostname|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#last)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,23 @@
+# Listening_ports Table
+
+## Description
+Processes with listening (bound) network sockets/ports.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|pid|INTEGER|Process (or thread) ID|`TBD`|
+|TBD|port|INTEGER|Transport layer port|`TBD`|
+|TBD|protocol|INTEGER|Transport protocol (TCP/UDP)|`TBD`|
+|TBD|family|INTEGER|Network protocol (IPv4, IPv6)|`TBD`|
+|TBD|address|TEXT|Specific address for bind|`TBD`|
+|TBD|fd|BIGINT|Socket file descriptor number|`TBD`|
+|TBD|socket|BIGINT|Socket handle or inode number|`TBD`|
+|TBD|path|TEXT|Path for UNIX domain sockets|`TBD`|
+|TBD|net_namespace|TEXT|The inode number of the network namespace [LINUX]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#listening_ports)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,83 @@
+# Lldp_neighbors Table
+
+## Description
+LLDP neighbors of interfaces.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|interface|TEXT|Interface name|`TBD`|
+|TBD|rid|INTEGER|Neighbor chassis index|`TBD`|
+|TBD|chassis_id_type|TEXT|Neighbor chassis ID type|`TBD`|
+|TBD|chassis_id|TEXT|Neighbor chassis ID value|`TBD`|
+|TBD|chassis_sysname|TEXT|CPU brand string, contains vendor and model|`TBD`|
+|TBD|chassis_sys_description|INTEGER|Max number of CPU physical cores|`TBD`|
+|TBD|chassis_bridge_capability_available|INTEGER|Chassis bridge capability availability|`TBD`|
+|TBD|chassis_bridge_capability_enabled|INTEGER|Is chassis bridge capability enabled.|`TBD`|
+|TBD|chassis_router_capability_available|INTEGER|Chassis router capability availability|`TBD`|
+|TBD|chassis_router_capability_enabled|INTEGER|Chassis router capability enabled|`TBD`|
+|TBD|chassis_repeater_capability_available|INTEGER|Chassis repeater capability availability|`TBD`|
+|TBD|chassis_repeater_capability_enabled|INTEGER|Chassis repeater capability enabled|`TBD`|
+|TBD|chassis_wlan_capability_available|INTEGER|Chassis wlan capability availability|`TBD`|
+|TBD|chassis_wlan_capability_enabled|INTEGER|Chassis wlan capability enabled|`TBD`|
+|TBD|chassis_tel_capability_available|INTEGER|Chassis telephone capability availability|`TBD`|
+|TBD|chassis_tel_capability_enabled|INTEGER|Chassis telephone capability enabled|`TBD`|
+|TBD|chassis_docsis_capability_available|INTEGER|Chassis DOCSIS capability availability|`TBD`|
+|TBD|chassis_docsis_capability_enabled|INTEGER|Chassis DOCSIS capability enabled|`TBD`|
+|TBD|chassis_station_capability_available|INTEGER|Chassis station capability availability|`TBD`|
+|TBD|chassis_station_capability_enabled|INTEGER|Chassis station capability enabled|`TBD`|
+|TBD|chassis_other_capability_available|INTEGER|Chassis other capability availability|`TBD`|
+|TBD|chassis_other_capability_enabled|INTEGER|Chassis other capability enabled|`TBD`|
+|TBD|chassis_mgmt_ips|TEXT|Comma delimited list of chassis management IPS|`TBD`|
+|TBD|port_id_type|TEXT|Port ID type|`TBD`|
+|TBD|port_id|TEXT|Port ID value|`TBD`|
+|TBD|port_description|TEXT|Port description|`TBD`|
+|TBD|port_ttl|BIGINT|Age of neighbor port|`TBD`|
+|TBD|port_mfs|BIGINT|Port max frame size|`TBD`|
+|TBD|port_aggregation_id|TEXT|Port aggregation ID|`TBD`|
+|TBD|port_autoneg_supported|INTEGER|Auto negotiation supported|`TBD`|
+|TBD|port_autoneg_enabled|INTEGER|Is auto negotiation enabled|`TBD`|
+|TBD|port_mau_type|TEXT|MAU type|`TBD`|
+|TBD|port_autoneg_10baset_hd_enabled|INTEGER|10Base-T HD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_10baset_fd_enabled|INTEGER|10Base-T FD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_100basetx_hd_enabled|INTEGER|100Base-TX HD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_100basetx_fd_enabled|INTEGER|100Base-TX FD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_100baset2_hd_enabled|INTEGER|100Base-T2 HD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_100baset2_fd_enabled|INTEGER|100Base-T2 FD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_100baset4_hd_enabled|INTEGER|100Base-T4 HD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_100baset4_fd_enabled|INTEGER|100Base-T4 FD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_1000basex_hd_enabled|INTEGER|1000Base-X HD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_1000basex_fd_enabled|INTEGER|1000Base-X FD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_1000baset_hd_enabled|INTEGER|1000Base-T HD auto negotiation enabled|`TBD`|
+|TBD|port_autoneg_1000baset_fd_enabled|INTEGER|1000Base-T FD auto negotiation enabled|`TBD`|
+|TBD|power_device_type|TEXT|Dot3 power device type|`TBD`|
+|TBD|power_mdi_supported|INTEGER|MDI power supported|`TBD`|
+|TBD|power_mdi_enabled|INTEGER|Is MDI power enabled|`TBD`|
+|TBD|power_paircontrol_enabled|INTEGER|Is power pair control enabled|`TBD`|
+|TBD|power_pairs|TEXT|Dot3 power pairs|`TBD`|
+|TBD|power_class|TEXT|Power class|`TBD`|
+|TBD|power_8023at_enabled|INTEGER|Is 802.3at enabled|`TBD`|
+|TBD|power_8023at_power_type|TEXT|802.3at power type|`TBD`|
+|TBD|power_8023at_power_source|TEXT|802.3at power source|`TBD`|
+|TBD|power_8023at_power_priority|TEXT|802.3at power priority|`TBD`|
+|TBD|power_8023at_power_allocated|TEXT|802.3at power allocated|`TBD`|
+|TBD|power_8023at_power_requested|TEXT|802.3at power requested|`TBD`|
+|TBD|med_device_type|TEXT|Chassis MED type|`TBD`|
+|TBD|med_capability_capabilities|INTEGER|Is MED capabilities enabled|`TBD`|
+|TBD|med_capability_policy|INTEGER|Is MED policy capability enabled|`TBD`|
+|TBD|med_capability_location|INTEGER|Is MED location capability enabled|`TBD`|
+|TBD|med_capability_mdi_pse|INTEGER|Is MED MDI PSE capability enabled|`TBD`|
+|TBD|med_capability_mdi_pd|INTEGER|Is MED MDI PD capability enabled|`TBD`|
+|TBD|med_capability_inventory|INTEGER|Is MED inventory capability enabled|`TBD`|
+|TBD|med_policies|TEXT|Comma delimited list of MED policies|`TBD`|
+|TBD|vlans|TEXT|Comma delimited list of vlan ids|`TBD`|
+|TBD|pvid|TEXT|Primary VLAN id|`TBD`|
+|TBD|ppvids_supported|TEXT|Comma delimited list of supported PPVIDs|`TBD`|
+|TBD|ppvids_enabled|TEXT|Comma delimited list of enabled PPVIDs|`TBD`|
+|TBD|pids|TEXT|Comma delimited list of PIDs|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#lldp_neighbors)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,16 @@
+# Load_average Table
+
+## Description
+Displays information about the system wide load averages.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|period|TEXT|Period over which the average is calculated.|`TBD`|
+|TBD|average|TEXT|Load average over the specified period.|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#load_average)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,22 @@
+# Logged_in_users Table
+
+## Description
+Users with an active shell on the system.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|type|TEXT|Login type|`TBD`|
+|TBD|user|TEXT|User login name|`TBD`|
+|TBD|tty|TEXT|Device name|`TBD`|
+|TBD|host|TEXT|Remote hostname|`TBD`|
+|TBD|time|INTEGER|Time entry was made|`TBD`|
+|TBD|pid|INTEGER|Process (or thread) ID|`TBD`|
+|TBD|sid|TEXT|The user's unique security identifier [WINDOWS]|`TBD`|
+|TBD|registry_hive|TEXT|HKEY_USERS registry hive [WINDOWS]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#logged_in_users)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Magic Table
+
+## Description
+Magic number recognition library table.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|path|TEXT|Absolute path to target file|`TBD`|
+|TBD|magic_db_files|TEXT|Colon(:) separated list of files where the magic db file can be found. By default one of the following is used: /usr/share/file/magic/magic, /usr/share/misc/magic or /usr/share/misc/magic.mgc|`TBD`|
+|TBD|data|TEXT|Magic number data from libmagic|`TBD`|
+|TBD|mime_type|TEXT|MIME type data from libmagic|`TBD`|
+|TBD|mime_encoding|TEXT|MIME encoding data from libmagic|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#magic)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,25 @@
+# Mounts Table
+
+## Description
+System mounted devices and filesystems (not process specific).
