osquery_policy
| Column |
Type |
PK |
Required |
Default |
| osquery_policy_id |
VARCHAR |
Yes |
Yes |
|
| policy_group |
TEXT |
No |
No |
|
| policy_name |
TEXT |
No |
Yes |
|
| osquery_code |
TEXT |
No |
Yes |
|
| policy_description |
TEXT |
No |
Yes |
|
| policy_pass_label |
TEXT |
No |
Yes |
'Pass' |
| policy_fail_label |
TEXT |
No |
Yes |
'Fail' |
| policy_pass_remarks |
TEXT |
No |
No |
|
| policy_fail_remarks |
TEXT |
No |
No |
|
| osquery_platforms |
TEXT |
No |
No |
|
| created_at |
TIMESTAMPTZ |
No |
No |
CURRENT_TIMESTAMP |
| created_by |
TEXT |
No |
No |
'UNKNOWN' |
| updated_at |
TIMESTAMPTZ |
No |
No |
|
| updated_by |
TEXT |
No |
No |
|
| deleted_at |
TIMESTAMPTZ |
No |
No |
|
| deleted_by |
TEXT |
No |
No |
|
| activity_log |
TEXT |
No |
No |
|
Foreign Keys
Indexes
| Column Name |
Index Name |
| policy_name |
sqlite_autoindex_osquery_policy_2 |
| osquery_code |
sqlite_autoindex_osquery_policy_2 |
| osquery_policy_id |
sqlite_autoindex_osquery_policy_1 |
SQL DDL
CREATE TABLE "osquery_policy" (
"osquery_policy_id" VARCHAR PRIMARY KEY NOT NULL,
"policy_group" TEXT,
"policy_name" TEXT NOT NULL,
"osquery_code" TEXT NOT NULL,
"policy_description" TEXT NOT NULL,
"policy_pass_label" TEXT NOT NULL DEFAULT 'Pass',
"policy_fail_label" TEXT NOT NULL DEFAULT 'Fail',
"policy_pass_remarks" TEXT,
"policy_fail_remarks" TEXT,
"osquery_platforms" TEXT,
"created_at" TIMESTAMPTZ DEFAULT CURRENT_TIMESTAMP,
"created_by" TEXT DEFAULT 'UNKNOWN',
"updated_at" TIMESTAMPTZ,
"updated_by" TEXT,
"deleted_at" TIMESTAMPTZ,
"deleted_by" TEXT,
"activity_log" TEXT,
UNIQUE("policy_name", "osquery_code")
)