Meta pixel

Locate device assets in the event of an emergency.


| The author's GitHub profile picture

Zach Wasserman

Locate device assets in the event of an emergency.

A simple query for IP-Geolocation

Locate device assets in the event of an emergency

In the event of an emergency or public safety concern, osquery can be easily used to identify employees the direct vicinity, so that teams can push warnings or safety precautions to their staff.

This simple strategy for obtaining the location of an osquery device utilizes the API to retrieve the IP geolocation of the device. Note that the device must be able to connect to the internet over HTTP, and the calculated location may be skewed by VPN, proxies, etc.


SELECT JSON_EXTRACT(result, '$.ip') AS ip,
 JSON_EXTRACT(result, '$.city') AS city,
 JSON_EXTRACT(result, '$.region') AS region,
 JSON_EXTRACT(result, '$.country') AS country
FROM curl
WHERE url = '';

Sample result:

| ip           | city       | region     | country |
| | Sacramento | California | US      |

Other techniques A common technique for geolocation of macOS devices with osquery is to use the wifi_survey table in combination with the Google Geolocation API. This strategy has become more difficult to use due to security controls introduced in macOS 10.15, and poses privacy concerns due to the precision of the location data returned by the API.

Explore Fleet

Find out how Fleet can benefit your organization by exploring our docs and community.
Want to get up and running quicker? Then try out Fleet locally on your device - you’ll be up and running in minutes.