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|device|TEXT|Mounted device|`TBD`|
+|TBD|device_alias|TEXT|Mounted device alias|`TBD`|
+|TBD|path|TEXT|Mounted device path|`TBD`|
+|TBD|type|TEXT|Mounted device type|`TBD`|
+|TBD|blocks_size|BIGINT|Block size in bytes|`TBD`|
+|TBD|blocks|BIGINT|Mounted device used blocks|`TBD`|
+|TBD|blocks_free|BIGINT|Mounted device free blocks|`TBD`|
+|TBD|blocks_available|BIGINT|Mounted device available blocks|`TBD`|
+|TBD|inodes|BIGINT|Mounted device used inodes|`TBD`|
+|TBD|inodes_free|BIGINT|Mounted device free inodes|`TBD`|
+|TBD|flags|TEXT|Mounted device flags|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#mounts)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,23 @@
+# Opera_extensions Table
+
+## Description
+Opera browser extensions.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|The local user that owns the extension|`TBD`|
+|TBD|name|TEXT|Extension display name|`TBD`|
+|TBD|identifier|TEXT|Extension identifier|`TBD`|
+|TBD|version|TEXT|Extension-supplied version|`TBD`|
+|TBD|description|TEXT|Extension-optional description|`TBD`|
+|TBD|locale|TEXT|Default locale supported by extension|`TBD`|
+|TBD|update_url|TEXT|Extension-supplied update URI|`TBD`|
+|TBD|author|TEXT|Optional extension author|`TBD`|
+|TBD|path|TEXT|Path to extension folder|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#opera_extensions)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,24 @@
+# Os_version Table
+
+## Description
+A single row containing the operating system name and version.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Distribution or product name|`TBD`|
+|TBD|version|TEXT|Pretty, suitable for presentation, OS version|`TBD`|
+|TBD|major|INTEGER|Major release version|`TBD`|
+|TBD|minor|INTEGER|Minor release version|`TBD`|
+|TBD|patch|INTEGER|Optional patch release|`TBD`|
+|TBD|build|TEXT|Optional build-specific or variant string|`TBD`|
+|TBD|platform|TEXT|OS Platform or ID|`TBD`|
+|TBD|platform_like|TEXT|Closely related platforms|`TBD`|
+|TBD|codename|TEXT|OS version codename|`TBD`|
+|TBD|install_date|TEXT|The install date of the OS. [WINDOWS]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#os_version)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Osquery_events Table
+
+## Description
+Information about the event publishers and subscribers.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Event publisher or subscriber name|`TBD`|
+|TBD|publisher|TEXT|Name of the associated publisher|`TBD`|
+|TBD|type|TEXT|Either publisher or subscriber|`TBD`|
+|TBD|refreshes|INTEGER|Publisher only: number of runloop restarts|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#osquery_events)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,20 @@
+# Osquery_extensions Table
+
+## Description
+List of active osquery extensions.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uuid|BIGINT|The transient ID assigned for communication|`TBD`|
+|TBD|name|TEXT|Extension's name|`TBD`|
+|TBD|version|TEXT|Extension's version|`TBD`|
+|TBD|sdk_version|TEXT|osquery SDK version used to build the extension|`TBD`|
+|TBD|path|TEXT|Path of the extenion's domain socket or library path|`TBD`|
+|TBD|type|TEXT|SDK extension type: extension or module|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#osquery_extensions)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,20 @@
+# Osquery_flags Table
+
+## Description
+Configurable flags that modify osquery's behavior.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Flag name|`TBD`|
+|TBD|type|TEXT|Flag type|`TBD`|
+|TBD|description|TEXT|Flag description|`TBD`|
+|TBD|default_value|TEXT|Flag default value|`TBD`|
+|TBD|value|TEXT|Flag value|`TBD`|
+|TBD|shell_only|INTEGER|Is the flag shell only?|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#osquery_flags)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,26 @@
+# Osquery_info Table
+
+## Description
+Top level information about the running version of osquery.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|pid|INTEGER|Process (or thread/handle) ID|`TBD`|
+|TBD|uuid|TEXT|Unique ID provided by the system|`TBD`|
+|TBD|instance_id|TEXT|Unique, long-lived ID per instance of osquery|`TBD`|
+|TBD|version|TEXT|osquery toolkit version|`TBD`|
+|TBD|config_hash|TEXT|Hash of the working configuration state|`TBD`|
+|TBD|config_valid|INTEGER|1 if the config was loaded and considered valid, else 0|`TBD`|
+|TBD|extensions|TEXT|osquery extensions status|`TBD`|
+|TBD|build_platform|TEXT|osquery toolkit build platform|`TBD`|
+|TBD|build_distro|TEXT|osquery toolkit platform distribution name (os version)|`TBD`|
+|TBD|start_time|INTEGER|UNIX time in seconds when the process started|`TBD`|
+|TBD|watcher|INTEGER|Process (or thread/handle) ID of optional watcher process|`TBD`|
+|TBD|platform_mask|INTEGER|The osquery platform bitmask|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#osquery_info)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,21 @@
+# Osquery_packs Table
+
+## Description
+Information about the current query packs that are loaded in osquery.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|The given name for this query pack|`TBD`|
+|TBD|platform|TEXT|Platforms this query is supported on|`TBD`|
+|TBD|version|TEXT|Minimum osquery version that this query will run on|`TBD`|
+|TBD|shard|INTEGER|Shard restriction limit, 1-100, 0 meaning no restriction|`TBD`|
+|TBD|discovery_cache_hits|INTEGER|The number of times that the discovery query used cached values since the last time the config was reloaded|`TBD`|
+|TBD|discovery_executions|INTEGER|The number of times that the discovery queries have been executed since the last time the config was reloaded|`TBD`|
+|TBD|active|INTEGER|Whether this pack is active (the version, platform and discovery queries match) yes=1, no=0.|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#osquery_packs)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Osquery_registry Table
+
+## Description
+List the osquery registry plugins.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|registry|TEXT|Name of the osquery registry|`TBD`|
+|TBD|name|TEXT|Name of the plugin item|`TBD`|
+|TBD|owner_uuid|INTEGER|Extension route UUID (0 for core)|`TBD`|
+|TBD|internal|INTEGER|1 If the plugin is internal else 0|`TBD`|
+|TBD|active|INTEGER|1 If this plugin is active else 0|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#osquery_registry)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,21 @@
