Solutions
Device management
Remotely manage, and protect laptops and mobile devices.
Orchestration
Automate tasks across devices, from app installs to scripts.
Software management
Inventory, patch, and manage installed software.
Extend Fleet
Integrate your favorite tools with Fleet.
Customers
Stripe + Fleet
Stripe consolidates multiple tools with Fleet.
Foursquare + Fleet
Foursquare quickly migrates to Fleet for device management.
What people are saying
Stories from the Fleet community.
More
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
account_policy_data
Additional macOS user account data from the AccountPolicy section of OpenDirectory, the identity provider used by Apple.
Column | Type | Description |
---|---|---|
creation_time | double | When the account was first created |
failed_login_count | bigint | The number of failed login attempts using an incorrect password. Count resets after a correct password is entered. |
failed_login_timestamp | double | The time of the last failed login attempt. Resets after a correct password is entered |
password_last_set_time | double | The time the password was last changed |
uid | bigint | User ID |
Query the creation date of user accounts. You could also query the date of the last failed login attempt or password change.
SELECT strftime('%Y-%m-%d %H:%M:%S',creation_time,'unixepoch') AS creationdate FROM account_policy_data;
See each user's last password set date and number of failed logins since last successful login to detect any intrusion attempts.
SELECT u.username, u.uid, strftime('%Y-%m-%dT%H:%M:%S', a.password_last_set_time, 'unixepoch') AS password_last_set_time, a.failed_login_count, strftime('%Y-%m-%dT%H:%M:%S', a.failed_login_timestamp, 'unixepoch') AS failed_login_timestamp FROM account_policy_data AS a CROSS JOIN users AS u USING (uid) ORDER BY password_last_set_time ASC;
~
) on a server, and then log in and get that folder wherever they are. (These days, this use case is more uncommon.)