Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
codesign
Retrieves codesign information of a given .app path. It doesn't perform (expensive) verification, it just parses the signature from the 'Contents' folder using the "codesign --display" command.
Column | Type | Description |
---|---|---|
path | text | Path is the absolute path to the app folder. Required in WHERE clause |
team_identifier | text | Unique 10-character string generated by Apple that's assigned to a developer account to sign packages. This value is empty on unsigned applications and built-in Apple applications. |
This table is not a core osquery table. It is included as part of Fleet's agent (fleetd).