Schema documentation
Break down of the important information in the schema documentation:
A dropdown lists various versions of Osquery. Choose the version of Osquery you wish to see schema tables for.
The number of tables within the selected version of Osquery. (In the above image, 106 tables are available).
The list of tables is listed in alphabetical order for the selected version of Osquery. This is the same result we get when we use the .table command in the interactive mode.
The name of the table and a brief description.
A detailed chart showing each table’s column, type, and description.
Information to which Operating System the table applies. (In the above image, the account_policy_data table is available only for macOS)
A dropdown menu to select the Operating System of choice. We can choose multiple Operating Systems, which will display the tables available for those Operating systems.