+# Osquery_schedule Table
+
+## Description
+Information about the current queries that are scheduled in osquery.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|The given name for this query|`TBD`|
+|TBD|query|TEXT|The exact query to run|`TBD`|
+|TBD|executions|BIGINT|Number of times the query was executed|`TBD`|
+|TBD|blacklisted|INTEGER|1 if the query is blacklisted else 0|`TBD`|
+|TBD|wall_time|BIGINT|Total wall time spent executing|`TBD`|
+|TBD|user_time|BIGINT|Total user time spent executing|`TBD`|
+|TBD|system_time|BIGINT|Total system time spent executing|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#osquery_schedule)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Pkg_packages Table
+
+## Description
+pkgng packages that are currently installed on the host system.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Package name|`TBD`|
+|TBD|version|TEXT|Package version|`TBD`|
+|TBD|flatsize|BIGINT|Package size in bytes|`TBD`|
+|TBD|arch|TEXT|Architecture(s) supported|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#pkg_packages)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,22 @@
+# Platform_info Table
+
+## Description
+Information about EFI/UEFI/ROM and platform/boot.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|vendor|TEXT|Platform code vendor|`TBD`|
+|TBD|version|TEXT|Platform code version|`TBD`|
+|TBD|date|TEXT|Self-reported platform code update date|`TBD`|
+|TBD|revision|TEXT|BIOS major and minor revision|`TBD`|
+|TBD|address|TEXT|Relative address of firmware mapping|`TBD`|
+|TBD|size|TEXT|Size in bytes of firmware|`TBD`|
+|TBD|volume_size|INTEGER|(Optional) size of firmware volume|`TBD`|
+|TBD|extra|TEXT|Platform-specific additional information|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#platform_info)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Process_envs Table
+
+## Description
+A key/value table of environment variables for each process.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|pid|INTEGER|Process (or thread) ID|`TBD`|
+|TBD|key|TEXT|Environment variable name|`TBD`|
+|TBD|value|TEXT|Environment variable value|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#process_envs)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,41 @@
+# Process_events Table
+
+## Description
+Track time/action process executions.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|pid|BIGINT|Process (or thread) ID|`TBD`|
+|TBD|path|TEXT|Path of executed file|`TBD`|
+|TBD|mode|TEXT|File mode permissions|`TBD`|
+|TBD|cmdline|TEXT|Command line arguments (argv)|`TBD`|
+|TBD|cmdline_size|BIGINT|Actual size (bytes) of command line arguments|`TBD`|
+|TBD|env|TEXT|Environment variables delimited by spaces|`TBD`|
+|TBD|env_count|BIGINT|Number of environment variables|`TBD`|
+|TBD|env_size|BIGINT|Actual size (bytes) of environment list|`TBD`|
+|TBD|cwd|TEXT|The process current working directory|`TBD`|
+|TBD|auid|BIGINT|Audit User ID at process start|`TBD`|
+|TBD|uid|BIGINT|User ID at process start|`TBD`|
+|TBD|euid|BIGINT|Effective user ID at process start|`TBD`|
+|TBD|gid|BIGINT|Group ID at process start|`TBD`|
+|TBD|egid|BIGINT|Effective group ID at process start|`TBD`|
+|TBD|owner_uid|BIGINT|File owner user ID|`TBD`|
+|TBD|owner_gid|BIGINT|File owner group ID|`TBD`|
+|TBD|atime|BIGINT|File last access in UNIX time|`TBD`|
+|TBD|mtime|BIGINT|File modification in UNIX time|`TBD`|
+|TBD|ctime|BIGINT|File last metadata change in UNIX time|`TBD`|
+|TBD|btime|BIGINT|File creation in UNIX time|`TBD`|
+|TBD|overflows|TEXT|List of structures that overflowed|`TBD`|
+|TBD|parent|BIGINT|Process parent's PID, or -1 if cannot be determined.|`TBD`|
+|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`|
+|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`|
+|TBD|eid|TEXT|Event ID|`TBD`|
+|TBD|status|BIGINT|OpenBSM Attribute: Status of the process [DARWIN]|`TBD`|
+|TBD|syscall|TEXT|Syscall name: fork, vfork, clone, execve, execveat [LINUX]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#process_events)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,23 @@
+# Process_memory_map Table
+
+## Description
+Process memory mapped files and pseudo device/regions.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|pid|INTEGER|Process (or thread) ID|`TBD`|
+|TBD|start|TEXT|Virtual start address (hex)|`TBD`|
+|TBD|end|TEXT|Virtual end address (hex)|`TBD`|
+|TBD|permissions|TEXT|r=read, w=write, x=execute, p=private (cow)|`TBD`|
+|TBD|offset|BIGINT|Offset into mapped path|`TBD`|
+|TBD|device|TEXT|MA:MI Major/minor device ID|`TBD`|
+|TBD|inode|INTEGER|Mapped path inode, 0 means uninitialized (BSS)|`TBD`|
+|TBD|path|TEXT|Path to mapped file or mapped type|`TBD`|
+|TBD|pseudo|INTEGER|1 If path is a pseudo path, else 0|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#process_memory_map)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Process_open_files Table
+
+## Description
+File descriptors for each process.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|pid|BIGINT|Process (or thread) ID|`TBD`|
+|TBD|fd|BIGINT|Process-specific file descriptor number|`TBD`|
+|TBD|path|TEXT|Filesystem path of descriptor|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#process_open_files)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,26 @@
+# Process_open_sockets Table
+
+## Description
+Processes which have open network sockets on the system.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|pid|INTEGER|Process (or thread) ID|`TBD`|
+|TBD|fd|BIGINT|Socket file descriptor number|`TBD`|
+|TBD|socket|BIGINT|Socket handle or inode number|`TBD`|
+|TBD|family|INTEGER|Network protocol (IPv4, IPv6)|`TBD`|
+|TBD|protocol|INTEGER|Transport protocol (TCP/UDP)|`TBD`|
+|TBD|local_address|TEXT|Socket local address|`TBD`|
+|TBD|remote_address|TEXT|Socket remote address|`TBD`|
+|TBD|local_port|INTEGER|Socket local port|`TBD`|
+|TBD|remote_port|INTEGER|Socket remote port|`TBD`|
+|TBD|path|TEXT|For UNIX sockets (family=AF_UNIX), the domain path|`TBD`|
+|TBD|state|TEXT|TCP socket state [lambda: LINUX() or DARWIN() or WINDOWS()]|`TBD`|
+|TBD|net_namespace|TEXT|The inode number of the network namespace [LINUX]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#process_open_sockets)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,47 @@
+# Processes Table
+
+## Description
+All running processes on the host system.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|pid|BIGINT|Process (or thread) ID|`TBD`|
