Improvements to VQL reference documentation and minor fixes (#949)

Also includes changes from Velocidex/velociraptor#3914
Velocidex · Nov 26, 2024 · 53ba3bb · 53ba3bb
1 parent f665b1e
commit 53ba3bb
Show file tree

Hide file tree

Showing 383 changed files with 894 additions and 611 deletions.
diff --git a/.wordlist.txt b/.wordlist.txt
@@ -1551,7 +1551,6 @@ vhdx
 vmdk
 --------------------------------------------------------------------------------
 
-Misspelled words:
 <url-free> content/blog/2024/2024-09-10-release-notes-0.73/_index.md
 --------------------------------------------------------------------------------
 Paginator
@@ -1562,7 +1561,6 @@ timesketch
 vmdk
 --------------------------------------------------------------------------------
 
-Misspelled words:
 <url-free> content/blog/2024/2024-09-12-timelines/_index.md
 --------------------------------------------------------------------------------
 Timelining
@@ -1578,3 +1576,17 @@ CRUU
 KIE
 ds
 AES
+
+<url-free> content/vql_reference/misc/ebpf_events/_index.md
+--------------------------------------------------------------------------------
+ebpf
+
+<url-free> content/vql_reference/misc/watch_ebpf/_index.md
+--------------------------------------------------------------------------------
+eBPF
+tracee
+
+<url-free> content/vql_reference/basic/now/_index.md
+--------------------------------------------------------------------------------
+datetime
+
diff --git a/content/vql_reference/_index.md b/content/vql_reference/_index.md
@@ -12,6 +12,6 @@ pre: <i class="fas fa-book"></i>
 head: <hr>
 ---
 
-Search for documentation on VQL plugins or functions.
+Search for documentation on VQL plugins, functions and accessors.
 
 {{% reference %}}
diff --git a/content/vql_reference/accessors/auto/_index.md b/content/vql_reference/accessors/auto/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## auto
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/bzip2/_index.md b/content/vql_reference/accessors/bzip2/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## bzip2
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/collector/_index.md b/content/vql_reference/accessors/collector/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## collector
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/collector_sparse/_index.md b/content/vql_reference/accessors/collector_sparse/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## collector_sparse
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/data/_index.md b/content/vql_reference/accessors/data/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## data
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/ewf/_index.md b/content/vql_reference/accessors/ewf/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## ewf
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/ext4/_index.md b/content/vql_reference/accessors/ext4/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## ext4
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/fat/_index.md b/content/vql_reference/accessors/fat/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## fat
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/file/_index.md b/content/vql_reference/accessors/file/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## file
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/file_links/_index.md b/content/vql_reference/accessors/file_links/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## file_links
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/file_nocase/_index.md b/content/vql_reference/accessors/file_nocase/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## file_nocase
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/fs/_index.md b/content/vql_reference/accessors/fs/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## fs
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/fs_sparse/_index.md b/content/vql_reference/accessors/fs_sparse/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## fs_sparse
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/gzip/_index.md b/content/vql_reference/accessors/gzip/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## gzip
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/lazy_ntfs/_index.md b/content/vql_reference/accessors/lazy_ntfs/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## lazy_ntfs
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/me/_index.md b/content/vql_reference/accessors/me/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## me
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/mft/_index.md b/content/vql_reference/accessors/mft/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## mft
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/mscfb/_index.md b/content/vql_reference/accessors/mscfb/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## mscfb
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/ntfs/_index.md b/content/vql_reference/accessors/ntfs/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## ntfs
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/ntfs_vss/_index.md b/content/vql_reference/accessors/ntfs_vss/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## ntfs_vss
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/offset/_index.md b/content/vql_reference/accessors/offset/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## offset
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/pipe/_index.md b/content/vql_reference/accessors/pipe/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## pipe
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/process/_index.md b/content/vql_reference/accessors/process/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## process
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/ranged/_index.md b/content/vql_reference/accessors/ranged/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## ranged
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/raw_ext4/_index.md b/content/vql_reference/accessors/raw_ext4/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## raw_ext4
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/raw_file/_index.md b/content/vql_reference/accessors/raw_file/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## raw_file
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/raw_ntfs/_index.md b/content/vql_reference/accessors/raw_ntfs/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## raw_ntfs
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/raw_reg/_index.md b/content/vql_reference/accessors/raw_reg/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## raw_reg
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/reg/_index.md b/content/vql_reference/accessors/reg/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## reg
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/registry/_index.md b/content/vql_reference/accessors/registry/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## registry
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/s3/_index.md b/content/vql_reference/accessors/s3/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## s3
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/scope/_index.md b/content/vql_reference/accessors/scope/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## scope
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/smb/_index.md b/content/vql_reference/accessors/smb/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## smb
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/sparse/_index.md b/content/vql_reference/accessors/sparse/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## sparse
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/ssh/_index.md b/content/vql_reference/accessors/ssh/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## ssh
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/vfs/_index.md b/content/vql_reference/accessors/vfs/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## vfs
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/vhdx/_index.md b/content/vql_reference/accessors/vhdx/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## vhdx
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/vmdk/_index.md b/content/vql_reference/accessors/vmdk/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## vmdk
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description

diff --git a/content/vql_reference/accessors/winpmem/_index.md b/content/vql_reference/accessors/winpmem/_index.md
@@ -11,7 +11,7 @@ no_edit: true
 
 
 ## winpmem
-<span class='vql_type pull-right page-header'>Accessor</span>
+<span class='vql_type label label-warning pull-right page-header'>Accessor</span>
 
 
 ### Description