Tables

Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.

Apple

corestorage_logical_volume_families

Information about CoreStorage Logical Volume Families from the diskutil coreStorage list -plist command.

Column	Type	Description
EncryptionStatus	text	Unlock status of the logical volume family, e.g. "Locked" or "Unlocked"
EncryptionType	text	Encryption algorithm for the logical volume family, normally "AES-XTS" or "None"
HasVisibleUsers	integer	Undocumented field returned from `diskutil cs info`
HasVolumeKey	integer	Whether there is an encryption key assigned for the logical volume
IsAcceptingNewUsers	integer	Whether new users may be granted access to the logical volume family encryption key
IsFullySecure	integer	Undocumented field returned from `diskutil cs info`
MayHaveEncryptedEvents	integer	Undocumented field returned from `diskutil cs info`
RequiresPasswordUnlock	integer	Whether a password is currently required to unlock the volume
UUID	text	Unique ID of the logical volume family
vg_FreeSpace	bigint	Amount of space, in bytes, in the volume group that have not been allocated by any logical volume
vg_FusionDrive	integer	Whether the volume group is a "fusion drive" (i.e. SSHD)
vg_Name	text	The customizable name of the volume group
vg_Sequence	bigint	Current sequence number of the volume group
vg_Size	bigint	Total (i.e. either allocated or unallocated) size of the volume group
vg_Sparse	integer	Whether the volume group allows overcommitting storage
vg_Status	text	Status of the volume group, e.g. "Online"
vg_UUID	text	The unique identifier of the containing volume group
vg_Version	integer	The version of the volume group, probably 1