+|TBD|name|TEXT|The process path or shorthand argv[0]|`TBD`|
+|TBD|path|TEXT|Path to executed binary|`TBD`|
+|TBD|cmdline|TEXT|Complete argv|`TBD`|
+|TBD|state|TEXT|Process state|`TBD`|
+|TBD|cwd|TEXT|Process current working directory|`TBD`|
+|TBD|root|TEXT|Process virtual root directory|`TBD`|
+|TBD|uid|BIGINT|Unsigned user ID|`TBD`|
+|TBD|gid|BIGINT|Unsigned group ID|`TBD`|
+|TBD|euid|BIGINT|Unsigned effective user ID|`TBD`|
+|TBD|egid|BIGINT|Unsigned effective group ID|`TBD`|
+|TBD|suid|BIGINT|Unsigned saved user ID|`TBD`|
+|TBD|sgid|BIGINT|Unsigned saved group ID|`TBD`|
+|TBD|wired_size|BIGINT|Bytes of unpagable memory used by process|`TBD`|
+|TBD|resident_size|BIGINT|Bytes of private memory used by process|`TBD`|
+|TBD|total_size|BIGINT|Total virtual memory size|`TBD`|
+|TBD|user_time|BIGINT|CPU time in milliseconds spent in user space|`TBD`|
+|TBD|system_time|BIGINT|CPU time in milliseconds spent in kernel space|`TBD`|
+|TBD|disk_bytes_read|BIGINT|Bytes read from disk|`TBD`|
+|TBD|disk_bytes_written|BIGINT|Bytes written to disk|`TBD`|
+|TBD|start_time|BIGINT|Process start time in seconds since Epoch, in case of error -1|`TBD`|
+|TBD|parent|BIGINT|Process parent's PID|`TBD`|
+|TBD|pgroup|BIGINT|Process group|`TBD`|
+|TBD|threads|INTEGER|Number of threads used by process|`TBD`|
+|TBD|nice|INTEGER|Process nice level (-20 to 20, default 0)|`TBD`|
+|TBD|is_elevated_token|INTEGER|Process uses elevated token yes=1, no=0 [WINDOWS]|`TBD`|
+|TBD|elapsed_time|BIGINT|Elapsed time in seconds this process has been running. [WINDOWS]|`TBD`|
+|TBD|handle_count|BIGINT|Total number of handles that the process has open. This number is the sum of the handles currently opened by each thread in the process. [WINDOWS]|`TBD`|
+|TBD|percent_processor_time|BIGINT|Returns elapsed time that all of the threads of this process used the processor to execute instructions in 100 nanoseconds ticks. [WINDOWS]|`TBD`|
+|TBD|upid|BIGINT|A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`|
+|TBD|uppid|BIGINT|The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`|
+|TBD|cpu_type|INTEGER|A 64bit pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`|
+|TBD|cpu_subtype|INTEGER|The 64bit parent pid that is never reused. Returns -1 if we couldn't gather them from the system. [DARWIN]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#processes)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Prometheus_metrics Table
+
+## Description
+Retrieve metrics from a Prometheus server.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|target_name|TEXT|Address of prometheus target|`TBD`|
+|TBD|metric_name|TEXT|Name of collected Prometheus metric|`TBD`|
+|TBD|metric_value|DOUBLE|Value of collected Prometheus metric|`TBD`|
+|TBD|timestamp_ms|BIGINT|Unix timestamp of collected data in MS|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#prometheus_metrics)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,21 @@
+# Python_packages Table
+
+## Description
+Python packages installed in a system.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Package display name|`TBD`|
+|TBD|version|TEXT|Package-supplied version|`TBD`|
+|TBD|summary|TEXT|Package-supplied summary|`TBD`|
+|TBD|author|TEXT|Optional package author|`TBD`|
+|TBD|license|TEXT|License under which package is launched|`TBD`|
+|TBD|path|TEXT|Path at which this module resides|`TBD`|
+|TBD|directory|TEXT|Directory where Python modules are located|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#python_packages)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,24 @@
+# Routes Table
+
+## Description
+The active route table for the host system.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|destination|TEXT|Destination IP address|`TBD`|
+|TBD|netmask|INTEGER|Netmask length|`TBD`|
+|TBD|gateway|TEXT|Route gateway|`TBD`|
+|TBD|source|TEXT|Route source|`TBD`|
+|TBD|flags|INTEGER|Flags to describe route|`TBD`|
+|TBD|interface|TEXT|Route local interface|`TBD`|
+|TBD|mtu|INTEGER|Maximum Transmission Unit for the route|`TBD`|
+|TBD|metric|INTEGER|Cost of route. Lowest is preferred|`TBD`|
+|TBD|type|TEXT|Type of route|`TBD`|
+|TBD|hopcount|INTEGER|Max hops expected [POSIX]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#routes)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Shell_history Table
+
+## Description
+A line-delimited (command) table of per-user .*_history data.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|Shell history owner|`TBD`|
+|TBD|time|INTEGER|Entry timestamp. It could be absent, default value is 0.|`TBD`|
+|TBD|command|TEXT|Unparsed date/line/command history line|`TBD`|
+|TBD|history_file|TEXT|Path to the .*_history for this user|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#shell_history)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Ssh_configs Table
+
+## Description
+A table of parsed ssh_configs.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|The local owner of the ssh_config file|`TBD`|
+|TBD|option|TEXT|The option and value|`TBD`|
+|TBD|ssh_config_file|TEXT|Path to the ssh_config file|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#ssh_configs)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Sudoers Table
+
+## Description
+Rules for running commands as other users via sudo.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|source|TEXT|Source file containing the given rule|`TBD`|
+|TBD|header|TEXT|Symbol for given rule|`TBD`|
+|TBD|rule_details|TEXT|Rule definition|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#sudoers)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Suid_bin Table
+
+## Description
+suid binaries in common locations.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|path|TEXT|Binary path|`TBD`|
+|TBD|username|TEXT|Binary owner username|`TBD`|
+|TBD|groupname|TEXT|Binary owner group|`TBD`|
+|TBD|permissions|TEXT|Binary permissions|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#suid_bin)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,21 @@
+# System_controls Table
+
+## Description
+sysctl names, values, and settings information.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Full sysctl MIB name|`TBD`|
+|TBD|oid|TEXT|Control MIB|`TBD`|
+|TBD|subsystem|TEXT|Subsystem ID, control type|`TBD`|
+|TBD|current_value|TEXT|Value of setting|`TBD`|
+|TBD|config_value|TEXT|The MIB value set in /etc/sysctl.conf|`TBD`|
+|TBD|type|TEXT|Data type|`TBD`|
