Solutions
Device management
Remotely manage, and protect laptops and mobile devices.
Orchestration
Automate tasks across devices, from app installs to scripts.
Software management
Inventory, patch, and manage installed software.
Infrastructure as code
See every change, undo any error, repeat every success.
Extend Fleet
Integrate your favorite tools with Fleet.
Customers
Pricing
More
Device management
Remotely manage, and protect laptops and mobile devices.
Orchestration
Automate tasks across devices, from app installs to scripts.
Software management
Inventory, patch, and manage installed software.
Infrastructure as code
See every change, undo any error, repeat every success.
Extend Fleet
Integrate your favorite tools with Fleet.
Tables
Fleet uses osquery tables to query operating system, hardware, and software data. Each table provides specific data for analysis and filtering.
Apple
Linux
Windows
ChromeOS
crowdstrike_falcon
crowdstrike_falcon
Information about Crowdstrike Falcon, collected via the falconctl utility.
| Column | Type | Description |
|---|---|---|
| agent_id | text | The agent ID for the current install of Falcon |
| cid | text | The CrowdStrike customer ID |
| falcon_version | text | The version of Falcon Sensor installed |
| reduced_functionality_mode | text | Whether Falcon Sensor is in reduced functionality mode (true/false) |
| sensor_loaded | text | Whether Falcon Sensor is loaded (true/false) |
Example
Get the agent ID of the CrowdStrike Falcon agent on all macOS and Linux hosts.
SELECT agent_id FROM crowdstrike_falcon;Output most table information, swapping customer ID for its length to avoid leaking sensitive information.
SELECT agent_id, LENGTH(cid), falcon_version, reduced_functionality_mode, sensor_loaded FROM crowdstrike_falcon;Notes
This table is from the Mac Admins osquery extension.
Questions?
SOC2 Type 2
