我对运行 osqueryi.exe 时可以看到的一些可用表感到好奇。
我有这些桌子。
osquery> .tables
=> appcompat_shims
=> arp_cache
=> authenticode
=> autoexec
=> bitlocker_info
=> carbon_black_info
=> carves
=> certificates
=> chocolatey_packages
...
然后我想知道其中的一些，例如我在这里查找了进程表的来源。
那里有一堆描述，架构命令没有显示......问题是......有没有办法查看似乎在源代码中的元数据？
osquery> .schema processes
CREATE TABLE processes(`pid` BIGINT,
`name` TEXT,
`path` TEXT,
`cmdline` TEXT,
`state` TEXT,
`cwd` TEXT,
`root` TEXT,
`uid` BIGINT,
`gid` BIGINT,
`euid` BIGINT,
`egid` BIGINT,
`suid` BIGINT,
`sgid` BIGINT,
`on_disk` INTEGER,
`wired_size` BIGINT,
`resident_size` BIGINT,
`total_size` BIGINT,
`user_time` BIGINT,
`system_time` BIGINT,
`disk_bytes_read` BIGINT,
`disk_bytes_written` BIGINT,
`start_time` BIGINT,
`parent` BIGINT,
`pgroup` BIGINT,
`threads` INTEGER,
`nice` INTEGER,
`is_elevated_token` INTEGER,
`elapsed_time` BIGINT,
`handle_count` BIGINT,
`percent_processor_time` BIGINT,
`upid` BIGINT HIDDEN,
`uppid` BIGINT HIDDEN,
`cpu_type` INTEGER HIDDEN,
`cpu_subtype` INTEGER HIDDEN,
`phys_footprint` BIGINT HIDDEN,
PRIMARY KEY (`pid`)) WITHOUT ROWID;