+|TBD|field_name|TEXT|Specific attribute of opaque type [DARWIN]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#system_controls)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,29 @@
+# System_info Table
+
+## Description
+System information for identification.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|hostname|TEXT|Network hostname including domain|`TBD`|
+|TBD|uuid|TEXT|Unique ID provided by the system|`TBD`|
+|TBD|cpu_type|TEXT|CPU type|`TBD`|
+|TBD|cpu_subtype|TEXT|CPU subtype|`TBD`|
+|TBD|cpu_brand|TEXT|CPU brand string, contains vendor and model|`TBD`|
+|TBD|cpu_physical_cores|INTEGER|Number of physical CPU cores in to the system|`TBD`|
+|TBD|cpu_logical_cores|INTEGER|Number of logical CPU cores available to the system|`TBD`|
+|TBD|cpu_microcode|TEXT|Microcode version|`TBD`|
+|TBD|physical_memory|BIGINT|Total physical memory in bytes|`TBD`|
+|TBD|hardware_vendor|TEXT|Hardware or board vendor|`TBD`|
+|TBD|hardware_model|TEXT|Hardware or board model|`TBD`|
+|TBD|hardware_version|TEXT|Hardware or board version|`TBD`|
+|TBD|hardware_serial|TEXT|Device or board serial number|`TBD`|
+|TBD|computer_name|TEXT|Friendly computer name (optional)|`TBD`|
+|TBD|local_hostname|TEXT|Local hostname (optional)|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#system_info)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,28 @@
+# Time Table
+
+## Description
+Track current date and time in the system.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|weekday|TEXT|Current weekday in the system|`TBD`|
+|TBD|year|INTEGER|Current year in the system|`TBD`|
+|TBD|month|INTEGER|Current month in the system|`TBD`|
+|TBD|day|INTEGER|Current day in the system|`TBD`|
+|TBD|hour|INTEGER|Current hour in the system|`TBD`|
+|TBD|minutes|INTEGER|Current minutes in the system|`TBD`|
+|TBD|seconds|INTEGER|Current seconds in the system|`TBD`|
+|TBD|timezone|TEXT|Current timezone in the system|`TBD`|
+|TBD|local_time|INTEGER|Current local UNIX time in the system|`TBD`|
+|TBD|local_timezone|TEXT|Current local timezone in the system|`TBD`|
+|TBD|timestamp|TEXT|Current timestamp (log format) in the system|`TBD`|
+|TBD|datetime|TEXT|Current date and time (ISO format) in the system|`TBD`|
+|TBD|iso_8601|TEXT|Current time (ISO format) in the system|`TBD`|
+|TBD|win_timestamp|BIGINT|Timestamp value in 100 nanosecond units. [WINDOWS]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#time)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Ulimit_info Table
+
+## Description
+System resource usage limits.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|type|TEXT|System resource to be limited|`TBD`|
+|TBD|soft_limit|TEXT|Current limit value|`TBD`|
+|TBD|hard_limit|TEXT|Maximum limit value|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#ulimit_info)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Uptime Table
+
+## Description
+Track time passed since last boot.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|days|INTEGER|Days of uptime|`TBD`|
+|TBD|hours|INTEGER|Hours of uptime|`TBD`|
+|TBD|minutes|INTEGER|Minutes of uptime|`TBD`|
+|TBD|seconds|INTEGER|Seconds of uptime|`TBD`|
+|TBD|total_seconds|BIGINT|Total uptime seconds|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#uptime)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,25 @@
+# User_events Table
+
+## Description
+Track user events from the audit framework.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|User ID|`TBD`|
+|TBD|auid|BIGINT|Audit User ID|`TBD`|
+|TBD|pid|BIGINT|Process (or thread) ID|`TBD`|
+|TBD|message|TEXT|Message from the event|`TBD`|
+|TBD|type|INTEGER|The file description for the process socket|`TBD`|
+|TBD|path|TEXT|Supplied path from event|`TBD`|
+|TBD|address|TEXT|The Internet protocol address or family ID|`TBD`|
+|TBD|terminal|TEXT|The network protocol ID|`TBD`|
+|TBD|time|BIGINT|Time of execution in UNIX time|`TBD`|
+|TBD|uptime|BIGINT|Time of execution in system uptime|`TBD`|
+|TBD|eid|TEXT|Event ID|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#user_events)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# User_ssh_keys Table
+
+## Description
+Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|The local user that owns the key file|`TBD`|
+|TBD|path|TEXT|Path to key file|`TBD`|
+|TBD|encrypted|INTEGER|1 if key is encrypted, 0 otherwise|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#user_ssh_keys)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,25 @@
+# Users Table
+
+## Description
+Local user accounts (including domain accounts that have logged on locally (Windows)).
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|User ID|`TBD`|
+|TBD|gid|BIGINT|Group ID (unsigned)|`TBD`|
+|TBD|uid_signed|BIGINT|User ID as int64 signed (Apple)|`TBD`|
+|TBD|gid_signed|BIGINT|Default group ID as int64 signed (Apple)|`TBD`|
+|TBD|username|TEXT|Username|`TBD`|
+|TBD|description|TEXT|Optional user description|`TBD`|
+|TBD|directory|TEXT|User's home directory|`TBD`|
+|TBD|shell|TEXT|User's configured default shell|`TBD`|
+|TBD|uuid|TEXT|User's UUID (Apple) or SID (Windows)|`TBD`|
+|TBD|type|TEXT|Whether the account is roaming (domain), local, or a system profile [WINDOWS]|`TBD`|
+|TBD|is_hidden|INTEGER|IsHidden attribute set in OpenDirectory [DARWIN]|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#users)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,21 @@
+# Yara Table
+
+## Description
+Track YARA matches for files or PIDs.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|path|TEXT|The path scanned|`TBD`|
+|TBD|matches|TEXT|List of YARA matches|`TBD`|
+|TBD|count|INTEGER|Number of YARA matches|`TBD`|
+|TBD|sig_group|TEXT|Signature group used|`TBD`|
+|TBD|sigfile|TEXT|Signature file used|`TBD`|
+|TBD|strings|TEXT|Matching strings|`TBD`|
+|TBD|tags|TEXT|Matching tags|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#yara)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Yum_sources Table
+
+## Description
+Current list of Yum repositories or software channels.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Repository name|`TBD`|
+|TBD|baseurl|TEXT|Repository base URL|`TBD`|
+|TBD|enabled|TEXT|Whether the repository is used|`TBD`|
+|TBD|gpgcheck|TEXT|Whether packages are GPG checked|`TBD`|
+|TBD|gpgkey|TEXT|URL to GPG key|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#yum_sources)
+
+## Tags
+* version_4.4.2
@@ -6,8 +6,146 @@ Osquery schema is defined in tables by osquery engineers.
