osquery-site
osquery-site copied to clipboard
Table schema is missing "architecture support"
Several tables are architecture-specific now, existing or producing results only in x86 builds of osquery (and at a future date, probably ones specific to ARM).
The schema, and the website's view of it, doesn't expose this information for the user, as several people have noted.
I think this belongs in the osquery repo -- that's where the schema is generated. We'll need to update the website to consume it, once it exists though
An (interim) attempt at addressing this is here: https://github.com/osquery/osquery/pull/7650
It's just language in the description of each table.
I don't think description text is enough. I think we need to think about how to surface supported architectures, and not just platforms.
I can't quite decide if it's simple, of if we need to surface things as the intersection between arch and platform