Create system_profiler.yml

schema/tables/system_profiler.yml

@@ -0,0 +1,87 @@
+name: system_profiler
+description: |-
+  The macOS system_profiler binary reports on the hardware and software configuration of a Mac. It can generate detailed, plain text, XML or json reports which can be exported from the Terminal or generated as .spx files and read by the macOS System Information.app based on "data types". 
+examples: |- 
+
+  Collect Mac Activation Lock Status:
+
+  ```
+  SELECT json_extract (value,'$.activation_lock_status')
+  FROM system_profiler
+  WHERE data_type='SPHardwareDataType';
+  ```
+
+  Collect Mac Hardware UUID (platform_uuid):
+
+  ```
+  SELECT json_extract (value,'$.platform_UUID')
+  FROM system_profiler
+  WHERE data_type='SPHardwareDataType';
+  ```
+
+  Collect Mac Serial Number:
+
+  ```
+  SELECT json_extract (value,'$.serial_number')
+  FROM system_profiler
+  WHERE data_type='SPHardwareDataType';
+  ```
+
+notes: |-
+
+  The system_profiler binary is a rich source of macOS data which can be used in many ways to enhance Mac management.
+
+  Not all System Profiler data types are available via the system_profiler osquery table. Some data types are legacy & others are OS version-specific. 
+
+  The following data types are available from the system_profiler binary as of macOS 26:
+
+  - SPParallelATADataType
+  - SPUniversalAccessDataType
+  - SPSecureElementDataType
+  - SPApplicationsDataType
+  - SPAudioDataType
+  - SPBluetoothDataType
+  - SPCameraDataType
+  - SPCardReaderDataType
+  - SPiBridgeDataType
+  - SPDeveloperToolsDataType
+  - SPDiagnosticsDataType
+  - SPDisabledSoftwareDataType
+  - SPDiscBurningDataType
+  - SPEthernetDataType
+  - SPExtensionsDataType
+  - SPFibreChannelDataType
+  - SPFirewallDataType
+  - SPFontsDataType
+  - SPFrameworksDataType
+  - SPDisplaysDataType
+  - SPHardwareDataType
+  - SPInstallHistoryDataType
+  - SPInternationalDataType
+  - SPNetworkLocationDataType
+  - SPLogsDataType
+  - SPManagedClientDataType
+  - SPMemoryDataType
+  - SPNVMeDataType
+  - SPNetworkDataType
+  - SPPCIDataType
+  - SPParallelSCSIDataType
+  - SPPowerDataType
+  - SPPrefPaneDataType
+  - SPPrintersSoftwareDataType
+  - SPPrintersDataType
+  - SPConfigurationProfileDataType
+  - SPRawCameraDataType
+  - SPLegacySoftwareDataType
+  - SPSASDataType
+  - SPSerialATADataType
+  - SPSPIDataType
+  - SPSmartCardsDataType
+  - SPSoftwareDataType
+  - SPStartupItemDataType
+  - SPStorageDataType
+  - SPSyncServicesDataType
+  - SPThunderboltDataType
+  - SPUSBHostDataType
+  - SPNetworkVolumeDataType
+  - SPAirPortDataType