 ## Sub Data Sets
 |events|Description|Tags|
 |---|---|---|
-|[file](events/file.md)|Interactive filesystem attributes and metadata.||
+|[acpi_tables](events/acpi_tables.md)|Firmware ACPI functional table common metadata and content.|version_4.4.2|
+|[apparmor_profiles](events/apparmor_profiles.md)|Track active AppArmor profiles.|version_4.4.2|
+|[apt_sources](events/apt_sources.md)|Current list of APT repositories or software channels.|version_4.4.2|
+|[arp_cache](events/arp_cache.md)|Address resolution cache, both static and dynamic (from ARP, NDP).|version_4.4.2|
+|[atom_packages](events/atom_packages.md)|Lists all atom packages in a directory or globally installed in a system.|version_4.4.2|
+|[augeas](events/augeas.md)|Configuration files parsed by augeas.|version_4.4.2|
+|[authorized_keys](events/authorized_keys.md)|A line-delimited authorized_keys table.|version_4.4.2|
+|[azure_instance_metadata](events/azure_instance_metadata.md)|Azure instance metadata.|version_4.4.2|
+|[azure_instance_tags](events/azure_instance_tags.md)|Azure instance tags.|version_4.4.2|
+|[block_devices](events/block_devices.md)|Block (buffered access) device file nodes: disks, ramdisks, and DMG containers.|version_4.4.2|
+|[carbon_black_info](events/carbon_black_info.md)|Returns info about a Carbon Black sensor install.|version_4.4.2|
+|[carves](events/carves.md)|Forensic Carves.|version_4.4.2|
+|[chrome_extensions](events/chrome_extensions.md)|Chrome browser extensions.|version_4.4.2|
+|[cpu_time](events/cpu_time.md)|Displays information from /proc/stat file about the time the cpu cores spent in different parts of the system.|version_4.4.2|
+|[cpuid](events/cpuid.md)|Useful CPU features from the cpuid ASM call.|version_4.4.2|
+|[crontab](events/crontab.md)|Line parsed values from system and user cron/tab.|version_4.4.2|
+|[curl](events/curl.md)|Perform an http request and return stats about it.|version_4.4.2|
+|[curl_certificate](events/curl_certificate.md)|Inspect TLS certificates by connecting to input hostnames.|version_4.4.2|
+|[deb_packages](events/deb_packages.md)|The installed DEB package database.|version_4.4.2|
+|[device_file](events/device_file.md)|Similar to the file table, but use TSK and allow block address access.|version_4.4.2|
+|[device_hash](events/device_hash.md)|Similar to the hash table, but use TSK and allow block address access.|version_4.4.2|
+|[device_partitions](events/device_partitions.md)|Use TSK to enumerate details about partitions on a disk device.|version_4.4.2|
+|[disk_encryption](events/disk_encryption.md)|Disk encryption status and information.|version_4.4.2|
+|[dns_resolvers](events/dns_resolvers.md)|Resolvers used by this host.|version_4.4.2|
+|[docker_container_labels](events/docker_container_labels.md)|Docker container labels.|version_4.4.2|
+|[docker_container_mounts](events/docker_container_mounts.md)|Docker container mounts.|version_4.4.2|
+|[docker_container_networks](events/docker_container_networks.md)|Docker container networks.|version_4.4.2|
+|[docker_container_ports](events/docker_container_ports.md)|Docker container ports.|version_4.4.2|
+|[docker_container_processes](events/docker_container_processes.md)|Docker container processes.|version_4.4.2|
+|[docker_container_stats](events/docker_container_stats.md)|Docker container statistics. Queries on this table take at least one second.|version_4.4.2|
+|[docker_containers](events/docker_containers.md)|Docker containers information.|version_4.4.2|
+|[docker_image_labels](events/docker_image_labels.md)|Docker image labels.|version_4.4.2|
+|[docker_image_layers](events/docker_image_layers.md)|Docker image layers information.|version_4.4.2|
+|[docker_images](events/docker_images.md)|Docker images information.|version_4.4.2|
+|[docker_info](events/docker_info.md)|Docker system information.|version_4.4.2|
+|[docker_network_labels](events/docker_network_labels.md)|Docker network labels.|version_4.4.2|
+|[docker_networks](events/docker_networks.md)|Docker networks information.|version_4.4.2|
+|[docker_version](events/docker_version.md)|Docker version information.|version_4.4.2|
+|[docker_volume_labels](events/docker_volume_labels.md)|Docker volume labels.|version_4.4.2|
+|[docker_volumes](events/docker_volumes.md)|Docker volumes information.|version_4.4.2|
+|[ec2_instance_metadata](events/ec2_instance_metadata.md)|EC2 instance metadata.|version_4.4.2|
+|[ec2_instance_tags](events/ec2_instance_tags.md)|EC2 instance tag key value pairs.|version_4.4.2|
+|[elf_dynamic](events/elf_dynamic.md)|ELF dynamic section information.|version_4.4.2|
+|[elf_info](events/elf_info.md)|ELF file information.|version_4.4.2|
+|[elf_sections](events/elf_sections.md)|ELF section information.|version_4.4.2|
+|[elf_segments](events/elf_segments.md)|ELF segment information.|version_4.4.2|
+|[elf_symbols](events/elf_symbols.md)|ELF symbol list.|version_4.4.2|
+|[etc_hosts](events/etc_hosts.md)|Line-parsed /etc/hosts.|version_4.4.2|
+|[etc_protocols](events/etc_protocols.md)|Line-parsed /etc/protocols.|version_4.4.2|
+|[etc_services](events/etc_services.md)|Line-parsed /etc/services.|version_4.4.2|
+|[example](events/example.md)|This is an example table spec.|version_4.4.2|
+|[file](events/file.md)|Interactive filesystem attributes and metadata.|version_4.4.2|
+|[file_events](events/file_events.md)|Track time/action changes to files specified in configuration data.|version_4.4.2|
+|[firefox_addons](events/firefox_addons.md)|Firefox browser extensions, webapps, and addons.|version_4.4.2|
+|[groups](events/groups.md)|Local system groups.|version_4.4.2|
+|[hardware_events](events/hardware_events.md)|Hardware (PCI/USB/HID) events from UDEV or IOKit.|version_4.4.2|
+|[hash](events/hash.md)|Filesystem hash data.|version_4.4.2|
+|[hvci_status](events/hvci_status.md)|Retrieve HVCI info of the machine.|version_4.4.2|
+|[intel_me_info](events/intel_me_info.md)|Intel ME/CSE Info.|version_4.4.2|
+|[interface_addresses](events/interface_addresses.md)|Network interfaces and relevant metadata.|version_4.4.2|
+|[interface_details](events/interface_details.md)|Detailed information and stats of network interfaces.|version_4.4.2|
+|[interface_ipv6](events/interface_ipv6.md)|IPv6 configuration and stats of network interfaces.|version_4.4.2|
+|[iptables](events/iptables.md)|Linux IP packet filtering and NAT tool.|version_4.4.2|
+|[kernel_info](events/kernel_info.md)|Basic active kernel information.|version_4.4.2|
+|[kernel_modules](events/kernel_modules.md)|Linux kernel modules both loaded and within the load search path.|version_4.4.2|
