Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

Linux

Windows

ChromeOS

app_sso_platform

Returns device and login information parsed from the "app-sso platform -s" command ("Platform SSO" extensions).

Column	Type	Description
device_id	text	Device ID extracted from "Device Configuration" -> "deviceSigningCertificate" -> Subject -> CommonName.
extension_identifier	text	Extension identifier of the Platform SSO extension (e.g. "com.microsoft.CompanyPortalMac.ssoextension"). Required in `WHERE` clause
realm	text	Realm of the user that logged via Platform SSO (e.g. "KERBEROS.MICROSOFTONLINE.COM"). Required in `WHERE` clause
user_principal_name	text	User principal name of the user that logged in via Platform SSO.

Example

Check Platform SSO configuration by getting the device ID and and user principal name (UPN).

SELECT device_id, user_principal_name FROM app_sso_platform WHERE extension_identifier = 'com.microsoft.CompanyPortalMac.ssoextension' AND realm = 'KERBEROS.MICROSOFTONLINE.COM';