+|[known_hosts](events/known_hosts.md)|A line-delimited known_hosts table.|version_4.4.2|
+|[last](events/last.md)|System logins and logouts.|version_4.4.2|
+|[listening_ports](events/listening_ports.md)|Processes with listening (bound) network sockets/ports.|version_4.4.2|
+|[lldp_neighbors](events/lldp_neighbors.md)|LLDP neighbors of interfaces.|version_4.4.2|
+|[load_average](events/load_average.md)|Displays information about the system wide load averages.|version_4.4.2|
+|[logged_in_users](events/logged_in_users.md)|Users with an active shell on the system.|version_4.4.2|
+|[magic](events/magic.md)|Magic number recognition library table.|version_4.4.2|
+|[md_devices](events/md_devices.md)|Software RAID array settings.|version_4.4.2|
+|[md_drives](events/md_drives.md)|Drive devices used for Software RAID.|version_4.4.2|
+|[md_personalities](events/md_personalities.md)|Software RAID setting supported by the kernel.|version_4.4.2|
+|[memory_array_mapped_addresses](events/memory_array_mapped_addresses.md)|Data associated for address mapping of physical memory arrays.|version_4.4.2|
+|[memory_arrays](events/memory_arrays.md)|Data associated with collection of memory devices that operate to form a memory address.|version_4.4.2|
+|[memory_device_mapped_addresses](events/memory_device_mapped_addresses.md)|Data associated for address mapping of physical memory devices.|version_4.4.2|
+|[memory_devices](events/memory_devices.md)|Physical memory device (type 17) information retrieved from SMBIOS.|version_4.4.2|
+|[memory_error_info](events/memory_error_info.md)|Data associated with errors of a physical memory array.|version_4.4.2|
+|[memory_info](events/memory_info.md)|Main memory information in bytes.|version_4.4.2|
+|[memory_map](events/memory_map.md)|OS memory region map.|version_4.4.2|
+|[mounts](events/mounts.md)|System mounted devices and filesystems (not process specific).|version_4.4.2|
+|[msr](events/msr.md)|Various pieces of data stored in the model specific register per |version_4.4.2|
+|[npm_packages](events/npm_packages.md)|Lists all npm packages in a directory or globally installed in a system.|version_4.4.2|
+|[oem_strings](events/oem_strings.md)|OEM defined strings retrieved from SMBIOS.|version_4.4.2|
+|[opera_extensions](events/opera_extensions.md)|Opera browser extensions.|version_4.4.2|
+|[os_version](events/os_version.md)|A single row containing the operating system name and version.|version_4.4.2|
+|[osquery_events](events/osquery_events.md)|Information about the event publishers and subscribers.|version_4.4.2|
+|[osquery_extensions](events/osquery_extensions.md)|List of active osquery extensions.|version_4.4.2|
+|[osquery_flags](events/osquery_flags.md)|Configurable flags that modify osquery's behavior.|version_4.4.2|
+|[osquery_info](events/osquery_info.md)|Top level information about the running version of osquery.|version_4.4.2|
+|[osquery_packs](events/osquery_packs.md)|Information about the current query packs that are loaded in osquery.|version_4.4.2|
+|[osquery_registry](events/osquery_registry.md)|List the osquery registry plugins.|version_4.4.2|
+|[osquery_schedule](events/osquery_schedule.md)|Information about the current queries that are scheduled in osquery.|version_4.4.2|
+|[pci_devices](events/pci_devices.md)|PCI devices active on the host system.|version_4.4.2|
+|[platform_info](events/platform_info.md)|Information about EFI/UEFI/ROM and platform/boot.|version_4.4.2|
+|[portage_keywords](events/portage_keywords.md)|A summary about portage configurations like keywords, mask and unmask.|version_4.4.2|
+|[portage_packages](events/portage_packages.md)|List of currently installed packages.|version_4.4.2|
+|[portage_use](events/portage_use.md)|List of enabled portage USE values for specific package.|version_4.4.2|
+|[process_envs](events/process_envs.md)|A key/value table of environment variables for each process.|version_4.4.2|
+|[process_events](events/process_events.md)|Track time/action process executions.|version_4.4.2|
+|[process_file_events](events/process_file_events.md)|A File Integrity Monitor implementation using the audit service.|version_4.4.2|
+|[process_memory_map](events/process_memory_map.md)|Process memory mapped files and pseudo device/regions.|version_4.4.2|
+|[process_namespaces](events/process_namespaces.md)|Linux namespaces for processes running on the host system.|version_4.4.2|
+|[process_open_files](events/process_open_files.md)|File descriptors for each process.|version_4.4.2|
+|[process_open_pipes](events/process_open_pipes.md)|Pipes and partner processes for each process.|version_4.4.2|
+|[process_open_sockets](events/process_open_sockets.md)|Processes which have open network sockets on the system.|version_4.4.2|
+|[processes](events/processes.md)|All running processes on the host system.|version_4.4.2|
+|[prometheus_metrics](events/prometheus_metrics.md)|Retrieve metrics from a Prometheus server.|version_4.4.2|
+|[python_packages](events/python_packages.md)|Python packages installed in a system.|version_4.4.2|
+|[routes](events/routes.md)|The active route table for the host system.|version_4.4.2|
+|[rpm_package_files](events/rpm_package_files.md)|RPM packages that are currently installed on the host system.|version_4.4.2|
+|[rpm_packages](events/rpm_packages.md)|RPM packages that are currently installed on the host system.|version_4.4.2|
+|[selinux_events](events/selinux_events.md)|Track SELinux events.|version_4.4.2|
+|[selinux_settings](events/selinux_settings.md)|Track active SELinux settings.|version_4.4.2|
+|[shadow](events/shadow.md)|Local system users encrypted passwords and related information. Please note, that you usually need superuser rights to access `/etc/shadow`.|version_4.4.2|
+|[shared_memory](events/shared_memory.md)|OS shared memory regions.|version_4.4.2|
+|[shell_history](events/shell_history.md)|A line-delimited (command) table of per-user .*_history data.|version_4.4.2|
+|[smart_drive_info](events/smart_drive_info.md)|Drive information read by SMART controller utilizing autodetect.|version_4.4.2|
+|[smbios_tables](events/smbios_tables.md)|BIOS (DMI) structure common details and content.|version_4.4.2|
+|[socket_events](events/socket_events.md)|Track network socket opens and closes.|version_4.4.2|
+|[ssh_configs](events/ssh_configs.md)|A table of parsed ssh_configs.|version_4.4.2|
+|[sudoers](events/sudoers.md)|Rules for running commands as other users via sudo.|version_4.4.2|
+|[suid_bin](events/suid_bin.md)|suid binaries in common locations.|version_4.4.2|
+|[syslog_events](events/syslog_events.md)||version_4.4.2|
+|[system_controls](events/system_controls.md)|sysctl names, values, and settings information.|version_4.4.2|
+|[system_info](events/system_info.md)|System information for identification.|version_4.4.2|
+|[time](events/time.md)|Track current date and time in the system.|version_4.4.2|
+|[ulimit_info](events/ulimit_info.md)|System resource usage limits.|version_4.4.2|
+|[uptime](events/uptime.md)|Track time passed since last boot.|version_4.4.2|
+|[usb_devices](events/usb_devices.md)|USB devices that are actively plugged into the host system.|version_4.4.2|
+|[user_events](events/user_events.md)|Track user events from the audit framework.|version_4.4.2|
+|[user_groups](events/user_groups.md)|Local system user group relationships.|version_4.4.2|
+|[user_ssh_keys](events/user_ssh_keys.md)|Returns the private keys in the users ~/.ssh directory and whether or not they are encrypted.|version_4.4.2|
+|[users](events/users.md)|Local user accounts (including domain accounts that have logged on locally (Windows)).|version_4.4.2|
+|[yara](events/yara.md)|Track YARA matches for files or PIDs.|version_4.4.2|
+|[yara_events](events/yara_events.md)|Track YARA matches for files specified in configuration data.|version_4.4.2|
+|[yum_sources](events/yum_sources.md)|Current list of Yum repositories or software channels.|version_4.4.2|

 ## References
-* [osquery schema 3.2.4 (website)](https://osquery.io/schema/3.2.4)
+* [osquery schema 4.1.2 (website)](https://osquery.io/schema/4.1.2)
 * [osquery schema linux specs (GitHub)](https://github.com/facebook/osquery/tree/master/specs/linux)
@@ -0,0 +1,17 @@
+# Acpi_tables Table
+
+## Description
+Firmware ACPI functional table common metadata and content.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|ACPI table name|`TBD`|
+|TBD|size|INTEGER|Size of compiled table data|`TBD`|
+|TBD|md5|TEXT|MD5 hash of table content|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#acpi_tables)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,19 @@
+# Apparmor_profiles Table
+
+## Description
+Track active AppArmor profiles.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|path|TEXT|Unique, aa-status compatible, policy identifier.|`TBD`|
+|TBD|name|TEXT|Policy name.|`TBD`|
+|TBD|attach|TEXT|Which executable(s) a profile will attach to.|`TBD`|
+|TBD|mode|TEXT|How the policy is applied.|`TBD`|
+|TBD|sha1|TEXT|A unique hash that identifies this policy.|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#apparmor_profiles)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,22 @@
+# Apt_sources Table
+
+## Description
+Current list of APT repositories or software channels.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Repository name|`TBD`|
+|TBD|source|TEXT|Source file|`TBD`|
+|TBD|base_uri|TEXT|Repository base URI|`TBD`|
+|TBD|release|TEXT|Release name|`TBD`|
+|TBD|version|TEXT|Repository source version|`TBD`|
+|TBD|maintainer|TEXT|Repository maintainer|`TBD`|
+|TBD|components|TEXT|Repository components|`TBD`|
+|TBD|architectures|TEXT|Repository architectures|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#apt_sources)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Arp_cache Table
+
+## Description
+Address resolution cache, both static and dynamic (from ARP, NDP).
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|address|TEXT|IPv4 address target|`TBD`|
+|TBD|mac|TEXT|MAC address of broadcasted address|`TBD`|
+|TBD|interface|TEXT|Interface of the network for the MAC|`TBD`|
+|TBD|permanent|TEXT|1 for true, 0 for false|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#arp_cache)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,21 @@
+# Atom_packages Table
+
+## Description
+Lists all atom packages in a directory or globally installed in a system.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|name|TEXT|Package display name|`TBD`|
+|TBD|version|TEXT|Package supplied version|`TBD`|
+|TBD|description|TEXT|Package supplied description|`TBD`|
+|TBD|path|TEXT|Package's package.json path|`TBD`|
+|TBD|license|TEXT|License for package|`TBD`|
+|TBD|homepage|TEXT|Package supplied homepage|`TBD`|
+|TBD|uid|BIGINT|The local user that owns the plugin|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#atom_packages)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,18 @@
+# Augeas Table
+
+## Description
+Configuration files parsed by augeas.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|node|TEXT|The node path of the configuration item|`TBD`|
+|TBD|value|TEXT|The value of the configuration item|`TBD`|
+|TBD|label|TEXT|The label of the configuration item|`TBD`|
+|TBD|path|TEXT|The path to the configuration file|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#augeas)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,17 @@
+# Authorized_keys Table
+
+## Description
+A line-delimited authorized_keys table.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|uid|BIGINT|The local owner of authorized_keys file|`TBD`|
+|TBD|key|TEXT|parsed authorized keys line|`TBD`|
+|TBD|key_file|TEXT|Path to the authorized_keys file|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#authorized_keys)
+
+## Tags
+* version_4.4.2
@@ -0,0 +1,30 @@
+# Azure_instance_metadata Table
+
+## Description
+Azure instance metadata.
+
+## Data Dictionary
+|Standard Name|Field Name|Type|Description|Sample Value|
+|---|---|---|---|---|
+|TBD|location|TEXT|Azure Region the VM is running in|`TBD`|
+|TBD|name|TEXT|Name of the VM|`TBD`|
+|TBD|offer|TEXT|Offer information for the VM image (Azure image gallery VMs only)|`TBD`|
+|TBD|publisher|TEXT|Publisher of the VM image|`TBD`|
+|TBD|sku|TEXT|SKU for the VM image|`TBD`|
+|TBD|version|TEXT|Version of the VM image|`TBD`|
+|TBD|os_type|TEXT|Linux or Windows|`TBD`|
+|TBD|platform_update_domain|TEXT|Update domain the VM is running in|`TBD`|
+|TBD|platform_fault_domain|TEXT|Fault domain the VM is running in|`TBD`|
+|TBD|vm_id|TEXT|Unique identifier for the VM|`TBD`|
+|TBD|vm_size|TEXT|VM size|`TBD`|
+|TBD|subscription_id|TEXT|Azure subscription for the VM|`TBD`|
+|TBD|resource_group_name|TEXT|Resource group for the VM|`TBD`|
+|TBD|placement_group_id|TEXT|Placement group for the VM scale set|`TBD`|
+|TBD|vm_scale_set_name|TEXT|VM scale set name|`TBD`|
+|TBD|zone|TEXT|Availability zone of the VM|`TBD`|
+
+## References
+* [OSQuery table documentation](https://osquery.io/schema/current#azure_instance_metadata)
+
+## Tags
+* version_4.4.2
--- a/Show More
+++ b/Show More